How Bitcoin ETF Custody Actually Works (Coinbase, Fidelity, BitGo)
A plumbing-level look at how a spot Bitcoin ETF holds its coins — which fund uses which custodian, how many now use two or more, and what "proof of reserves" does not verify.
TL;DR. A spot Bitcoin ETF outsources the actual holding of bitcoin to a qualified custodian — for most US funds that is Coinbase Custody Trust Company, a New York-chartered trust company. Coins sit in offline (cold) wallets, segregated per fund. The picture has changed since launch: several funds now name two or more custodians, so the category is less monolithic than it was in 2024, even though Coinbase still holds the large majority of the assets. Custody is genuinely robust plumbing — but it is not self-custody, and "proof of reserves" verifies less than its name suggests.
The legal stack: trust, sponsor, custodian
A spot Bitcoin ETF is structured as a grantor trust under US law. Four roles matter:
- Sponsor. The fund manager (BlackRock, Fidelity, Invesco, Franklin and so on) that markets the product, files with the SEC and earns the fee. The sponsor never touches the coins.
- Bitcoin custodian. A regulated entity that holds the bitcoin, controls the private keys and moves coins on the sponsor's instructions.
- Administrator and cash custodian. Usually BNY Mellon, which calculates NAV, acts as transfer agent and holds any cash. It never holds bitcoin.
- Authorised participants. Broker-dealers who deliver cash or coin to the trust in exchange for new shares, and vice versa. BlackRock's filings name Jane Street, Virtu Americas, JP Morgan Securities and Marex Capital Markets as the APs able to settle IBIT in kind; most issuers simply write "the Authorized Participants". See our explainer on APs.
The separation matters legally: if the sponsor fails, the trust's bitcoin is held in a bankruptcy-remote structure and belongs to shareholders, not to the sponsor's creditors.
Who actually custodies US spot Bitcoin ETFs?
Net assets below are from each fund's Form 10-Q for the quarter ended 30 June 2026.
| ETF | Ticker | Bitcoin custodian(s) | Net assets, 30 Jun 2026 |
|---|---|---|---|
| iShares Bitcoin Trust (BlackRock) | IBIT | Coinbase Custody + Anchorage Digital Bank | $43.39bn |
| Fidelity Wise Origin Bitcoin Fund | FBTC | Fidelity Digital Assets | $10.30bn |
| Grayscale Bitcoin Trust | GBTC | Coinbase Custody + Anchorage Digital Bank | $8.14bn |
| Grayscale Bitcoin Mini Trust | BTC | Coinbase Custody + Anchorage Digital Bank | $3.19bn |
| Bitwise Bitcoin ETF | BITB | Coinbase Custody | $2.13bn |
| ARK 21Shares Bitcoin ETF | ARKB | Coinbase Custody, BitGo Bank & Trust, BitGo New York Trust, Anchorage | $1.89bn |
| VanEck Bitcoin ETF | HODL | Gemini Trust Company + Coinbase Custody | $0.96bn |
| CoinShares Bitcoin ETF | BRRR | Coinbase Custody, BitGo Trust Company, Komainu (Jersey) | $0.34bn |
| Franklin Bitcoin ETF | EZBC | Coinbase Custody | $0.33bn |
| Invesco Galaxy Bitcoin ETF | BTCO | Coinbase Custody | $0.32bn |
| WisdomTree Bitcoin Fund | BTCW | Coinbase Custody | $0.14bn |
Two things stand out. First, concentration: funds that name Coinbase Custody as a bitcoin custodian account for roughly 85% of the category's $71.42 billion. Second, the monoculture has thinned. Where the 2024 prospectuses described a single custodian each, IBIT, GBTC and the Grayscale Mini have added Anchorage Digital Bank, ARKB names four entities, HODL names Gemini plus Coinbase, and BRRR names Coinbase, BitGo Trust Company and Komainu (Jersey) Limited. FBTC remains the only fund custodied entirely outside the third-party market, at Fidelity's own custody entity.
How the coins are actually held
The headline answer: cold storage, segregated per client.
Cold storage
"Cold" means the private keys live on hardware that is never connected to the internet, kept in physically secured, geographically distributed facilities. To move coins, the key material has to be retrieved, the transaction signed offline, and the signed transaction broadcast separately. Prospectuses describe the arrangement in general terms; the specific vault architecture, quorum sizes and key-ceremony procedures are deliberately not public, and any article that quotes exact numbers for them is guessing.
