After a deposit to a Custodial Exchange, an on-chain Bitcoin transfer coexists with an internal claim governed by contract and jurisdiction. The exchange combines custody, trade matching, fiat rails and KYC. Until withdrawal reaches an address under the customer’s private key, neither Proof of Reserves nor a screen balance alone proves full backing, solvency or enforceable ownership.
Bitcoin records UTXO and accepts spending authorized by the relevant Script and private key. A Custodial Exchange normally pools assets in addresses it controls and credits a number in its database. That number is a contractual claim, not an on-chain output the customer can sign and send without the exchange.
The exchange provides a deposit address and credits its ledger after a chosen number of confirmations. Funds may then be swept into an omnibus wallet. A reorg, wrong network or asset, missing memo, minimum amount or review can affect credit; a transaction ID alone does not prove correct account allocation.
An order-book fill changes buyer and seller balances internally, often without a Bitcoin transaction per trade. Matching, fees and priority follow platform rules. Execution is therefore not final settlement into self-custody; the fiat leg, bank transfer and bitcoin withdrawal have different finality.
For withdrawal, the customer asks the operator to construct and sign. Limits, fees, batching, address whitelists, waiting periods, KYC/AML controls or manual review may apply. Verify a completed status through transaction ID, network, amount and receipt in a wallet the customer controls.
Operators split liquidity between a hot wallet and cold storage and may use multisig, MPC or a sub-custodian. Labels alone reveal neither signing authority, recovery nor ledger reconciliation. Security depends on governance, authorization, reconciliation, backups and incident response.
Segregation separates customer property from company assets legally, operationally and in books. Omnibus custody can work only if records identify every beneficial interest. Read whether assets may be lent, pledged or rehypothecated and identify every sub-custodian.
Solvency means assets cover liabilities; liquidity means withdrawals can be met on time. A solvent firm can be illiquid and a liquid-looking one can hide a deficit funded by new deposits. A run, hack, bank block, concentrated loan, collateral or affiliate can halt withdrawals before formal insolvency.
Proof of Reserves can show control of selected addresses at one moment and may commit customer liabilities in a Merkle tree. PCAOB warns it is not automatically an audit: liabilities, loans, fiat, encumbrances, entities or time between snapshots may be omitted. Assess reserves with liabilities, legal title and audited statements.
A Custodial Exchange links KYC identity to trades, deposit and withdrawal addresses, bank account, device and IP. Sanctions, suspicion, court orders, security or terms may freeze access. This is not a Bitcoin consensus rule, but it controls the internal claim and creates error, data-breach and appeal risk.
Verify the legal entity and regulator, custody and subcustody chain, segregation, permitted asset use, insolvency treatment, insured events, audited accounts, Proof of Reserves methodology, fees and withdrawal policy. Test a small deposit, trade and withdrawal. Licence, longevity and one successful test are not permanent guarantees; limit balance size and duration. Sources: Investor.gov — Crypto Asset Custody Basics; EU Regulation 2023/1114 — Markets in Crypto-assets; NYDFS — Updated Custodial Structures Guidance; PCAOB — Proof of Reserve Reports Advisory; Bitcoin Developer Guide — Transactions.
For the clearest picture, read this entry together with Self-custody, KYC, Proof of reserves, Counterparty risk, Bitcoin, UTXO. The reverse links also lead from KYC, Self-custody, Dollar-cost averaging (DCA), Spot Bitcoin ETP.