Custody due diligence tends to concentrate on two scenarios: somebody steals the assets, or the custodian goes under. Both are worth planning for, and DAG covers the second directly in its note on what happens if a custodian becomes insolvent or faces regulatory action.
The failures that actually turn up in operations are usually neither. They are procedural, they are frequently unrecoverable, and almost none of them are covered by the insurance a custodian carries. Where that coverage ends is set out in where crypto custody insurance stops; this article is about the events that never reach a policy at all.
The eight modes, and who can actually fix each one
| Failure mode | What happens | Reversible by | Control that prevents it |
|---|---|---|---|
| Missing or wrong destination tag | Funds credit the right address and the wrong customer | The receiving institution, at its discretion | Test transfer first; confirm the addressing scheme in writing |
| Wrong network | Asset sent to a valid address on a chain the custodian does not support there | Sometimes the custodian, at cost | Allowlist by asset and network together |
| Address poisoning | A lookalike address from transaction history gets pasted into a withdrawal | Nobody | Allowlisted withdrawal addresses with a time delay |
| Signer set drift | Authorized signers leave, quorum can no longer be met | Nobody, once quorum is unreachable | Quarterly signer attestation; quorum below headcount |
| Allowlist or policy lockout | Withdrawals blocked by the custodian’s own controls at the worst moment | The custodian, on its timeline | Rehearse a withdrawal before you need one |
| Compliance hold | Transfer stopped for identifying information on the counterparty | The custodian, once satisfied | Pre-clear counterparties above the threshold |
| Asset support withdrawn | Custodian stops supporting an asset and requires it to leave | The custodian sets the window | Contractual notice period, tested exit path |
| Fork or airdrop handling | An entitlement is not credited, or is credited late | The custodian, per its policy | Written policy before the event, not after |
Every row above is an operational risk. Every row sits outside a crime policy, because none of them is a theft.
Addressing errors are permanent in a way people underestimate
Two chains matter here for different reasons.
Many exchanges and custodians receive XRP into one shared address and identify the customer by a destination tag. The XRP Ledger documents source and destination tags as exactly this: a way for a shared account to route an incoming payment to the correct internal party. Send without the tag, or with the wrong one, and the payment settles correctly. It settles to the right address on behalf of the wrong beneficiary, and recovery depends entirely on the receiving institution’s willingness and ability to help.
Wrong-network sends fail differently. The address format is valid, the transaction confirms, and the asset now sits somewhere the receiving institution does not sweep. Some custodians will recover it. That is a manual engineering exercise with a price and a timeline attached, and it is a favor rather than an entitlement.
The prevention for both is unglamorous and it works. Send a small test transfer, confirm it credits, then send the balance. Ask the custodian to state the addressing scheme and the supported networks in writing before the first transfer rather than after the first problem.
Signer set drift is the one that ages into a crisis
Multi-signature arrangements get designed once, at the moment when everyone involved is present and paying attention. Then people change roles, leave the company, lose devices, or die.
The failure is specific: the policy requires a quorum, and the number of reachable signers has fallen below it. At that point nobody has stolen anything and the custodian has done nothing wrong. The assets remain intact and unreachable at the same time.
Two habits prevent it. Attest the signer set on a schedule and treat a failed attestation as an incident. And set the quorum meaningfully below the number of signers, so ordinary attrition does not walk the arrangement into a wall.
This is the same problem that makes passing digital assets to heirs harder than it looks, and it is worth solving once for both cases.
Lockouts, holds, and the transfer that will not go
Custodial controls exist to stop bad withdrawals. They also stop good ones.
Address allowlists usually carry a cooling-off period before a newly added destination becomes usable. That is a sound control. It also means the first time you attempt a large transfer under time pressure is the worst moment to discover the delay.
Compliance holds have their own trigger. Under the funds transfer recordkeeping rule at 31 CFR 1010.410(f), a transmittal of $3,000 or more requires the originating institution to include specified information about the originator and the recipient. Regulated digital asset firms apply an equivalent expectation to transfers between them, so a transfer to a counterparty whose details cannot be verified may be held until they can. Nothing has gone wrong when this happens. The money still does not move that day.
Both are answered the same way. Rehearse the exact withdrawal path you will one day need in a hurry, at a small size, and record how long each step took.
Recovery material has its own decay curve
Key ceremonies produce artifacts: recovery phrases, hardware backups, shard holders, sealed envelopes in two locations. The ceremony is usually run carefully. The artifacts then sit untouched for years while the organization around them changes.
Three things go wrong in that period, and all three are found the same way. Media degrade or become unreadable because the drive format outlived the reader. Locations change without the record being updated, so the envelope is somewhere the current staff cannot name. And shard holders leave, which turns an m-of-n scheme into an n-of-n scheme without anyone noticing.