Key management
Custodians split signing authority so that no single insider can move funds — typically through an n-of-m multisignature scheme, or through threshold signatures (TSS/MPC) and secret-sharing schemes that achieve the same property without leaving a multisig footprint on chain.
Segregation
Each fund's bitcoin is held in dedicated addresses, separate from other clients, from the custodian's own balance sheet and from any commingled pool. The IBIT prospectus, for example, states that the trust's coins are held in identifiable bitcoin addresses on the bitcoin blockchain. Where a fund publishes its addresses, anyone with a block explorer can watch the balance move as flows accumulate — one of the cleaner real-time auditability mechanisms anywhere in traditional finance.
Insurance: what's actually covered
Custody insurance is the most misunderstood part of the wrapper. Two very different things get called by the same name:
- The custodian's commercial crime or specie policy. Covers loss of bitcoin from theft, malicious insider activity, physical destruction of key material or computer fraud. Coverage is arranged by the custodian, not the fund, and the limits are commercial terms that custodians generally do not publish in full. Treat any specific dollar figure you see quoted with suspicion unless it comes from the custodian's own disclosure.
- SIPC and FDIC. Neither covers bitcoin. SIPC protects securities accounts up to $500,000; a bitcoin ETF share is a security held in your brokerage account and is covered on that basis, but the underlying bitcoin is not. There is no FDIC equivalent for crypto.
What insurance does not cover:
- A drop in bitcoin's price.
- A fork or chain split where the custodian does not claim the forked coins.
- The sponsor going bankrupt — that is handled by the trust structure, not by insurance.
- Losses above the policy cap. Any commercial crime policy is small next to $43.39bn of IBIT net assets; insurance is a backstop against operational theft, not a guarantee on the asset.
Creation and redemption: how coins move in and out
At launch the SEC required the January 2024 funds to run creations and redemptions in cash: the AP delivers dollars, the trust buys bitcoin through a prime broker, and the custodian sweeps the coins into the trust's segregated addresses. Redemptions run the same way in reverse.
That changed on 29 July 2025, when the SEC issued order 34-103571 permitting in-kind creation and redemption for spot crypto ETPs. Uptake has been uneven. VanEck's HODL states that the proceeds it receives from issuing baskets consist of bitcoin; BlackRock's filings name four APs able to settle IBIT in kind; the Grayscale Mini disclosed amended AP agreements in an 8-K filed 6 February 2026; GBTC's 10-Q for the quarter ended 30 June 2026 still says its AP agreements do not provide for in-kind, so every GBTC order runs as cash. Several smaller funds, Franklin's EZBC among them, describe baskets as issued "in exchange for an amount of bitcoin and/or cash".
The distinction matters because a cash model leaves the trust carrying execution risk between the order and the fill, and forces a bitcoin sale on every redemption. In-kind removes both.
"Proof of reserves": what it does and doesn't verify
Some custodians publish on-chain proof of reserves. It is genuinely useful, and genuinely oversold. What it actually demonstrates:
- ✅ Existence. A signed message from an address proves the custodian controls those coins.
- ✅ Balance match. If the on-chain balance equals what the trust reports, the assets are there.
- ❌ No double-pledging. Nothing on chain prevents the same coins being pledged as collateral elsewhere — proof of reserves is not proof of liabilities.
- ❌ Live ownership. A signature today says nothing about whether the keys are compromised tomorrow.
For an ETF this matters less than for an unregulated exchange, because the custodian answers to a regulator — the NYDFS for Coinbase Custody Trust and Gemini Trust, a national trust charter for Fidelity's custody entity — and the fund is audited annually. The audit and the regulator are doing the heavy lifting; proof of reserves is a useful supplement, not a substitute.
The real structural risks, in order
1. Custodian concentration
One custodian standing behind roughly 85% of category assets is a systemic exposure. Coinbase Custody is a New York trust company, separately capitalised from Coinbase Inc. and bankruptcy-remote — but a catastrophic failure there (key compromise, enforcement action, geopolitical event) would touch most of the category at once.
This is the single risk most worth tracking, and it is why the second-custodian additions of 2025–2026 matter more than they look: IBIT, GBTC and the Grayscale Mini adding Anchorage moved the three largest Coinbase-custodied funds off a single point of failure.
