Who holds your keys during custody consolidation?

Nevada regulators shut down Fortress Trust on Oct. 22, citing insolvency that left the custodian holding roughly $200,000 in cash against $8 million owed in fiat and $4 million in crypto.

The cease-and-desist order marked the second major Nevada trust-company collapse in two years, following Prime Trust’s entry into receivership in June 2023. Both firms shared the same founder.

The pattern forces exchanges, fintechs, and investors to confront where customer assets actually sit and which regulatory frameworks prevent failures from wiping out user funds.

Nevada’s Financial Institutions Division described Fortress’s condition as “unsafe and unsound,” barred deposits and asset transfers. It noted that the custodian could not produce financials for July through September or basic reconciliations.

Fortress, which rebranded as Elemental Financial Technologies after a 2023 vendor breach costing $12 million to $15 million, served more than 250,000 clients.

Ripple withdrew its acquisition bid days after the breach was disclosed. The failures occurred under Nevada’s retail trust-company charter, which requires statutory segregation but has led to enforcement actions spotlighting governance breakdowns and gaps in exam frequency.

Four custody charters and their segregation rules

US institutions custody digital assets under four frameworks: Nevada retail trusts, New York limited-purpose trusts and BitLicense custodians, OCC national trust banks, and Wyoming SPDIs.

Nevada’s NRS Chapter 669 mandates trust-fund segregation and permits omnibus titling if records identify each beneficial owner, but exam frequency, set as “often as necessary,” has varied in practice.

New York’s 2023 DFS custody guidance requires treating customer assets as customer property, prohibits custodians from using customer assets for anything beyond safekeeping, and requires audit trails that reconcile omnibus wallets to individual accounts.

Sub-custody needs prior DFS approval. BitLicense holders face intensive risk-based exams funded by DFS assessments, creating frequent touchpoints and capital requirements that smaller firms cannot meet.

The OCC confirmed crypto-custody authority through Interpretive Letters 1170 and 1179, applying fiduciary standards that require client-asset separation and operational controls.

National banks operate under a 12- to 18-month exam cycle. The OCC’s 2022 consent order against Anchorage Digital, which was terminated in August 2025 after remediation, showed that enforcement applies even to well-capitalized institutions.

Wyoming’s SPDI framework codifies bailment-based custody with strict segregation in statute and Chapter 19 regulations.

SPDIs maintain separate accounts or well-marked omnibus accounts with ledger-level segregation, sub-custody requires customer agreements naming the sub-custodian, and prohibiting commingling.

The trade-off is narrower permissions and bespoke supervision that limits quick scaling.

Where assets actually sit

Customer funds flow through layers: an exchange front-end ledger mapping balances, a legal custodian holding title or acting as a bailee, a sub-custodian or wallet infrastructure provider managing technical operations, and wallet tiers.

Omnibus pooling can occur at legal-custody or infrastructure layers, where multiple customers share a blockchain address.

Regulators permit omnibus if books maintain beneficial-ownership mappings, but failures at any layer, such as lost keys, poor reconciliation, or vendor breaches, strand customers even when the custodian’s balance sheet appears solvent.

DFS guidance and OCC handbooks require segregation across both books and technical implementation, with audit trails to prove each claim.

Wyoming’s Chapter 19 mandates sub-custody agreements that explicitly prohibit commingling, closing gaps that allow technical failures to propagate into losses.

The Oct. 10 washout prompted dYdX to halt amid market volatility, illustrating protocol-layer risk when the Cosmos blockchain was hit by a liquidation edge case, forcing a temporary suspension.

Although it resumed within 24 hours with the funds secure, it stressed that Custody risk extends beyond legal title to the entire infrastructure stack.

Enforcement timeline

The OCC’s April 2022 consent order against Anchorage Digital targeted BSA/AML deficiencies, demonstrating federal enforcement at compliant institutions.

Termination in August 2025 after remediation marked a rare cooperative resolution. New York’s February 2023 action ordering Paxos Trust to cease BUSD minting showed DFS polices product lines at state trusts, even with sound custody.

Prime Trust’s July 2023 receivership represented the first major state failure: Nevada FID issued a cease-and-desist on June 21, petitioned for receivership on June 26, and the court appointed a receiver on July 18 after filings described wallet losses and unsafe conditions. Recovery continues through Prime Core’s 2025 bankruptcy.

Fortress’s 2023 breach, covered by Ripple, foreshadowed the Oct. 22 shutdown, when Nevada FID found it unable to meet obligations or produce financials.

Maine’s 2024 consent order had restricted Fortress’s transmitter license and demanded audits, showing fragmented multi-state coordination.

Winners and losers

New York and OCC entities benefit because their regimes embed operational discipline, preventing Nevada-style collapses.

DFS custodians and OCC banks operate under frequent exams, mandatory segregation with audit trails, sub-custodian approvals, and assessment-funded supervision.

Requirements raise costs but create moats that competitors cannot cross without investment. Wyoming’s SPDI offers rigorous segregation and sub-custody guardrails, though bespoke supervision limits the number that can scale quickly.

Nevada trust companies face reputational headwinds. Two failures in two years make exchanges wary in the absence of governance overhauls and attestations.

Platforms using Prime Trust or Fortress face asset-recovery timelines of months or years, support costs, and litigation. At the same time, new custody requires intensive diligence that many Nevada firms cannot provide.

The result is a flight to supervision: firms that afford DFS or OCC migrate there; others exit custody, consolidate under larger parents, or accept reduced access and higher premiums.

The 90-day playbook

Custody agreements ban custodian use beyond safekeeping, prohibiting lending, rehypothecation, or pledging unless customers opt in, which retail platforms will not offer.

Auto-segregation clauses separate funds on the books and at the infrastructure layer, with monthly reconciliations and attestations that map addresses to owners.

Omnibus remains permissible where allowed, but platforms adopt DFS audit trails proving segregation even when customers share addresses, reducing operational simplicity.

Custody diversification accelerates as exchanges contract at least two custodians and decouple infrastructure providers from legal custodians, limiting single failures.

Fragmentation raises coordination costs but contains risk. Proof-of-Reserves evolves into solvency disclosures that pair reserves with liabilities, though the PCAOB warns that PoR alone is “inherently limited” and not an audit.

Platforms claiming solvency need third-party attestations covering both balance-sheet sides with disclosed scope and methodology.

Regulatory arbitrage narrows. Firms choosing lightly supervised charters to avoid costs face market pressure to upgrade.

The result: large platforms affording New York or OCC supervision, and smaller platforms exiting custody, partnering as sub-clients, or accepting reduced access.

Economics favor consolidation. The next 12 months will see M&A or wind-downs among second-tier custodians unable to meet the baseline for rigor and capital.

Nevada’s Fortress shutdown exposes the fragility of lightly supervised models and accelerates shifts toward fewer, larger, more closely examined custodians under New York, OCC, or Wyoming frameworks.

Exchanges face decisions on diversification, segregation, and disclosure. Customers confront narrower options with higher standards but higher costs.

The US crypto trust model consolidates around firms that are better capitalized, more transparent, and more intensively supervised, with oversight matching the systemic risk of holding billions in customer assets.