Any institution planning to become a digital asset custody provider must have a way to mitigate the risk posed by the absolute finality of digital asset transactions vs. “traditional” financial payment rails.
SWIFT and ACH transactions are relatively slow and costly compared to stable coins and other digital assets, but they are also reversible. Every year, a material percentage of transactions are reversed due to fraud or misdirection.
With digital assets, reversal is not an option.
A single party that possesses a wallet owner's private key can irreversibly finalize a transaction in seconds. Fast, irreversible compromise is part of the reason why criminals were able to steal over $3.4 billion in digital assets last year.
In the recent past, the risks created from digital asset theft and private key compromise were held primarily by individuals and niche brokers. Today, or at least very soon, these risks will be something that small and medium-sized banks, used to dealing with an entirely different financial system, will have to account for.
From our point of view, the central point of risk in all digital asset custody infrastructure is execution authority, and the best way to build safer execution authority is to distribute that authority. Here’s how.
Traditional financial infrastructure treats ownership as a legal and administrative construct in the sense that a bank holds a ledger entry that says a customer owns an asset.
If someone fraudulently moves that asset, the ledger can be corrected, and the transaction reversed or the counterparty pursued. In this environment, custody is control of the record, and secrets management must focus on the secrets that protect that record.
Tokenized rails fundamentally change this model. On a blockchain, ownership is a cryptographic construct where there is no central ledger administrator and thus also no reversal mechanism.
Ownership of a digital asset is defined purely by possession of the private key associated with an asset's address. The big change here is that the private key becomes, de facto, the asset itself, and protecting the key is the custody function.
This concentration of ownership creates a secret management problem unlike anything in traditional banking.
Any point in that lifecycle where the full key is exposed will rapidly become the single point of compromise that a threat actor needs to make a fraudulent transaction.
Safe digital asset custody means the private key must be generated, stored, used for signing, and potentially recovered or rotated, all without ever existing as a complete, extractable object in a single location.
The clear risk here is that a single failure in a bank's asset custody infrastructure could immediately expose its customers to irreversible financial loss. This leaves the onus on the bank to provide total security through the custody chain.
We are seeing a reflection of this challenge in emerging digital asset-focused regulations and guidance, such as the EU’s MiCA and the 2025 US interagency crypto safekeeping statement, which require banks to demonstrate they are not concentrating risk with a single provider.
The clear expectation from regulators is that risk must be deconcentrated. This will also extend to situations where banks use sub-custodians like Copper, BitGo, Cobo, Anchorage, or Fireblocks to provide institutional asset management services.
In fact, when banks lean on custodial services supplied by third parties, it's likely that further financial industry third-party risk requirements from regulators will also apply.
In the US, NYDFS and the SEC's S-P guidance impacts what must happen when a bank hands private key management to a custody vendor. In the EU, or for banks with EU customers, DORA Article 9 rules around access control will also apply to digital assets.
The common ground between all these regulations is that there cannot be an observable single point of failure in your environment.
Private keys, whether your bank’s or your customers', cannot be in one place, with one vendor, accessible through a single party's control. The only way to respond is to use infrastructure that guarantees that no single point of failure exists.
Digital asset custody security and the regulatory requirements surrounding the space translate into three operational imperatives:
Larger banks will be able to build systems that address these points internally, but small banks and other smaller financial institutions are going to depend on a qualified custodian or a custody technology partner. Although working with a custodian creates a dependency, this dependency can be mitigated with a secrets management tool like SplitSecure.
SplitSecure is an additional layer of assurance that small or mid-size institutions can deploy alongside their digital asset custody provider to architecturally prevent a single point of failure from emerging.
SplitSecure uses Shamir Secret Sharing to split private keys across a group of devices you control, so threat actors would need to compromise multiple devices simultaneously (a ‘threshold') to access protected secrets or private keys.
When a bank uses SplitSecure on top of its digital asset custody stack, it can demonstrate by default that no single device ever persists the protected credentials and that reconstructing a key requires a threshold of devices to collaborate.
The technology SplitSecure uses to enable this (Shamir Secret Sharing) was once the preserve of institutions with dedicated cryptographic teams, but is now available out of the box to any institution and deployable by any IT person.
If you work with a custody provider like Fireblocks, Anchorage, or BitGo, SplitSecure layers on top.
Your custody provider handles transaction execution and key operations. SplitSecure ensures that the private keys underlying those operations are not dependent on a single system or a single vendor. If your custody provider experiences a breach or an outage, the key material remains distributed across devices you control.
The single point of failure is eliminated without replacing the tools your team already uses.
SplitSecure is designed to give small and mid-market banks and regional institutions the ability to future-proof their digital asset custody plans against regulatory requirements for key management, audit trails, and third-party risk management.
Our solution stops breaches that could compromise private keys without the complexity of building a dedicated custody engineering team.
Our Blog
