Custody Failure Archive
Last reviewed: August 2026
Custody failures get reported individually and then mostly forgotten until the next one. This is a running record of documented cases, organized around one question for each: which specific architectural property, if it had been in place, would have prevented it.
Figures below are described in the asset's own units, not currency, since the point of each entry is the architecture that failed, not the value involved.
Documented Cases
| Year | Incident | What Failed | Would Have Prevented It |
|---|---|---|---|
| 2013 | A discarded hard drive | A single physical drive held the only copy of a private key. The drive was discarded and ended up in a landfill. | No backup copy existed anywhere else. |
| 2014 | An exchange's hot-wallet keys | Keys controlling a large share of customer holdings were held in internet-connected systems for years without detection of unauthorized withdrawals. | Cold storage and independent, ongoing verification of custodial holdings. |
| 2017 | A shared smart-contract library | Many multi-signature wallets depended on one shared library contract. A user accidentally triggered its self-destruct function, permanently freezing every wallet that depended on it. | Not relying on a single shared piece of infrastructure as a dependency for otherwise-independent wallets. |
| 2019 | A sole custodian's death | One individual reportedly held the only access to an exchange's custodial keys. Their death left customer holdings inaccessible, and left unresolved questions about whether the holdings were still there at all. | Recovery arrangements (distributed signing, documented succession, or independent audits) that don't depend on one person. |
| 2021 (reported) | A forgotten password | A private key was stored on an encrypted device protected by a password its owner could no longer recall, with a limited number of attempts before the device locks permanently. | Recovery material stored in a form that doesn't depend on human memory alone. |
| 2022 | Commingled custodial funds | An exchange used customer holdings, which customers believed were held on their behalf, for its own purposes. The arrangement collapsed when it couldn't meet withdrawal requests. | Understanding that custodial holdings depend entirely on the custodian's own conduct, not just its technical security. |
Reading Across the Cases
None of these were caused by the underlying network failing to do what it was designed to do. Every one of them was a failure of key management, backup, or trust in a third party, exactly the categories this site is organized around. See Key Security and Backup & Recovery for the architectural properties that address most of the entries above, and Custodial vs. Non-Custodial Wallets for the distinction behind the last one.
This record will be extended as new documented cases occur. It intentionally excludes rumors, unverified claims, and disputes that haven't been documented by reporting or legal proceedings.