The fix is a restoration drill rather than an inventory. An inventory confirms that something exists at a listed location. A drill confirms that the material still reconstructs access, which is the property that actually matters and the only one that decays. Run it against a low-value account so a failed drill costs nothing but the afternoon that found the problem.
Custodian offboarding takes a project plan
Leaving a custodian is the transaction least likely to have been rehearsed and most likely to happen under pressure, whether the trigger is pricing, service, an acquisition, or a support decision that removes an asset from the platform.
Ask early what the exit actually involves: notice period, whether the position can move in kind or has to be liquidated, per-asset withdrawal limits, how long a full withdrawal has taken for a comparable book, and who signs off internally on their side. Those answers belong in the file before there is a reason to want them.
What a ledger can enforce that a provider cannot
Most chains push every authorization decision into the custodian’s own systems, which means the controls are only as durable as that company. The XRP Ledger implements several at the protocol level, so they are enforced by the network rather than by a provider’s internal policy.
The dates below come from our own dataset of enabled amendments, each one derived from the ledger’s activation transaction rather than from documentation. The full list, with the method for checking any row against the ledger yourself, is in the complete index of enabled XRP Ledger amendments.
| Protocol control | What it enforces | Live since |
|---|---|---|
| Multi-signing | A quorum of signers before a transaction is valid | 2016-06-27 |
| Escrow | XRP locked until a time or condition is met | 2017-03-31 |
| Deposit authorization | Incoming payments blocked unless the sender is approved | 2018-04-06 |
| Deposit preauthorization | Named senders approved in advance | 2018-10-09 |
| Account deletion | An account closed and its reserve recovered | 2020-05-08 |
| Expanded signer lists | Up to 32 signers with per-signer weights | 2022-10-13 |
| Disallow incoming | Categories of incoming object refused at the account | 2023-08-21 |
| Credentials | On-chain attestations usable as an access condition | 2025-09-04 |
The practical consequence for signer set drift is worth drawing out. A quorum written into an on-chain signer list, with weights, survives the company that helped you set it up. Expanded signer lists raise the ceiling high enough that a serious governance structure fits inside it. What the ledger does not solve is the human process: attestation, succession, and knowing who currently holds what. Those remain somebody’s job.
The newest of these controls, and the one most relevant to institutional access policies, is covered in more depth in the XRPL Credentials amendment.
Where this analysis is limited
Some honest boundaries.
Custodians differ, and several of the modes above are addressed well by some providers and poorly by others. Treat the table as a question list rather than a verdict on anyone.
The list is not exhaustive. It covers the modes that recur across operational post-mortems and that a crime or specie policy does not answer. Rarer events exist, and new ones arrive with new product features.
Protocol controls help only on chains that implement them. The XRP Ledger rows above do not transfer to assets held elsewhere, and a multi-chain position needs this analysis run per chain.
Finally, none of this addresses market risk, which no custody arrangement has ever touched.
Common questions
What happens if I send XRP without a destination tag? It settles to the correct address, credited to the wrong party or to no internal account at all. There is no protocol mechanism that reverses it, so recovery depends on the receiving institution. Send a tagged test transfer before any real one.
Can a custodian recover crypto sent on the wrong network? Sometimes. It is a manual engineering exercise, usually chargeable, and it is offered as a favor rather than owed as a right. Ask what the process and the fee are before your first transfer.
What is signer set drift? The gradual loss of authorized signers through role changes, departures, lost devices or death, until the remaining reachable signers can no longer meet the quorum. The assets are then intact and unreachable at the same time.
Why would a custodian block my own withdrawal? Usually an allowlist cooling-off period on a newly added address, or a compliance hold while counterparty information is verified. Both are working as designed. Rehearse the path at a small size so the timing is known in advance.
Does insurance cover any of these? Generally no. A crime policy responds to theft and dishonesty. An addressing error, a lockout, a compliance hold and an unreachable quorum are none of those things.
Which of these should I fix first? Signer set attestation and a rehearsed withdrawal. They are cheap, they take an afternoon, and between them they cover the two modes that are hardest to unwind after the fact.
Do protocol-level controls replace a custodian? No. They enforce authorization independently of any company, which is valuable, and they leave key management, operational continuity, reporting and succession exactly where they were.
If you want these modes tested against a specific setup, DAG covers institutional digital asset services, including custody due diligence and operational review.
Educational only. This is not legal, tax, or investment advice, and it is not a recommendation to use any particular custodian or custody arrangement. Digital assets are volatile and you can lose your entire position. Custodian policies, supported networks and the rules governing transfers vary by provider and jurisdiction and change over time. Confirm current procedures with your provider and speak with qualified counsel before acting.
Read Jake regularly? Add jakeclaver.com as a preferred source in Google to see more of it in Search and AI Overviews.
Part of our guide: Digital Asset Custody.
