Hot Custody

Overview

Hot custody supports frequent withdrawals, settlements, or treasury operations by keeping keys or signing services available to online systems. It may use secure hardware, policy engines, distributed signing, or managed custody infrastructure rather than exposing a raw private key.

Continuous accessibility increases attack surface. Compromised applications, administrators, APIs, policies, or signing services may reach assets before human intervention. Strong technology does not remove the need to limit the value and permissions available through the hot path.

Operators should cap hot balances, restrict destinations and velocity, separate duties, require step-up approval for exceptional transfers, and sweep excess funds to colder storage. Monitoring must connect transaction intent, authorization, signing, broadcast, and settlement. Incident procedures should revoke access and move remaining value without depending on the compromised environment.

Records for Hot Custody should reconcile on-chain or provider balances with customer entitlements and the internal ledger by asset, network, account, and cutoff. For Hot Custody, pending deposits, locked assets, staking, fees, conversions, forks, unsupported transfers, and manual adjustments require separate treatment and review.

Hot Custody should be distinguished from investment ownership and from a software interface. For example, a provider may display an asset balance while holding pooled assets through another custodian; operations must verify contractual rights, segregation, withdrawal capability, and external evidence rather than rely on the screen alone.

The operating model for Hot Custody should map legal ownership, beneficial entitlement, technical control, account structure, asset segregation, supported networks, signing policy, provider roles, contractual duties, and insolvency treatment. For Hot Custody, these dimensions can belong to different parties and must not be inferred from a wallet label.