Self-Custody or Custodian? How SwissBorg Holds Your Crypto

Over the past few days, many people in the crypto community have been asking the same question: is my crypto where it should be?

The question follows reports of funds drained from Ledger hardware wallets sold through a third-party reseller in Southeast Asia. Ledger has confirmed an unauthorised hardware implant in at least one affected device. It says all confirmed losses are linked to that reseller and that its own manufacturing, internal systems and direct sales channels are not compromised.

Hardware wallets remain a reasonable choice for many people. What this news shows is how many steps self-custody depends on: where a device was bought, how it was set up, and where the recovery phrase is kept. Some people are happy to manage all of that. Others would rather the ease of handing custody to a regulated company.

Both are legitimate choices, and this article explains how the second one works at SwissBorg.

What Self-Custody Asks of You

This week's news was a supply-chain case: devices tampered with before they reached their owners. It is one of several jobs self-custody leaves with the owner.

Security researchers list the common ones:

• Buying only genuine hardware from official channels, because counterfeit and tampered devices circulate through unofficial ones.
• Setting the device up yourself, and rejecting any device that arrives with a recovery phrase already set.
• Installing firmware updates when they are released, only through the manufacturer's official app and website, because fake updates and fake companion apps exist.
• Checking every transaction on the device's own screen, because malware on a computer can change addresses.
• Storing the recovery phrase offline, protected from fire, water and loss, and never as a photo or in the cloud.
• Recognising phishing that impersonates the manufacturer.
• Planning how someone you trust could reach the funds if something happened to you.

Some people try their best to manage all of this. If you would rather not, managed custody moves most of that work to a regulated company whose job it is.

At SwissBorg, BlockNodes operates the MPC custody infrastructure, keeps keys inside approved systems and reconciles balances regularly, under AMF supervision.

Your part is to keep the app updated from the official app store, choose a strong passcode and set your Withdrawal Protection delay.

Self-Custody vs Custodial: How SwissBorg Compares

Four Layers Between Your Crypto and Anyone Else

Most of the conversation about exchange security is about how the platform stores crypto.

That matters, and we cover it below. But at SwissBorg, three of the four layers of protection are controlled by you, and two of them are separate from your phone's own lock.

Layer 1: Only Your Authorised Device Can Act

There is no username and password that works on another device.

When you set up SwissBorg, your phone creates a device key in its secure hardware that never leaves it, and that is part of what signs your sign-ins and withdrawals.

Moving to a new phone is a checked process: if it’s been reported as lost or stolen, your previous device is revoked and you receive an email with a "This wasn't me" option.

You prove the new device is yours with your passkey and your SwissBorg passcode. Without your passkey, a multi-step ID check is reviewed by our team.

For extra security withdrawals stay on hold for at least 24 hours after a passkey recovery.

A 48-hour hold also follows any change of phone number or email address.

Layer 2: Your SwissBorg Passcode Is Not Your Phone Code

Signing in and withdrawing also need a key derived from your SwissBorg passcode.

That passcode belongs to your SwissBorg app, not to your phone, so it only adds protection if it is different from the code that unlocks your phone. Our recommendations:

• Choose a passphrase. Alongside 4 and 6 digits, SwissBorg lets you set an alphanumeric passphrase of at least 8 characters. Make it long, random and unique. See our passcode requirements.
• Never reuse your phone code, a date that means something to you, or a code from another app or card.
• Decide whether biometrics suit you. With Face ID or fingerprint sign-in on, biometrics stand in for typing your passcode. That is convenient for everyday amounts. For larger holdings, consider turning biometric sign-in off and typing your passcode.

You can change both under Profile, Security.

Layer 3: Your Delay, with Withdrawal Protection

Withdrawal Protection adds a waiting period to every crypto withdrawal from your account, including Smart Send. You choose the length, from 1 to 180 days, under Profile, Security, Withdrawal Protection. It is off by default.

• The delay cannot be bypassed, not even by SwissBorg support.
• You can cancel a withdrawal while it is pending.
• Switching the feature off starts a countdown equal to the delay you set, so it cannot be turned off and used straight away.
• You can still swap and manage your portfolio in the app as normal.

Layer 4: MPC Custody Under MiCA

SwissBorg custody is provided by BlockNodes SAS, a French company authorised by the Autorité des Marchés Financiers (AMF) under the EU's Markets in Crypto-Assets regulation (MiCA), licence number A2026-011, including custody and administration of crypto-assets.

The details below come from our public Custody Policy summary.

• No single key to steal. Crypto is held at SwissBorg in wallets secured with MPC (multi-party computation). Before any transactions are signed, each gets checked against approval rules set by SwissBorg. Depending on the situation, some may need further sign-off from our team. Only then is a transaction signed, and to do so, every piece of the MPC key is needed. No server holds a complete key, and neither our team nor our technology provider can see or use a whole key. There is no single seed phrase that controls your crypto.
• Kept separate. Your crypto sits on different on-chain addresses from BlockNodes' own assets, is recorded in real time and reconciled regularly against on-chain balances, and is not affected by a possible insolvency proceeding of BlockNodes.
• Not lent or pledged. BlockNodes does not use your assets for its own account, and does not sell, transfer, lend or pledge them without your instruction, except under a valid court order or as set out in the Terms of Use.
• Responsibility under MiCA. BlockNodes is liable to you for the loss of any crypto-asset where the loss is attributable to it. Events on public blockchains it does not control are excluded.
• You can check. Enter your Audit Credential ID on our Proof of Liabilities page to confirm your balance is included.

Match Your Setup to What You Hold

These are suggestions, not requirements. Choose what fits how much you hold and how often you withdraw.

A longer delay gives you longer to cancel a withdrawal you did not make, and means you cannot move funds out quickly yourself.

The SwissBorg Way: Set Up Your Account in Three Steps

If you prefer custody with a regulated provider, set up in this order:

• Secure your login. Set an alphanumeric passphrase that you use nowhere else, decide on biometrics, and add a passkey so you can recover your account.
• Turn on Withdrawal Protection. Choose a delay from 1 to 180 days that fits how often you withdraw.
• Deposit. Send crypto from your existing wallet or exchange, starting with a small test amount.

Read more: Custody Policy summary, Withdrawal Protection, MiCA Transparency Hub.

Continue the conversation:

X | Instagram | YouTube | Discord | Telegram

Custody details in this article describe BlockNodes SAS (AMF, MiCA A2026-011), which provides SwissBorg services in the EEA, Switzerland and the UK. Services are provided as set out in our Terms of Use.

This is a crypto-asset marketing communication. Crypto assets are highly volatile. You risk losing all invested capital. Past performance is not a reliable indicator of future results. This article is for informational purposes only and is not financial advice. You can learn more about the risks associated with crypto assets on our List of Risks page.