A personal hardware wallet and an institutional custody platform are often described using the same vocabulary, cold storage, offline signing, secure hardware, which makes them sound like versions of the same thing at different scales. Structurally, they are not. A hardware wallet protects one private key, held by one person, on one physical device. Institutional custody is usually built so that no single device, location, or person ever holds a complete private key at all. That difference matters for security, and it matters just as much when something has gone wrong and needs to be investigated.
What a hardware wallet actually does
A consumer hardware wallet generates and stores a complete private key inside a small, purpose-built device, isolated from the internet-connected computer or phone used to build a transaction. The key never leaves the device, and transactions are signed inside it before the signature is passed back out. This is a genuinely strong defense against remote compromise, but the key, in its complete form, exists in exactly one place, protected primarily by the physical security of that device and the person holding it.
How institutional custody restructures the problem
Institutional custody generally solves a different problem: not just keeping a key safe from remote attackers, but ensuring no single compromised device, coerced employee, or lost piece of hardware can move funds alone. Two technical approaches dominate. A hardware security module, or HSM, is a certified, tamper-resistant piece of dedicated hardware, often housed in a secured data center rather than an office desk, that generates and uses keys internally without ever exposing the raw key material, even to the institution's own staff or software.
Multi-party computation, or MPC, takes a different approach: instead of one complete private key existing anywhere, the signing capability is split mathematically across multiple independent parties or locations, such that a valid signature can only be produced when a required number of those parties participate, without any single one of them ever holding, or needing to hold, the full key at any point. Functionally this achieves something similar to a multisignature wallet, requiring multiple approvals, but it does so at the cryptographic level rather than through multiple separate on-chain signatures, and it is frequently combined with geographically distributed key shares, so that no single facility, jurisdiction, or individual holds enough of the key material to reconstruct it alone.
The practical effect of MPC and distributed HSM custody is that there is no single point in the system where a complete private key exists, even briefly. Compromising the custody arrangement requires compromising multiple independent components, often in different physical locations, rather than stealing one device or one seed phrase.
Why this changes how an investigation actually runs
When an individual's hardware wallet is compromised, the investigative questions are usually narrow: how was the seed phrase or device physically or remotely accessed, and where did the funds go afterward. When an institutional custody platform reports a loss, the questions are structurally different and considerably broader. Was the loss the result of a genuine cryptographic or infrastructure failure, an access-control policy that was misconfigured or bypassed, an insider with legitimate but misused approval rights, or a failure in the operational process surrounding otherwise sound technology, such as an approval workflow that was rushed or circumvented under social engineering pressure. The technology being defeated is rarely the simplest explanation once MPC or HSM-based custody is involved. The policy and process layer around it usually is.
- Signer and approver logs across every party involved in the distributed signing scheme, not just the party that initiated the transaction.
- The institution's documented access-control and approval policy, and evidence of whether it was actually followed for the transaction in question.
- Infrastructure and access logs for each physical or logical location holding a key share or HSM component.
- A timeline of any recent changes to signer permissions, thresholds, or approval workflows in the period before the loss.
Why this distinction matters to anyone evaluating a custody provider
For an individual, a good hardware wallet paired with disciplined backup practices remains a strong, appropriate standard. For a business or fund holding institutional-scale value, evaluating a custody provider on whether it "uses cold storage" is no longer a meaningful question, since almost every provider will answer yes. The more useful questions are about the structure underneath that label, how many independent parties are required to authorize a transaction, whether key material is ever reconstructed in one place even momentarily, and how access-control policy is enforced and audited, because that structure is what actually determines both how resistant the custody is to a single point of failure, and how an incident would eventually be investigated if something went wrong.