Restore the permission structure first, rather than looking only at the "self-custody" label
It should be verified who holds the private keys or signing shares, who can change the receiving address, and who has recovery and administrator permissions. Although a product describes itself as self-custodial, if the platform can still replace addresses through its backend or participate in required signatures, its liability analysis cannot rely on the name alone. Conversely, where the customer independently controls the wallet and initiates transfers themselves, the platform cannot be presumed to have custody of the assets merely because the platform interface was used.
Multi-signature and sharding technologies also cannot be assessed for their level of protection based on marketing language alone. It is necessary to examine whether multiple signatories are in fact controlled by the same administrator, whether approval devices are independent, and whether the permissions of departed personnel can be revoked. The distinction between transaction signing and contract authorization should also be identified: a user may not have directly transferred assets out, yet may have authorized a contract that can subsequently access the assets. Explaining these permissions to the business and to customers in plain language is of more practical significance than merely writing "industry-leading security technology is adopted" in a contract.
Statutory custody liability has its own elements and scope
Article 75 of the EU's MiCA, for custodial service providers subject to it, provides for liability for the loss of client assets or means of access caused by attributable events, and sets out that article's specific value cap and non-attributable circumstances. This is not a rule that "all wallet thefts are fully compensated," nor can it be directly applied to other countries or to all payment disputes. Whether an event is attributable requires investigation of permissions, operations, security controls and the cause of the incident.
Hypothetical scenarios: wrong addresses also have different causes
Suppose a customer confirmed the correct address, but the platform interface replaced it with another address before broadcasting; this is different from the customer themselves pasting a wrong address and confirming it through a valid confirmation. Interface displays, network selection, address book changes and approval logs should also be examined; liability cannot be determined solely on the basis of on-chain transfer records. If the platform had promised specific verification or manual review but failed to perform it, the fact that the error was initiated by the customer does not automatically exclude the platform's liability.
After an incident, preserve evidence first and control the expansion of losses
Original logs, authorization records, device and service provider notifications should be retained, affected pathways should be suspended in accordance with lawful authority, and it should be verified whether any other customers are affected. The conditions for notifying receiving platforms, issuers, law enforcement and regulators may be assessed, but it cannot be guaranteed that they will be able to freeze or return the assets. Disclose known facts and unknown causes externally, and avoid requiring customers to acknowledge before an investigation that they "bear all losses themselves"; subsequent remediation and compensation negotiations should be based on ascertained facts.
Recommended actions
- Conduct a complete inventory of private keys, signing, backend and recovery permissions.
- