Crypto Custody and Internal Ledgers: Who Can Move Customer Assets?

Crypto custody and internal ledger control determine who can move customer assets and how the platform records whose assets they are. If you work in engineering, treasury or custody operations, you may know which account had special withdrawal access, who approved a transfer or why a customer balance stayed on the books after the assets went elsewhere. That knowledge connects the custody promise to the actual use of customer money. It is where a technical exception can become evidence of crypto customer-asset theft.

Who Can Move Customer Assets?

A hosted wallet provider can receive, store and transmit customer value under its own control. In an unhosted wallet, the user controls value for the user’s own transactions. The Financial Crimes Enforcement Network’s virtual-currency business-model guidance distinguishes those arrangements by what the participants actually do. The practical question for an insider is who could make the transfer happen.

We examine who controlled the keys in a multisig arrangement, whose approval a transfer required and how those powers related to the platform’s withdrawal authority. The people who ran it can explain who could actually sign.

The authority to move assets belongs beside the authority to record customer balances. An exchange ledger can identify the customer credited for value, while wallet-control records identify who could transfer it. Someone who understands both can explain how a customer-facing balance relates to the assets the business controls.

Does a Public Blockchain Transfer Prove Who Owned the Assets?

A public blockchain transfer can show movement without identifying the beneficial owner or the exchange customer credited internally. The transaction hash supplies one part of the account. The exchange ledger, wallet-control records and bank messages supply other parts, while internal communications can explain what staff knew.

For a crypto exchange using omnibus wallets, the internal ledger is central to ownership evidence because it connects shared holdings with customer accounts. We examine that connection alongside the custody promise and withdrawal authority.

Can an Exchange Move Customer Assets Without a Separate On-Chain Transaction?

A hosted exchange can record transfers on its internal ledger without a separate blockchain transaction for every customer movement. Its books and the public chain therefore describe different parts of the business. Looking only for a matching public transfer can leave the customer credit out of view.

That distinction matters when the question is what happened to an individual account. We connect the internal credit or transfer to the wallet movements and bank payments associated with it. The employee who knows how the exchange reconciled those records can explain a movement that a public blockchain search leaves incomplete.

Crypto Custody Administrator Permissions and Related-Party Withdrawals

Crypto custody administrator permissions can reveal who controlled withdrawal access, including access granted to a related party. The comparison is between the custody promise, the code privileges and the transfers those privileges enabled. The FTX criminal case shows why that comparison matters.

In its account of the criminal case against FTX’s founder, the Justice Department described promised segregated custody contradicted by a code exception that allowed Alameda effectively unlimited withdrawals. Customer funds went to investments and other spending. The account also described false financial statements and backdated documents. A jury convicted the founder of fraud and associated conspiracies.

We see a custody promise with an exception large enough to swallow it. The code privilege explains how Alameda could withdraw; the customer promise explains why the access mattered. Finance records and communications then connect the movement to what others were told about the business.

For an engineer, the important contribution may be explaining the exception and the accounts it served. For treasury, it may be identifying the recipient and actual use of the transferred assets. A person who reviewed the financial statements may know how the same movement was described elsewhere. Those perspectives can turn a withdrawal record into an account of the decision behind it.

Customer Ownership, Segregation and Omnibus Accounts

FTX shows why a segregation promise belongs beside the permissions and transfers that put it to the test. The customer’s recorded balance, the promise about how assets would be held and the actual use of the money belong in the same account of what happened.

The GENIUS Act, enacted July 18, 2025, shows how separate accounting and pooled custody can fit together. Its general effective date is the earlier of January 18, 2027, or 120 days after the specified final implementing regulations.

For the custody activities it covers, the Act calls for treating customer property as the customer’s, separately accounting for it and keeping it separate from the custodian’s own assets. It also allows specified property to share an omnibus account at certain banks or trust companies. Pooling customer assets does not make them the custodian’s money.

The operational question remains concrete: how did the business connect a pooled holding to each customer’s recorded interest? We examine the internal accounts and the use of the assets together. A total held at a wallet or account does not answer the customer-level question on its own.

How Does a Stablecoin Move After Issuance?

A stablecoin can circulate between users after issuance without the issuer executing every subsequent transfer. The issuer issues or redeems tokens against reserve assets. A hosted exchange’s customer ledger or an unhosted user’s control describes another part of the token’s movement. A transfer between holders and a redemption with the issuer are different events.

Reserve backing supports the redemption promise. The enacted GENIUS framework calls for identifiable eligible reserves backing outstanding payment stablecoins, a publicly disclosed redemption policy and publication of reserve composition. For someone in issuer treasury or reserve custody, those records connect the promise to the assets held behind it.

An exchange insider may instead see the internal account credited when the platform receives tokens and the authority used when they leave. The issuer’s reserve position and the exchange’s treatment of its customer’s balance need separate examination. We follow the particular function: who issued or redeemed the token, who held it for the customer and who controlled its onward movement.

When the Explanation Does Not Match the Asset Use

The explanation given to customers or staff is another piece of custody evidence. A claim about a hack, a locked liquidity pool or the safety of customer funds can be compared with withdrawal authority, transfers and internal corrections. These cases show different ways that comparison becomes specific.

Cryptsy’s Claimed Hack and Alleged Insider Transfers

The criminal indictment announcement concerning Cryptsy’s founder described alleged transfers of over $1 million from customer wallets to his own wallet and bank account. The Justice Department alleged that he gave employees a separate account of a hack exceeding $5 million, continued soliciting customers and later destroyed a customer database after notice of receivership.

Two stories about missing customer money, and then a missing database. We would want to understand which movement the explanation to employees described and where the customer’s account appeared in the records. Someone who worked with that database or handled the payments could connect the alleged transfers to what staff were told.

SafeMoon’s Locked-Liquidity Promise

The Justice Department’s account of the criminal case against SafeMoon’s chief executive describes false claims that insiders could not withdraw liquidity. Insiders retained access, diverted tokens and concealed proceeds through wallets and exchange accounts. A jury convicted the chief executive of conspiracies involving securities fraud, wire fraud and money laundering.

We put the locked-liquidity promise next to the retained withdrawal authority. That is the connection between custody mechanics and locked liquidity and rug pulls: the person who understands the permissions can explain what the advertised restriction actually allowed insiders to do.

Celsius’s Internal Corrections

The criminal statement of facts concerning Celsius describes false claims about safety, profitability, risk and rewards. It also describes internal edits to public statements that did not notify customers who had already heard them.

An internal correction can show that people inside the business recognized a problem in the public account. We compare the original statement, the correction and the actual use of customer money. The employee who knows why the statement changed can explain why the revision mattered to the custody or yield promise.

The Records That Connect a Customer Balance to a Decision

The same transfer can look different to the engineer who understands its permissions, the treasury employee who knows its destination and the employee who heard the customer assurance. We bring those accounts together around the actual movement and decision. That work gives the transaction its meaning without asking any one employee to know the entire business.

What Are the SEC and CFTC Whistleblower Programs?

The Securities and Exchange Commission’s whistleblower program pays for qualifying information about securities-law violations. The Commodity Futures Trading Commission’s program covers commodities-law violations. Both offer eligible whistleblowers 10% to 30% of qualifying collections.

We assess the connection between the custody conduct and the applicable program with you. SEC crypto whistleblower reports can connect investment promises to internal records, while CFTC crypto whistleblower reports concern conduct within the commodities agency’s authority. The choice belongs with the facts about the business, the offer and the use of customer money.

When You Know Who Had Access

If you know why a related party could withdraw customer assets or how the ledger concealed their use, speak with our whistleblower experts about that access. We work beside you to build the case around the permissions, the money and the promises, bringing in crypto fraud whistleblower lawyers who understand exchange and custody operations. Your knowledge of how the system actually worked is where we start, and we stay with you through the process.