2. Fork handling
If bitcoin forks and a meaningful chain emerges — as with Bitcoin Cash in 2017 — the trust must decide which side to hold and whether to claim or distribute the forked coins. Prospectuses generally leave that to the sponsor's discretion. That is real optionality a self-custodied holder keeps and an ETF holder gives up.
3. Cyber and physical attack on the custodian
The mitigations are mature, but the tail risk is not zero. A successful breach of a major Bitcoin ETF custodian would be an event for the whole asset class, not just one fund.
4. Regulatory action against the custodian
A freeze or enforcement action could lock holdings even with the keys intact. Theoretical here, but precedented in other asset classes.
How to verify a fund's custody for yourself
- Open the fund's latest 10-Q or 10-K free on EDGAR at sec.gov and search for "Custodian". The exact legal entities are named, and funds with more than one name them all.
- Check recent 8-K filings for changes to custody or AP arrangements — that is where the Anchorage additions and in-kind amendments appeared.
- Look up the custodian on its regulator's public register (NYDFS for Coinbase Custody and Gemini Trust).
- For funds that publish custody addresses, paste them into mempool.space and check the balance against reported holdings.
FAQ
Who holds the bitcoin behind a Bitcoin ETF?
A qualified custodian — most often Coinbase Custody Trust Company. Fidelity FBTC is custodied by Fidelity Digital Assets, VanEck HODL names Gemini Trust Company with Coinbase Custody as an additional custodian, ARK 21Shares ARKB uses four custodians including two BitGo entities and Anchorage, and IBIT, GBTC and the Grayscale Mini Trust name Anchorage Digital Bank alongside Coinbase.
How concentrated is Bitcoin ETF custody?
Funds that name Coinbase Custody as a bitcoin custodian accounted for roughly 85% of the category's $71.42 billion at 30 June 2026. That is down from a near-monoculture at launch, because several of the largest funds have since added a second custodian, but it is still the dominant structural exposure in the category.
Is the bitcoin held by an ETF insured?
The custodian carries commercial crime insurance against theft, insider action and destruction of key material. It does not cover price declines, forks, or losses above the policy limit, and the limits are commercial terms rather than published guarantees. SIPC covers the ETF share in your brokerage account, not the underlying bitcoin; there is no FDIC equivalent for crypto.
Do Bitcoin ETFs create and redeem shares in cash or in kind?
Both, now. The January 2024 funds launched cash-only. The SEC permitted in-kind creation and redemption for spot crypto ETPs on 29 July 2025 (order 34-103571), and adoption has been uneven: VanEck HODL receives bitcoin for its baskets and BlackRock names four APs able to settle IBIT in kind, while GBTC's agreements still provide for cash only.
Can I see the bitcoin a fund holds on chain?
In many cases yes. Funds disclose custody addresses or publish proof-of-reserve attestations, and you can check the balance on any block explorer. What that cannot show you is whether the same coins are pledged elsewhere — proof of reserves is not proof of liabilities.
What happens to my shares if the ETF sponsor goes bankrupt?
The trust structure is bankruptcy-remote: the bitcoin belongs to shareholders, not to the sponsor. In practice sponsorship would be transferred to another firm or the trust would be wound down and the proceeds distributed. The more disruptive failure mode is custodian failure, not sponsor failure.
Bottom line
Bitcoin ETF custody is a more sophisticated operation than retail crypto storage: segregated addresses, offline keys, split signing authority, a regulated custodian and an annual audit. The remaining risk is mostly about concentration — one custodian behind most of the category, in one jurisdiction, on one chain. That picture has improved since launch as the largest funds added second custodians, but it has not gone away. If you want true custody diversification, holding some bitcoin yourself is still the strongest available hedge.
Sources and further reading
- Forms 10-Q for the quarter ended 30 June 2026 for IBIT, FBTC, GBTC, the Grayscale Bitcoin Mini Trust, BITB, ARKB, HODL, EZBC, BTCO and BTCW — sec.gov/Archives/edgar.
- SEC order 34-103571, 29 July 2025, permitting in-kind creation and redemption for spot crypto ETPs — sec.gov.
- NYDFS public register of virtual currency business licensees — dfs.ny.gov.
- Internal: Bitcoin ETF vs Spot Bitcoin, Authorised Participants Explained.
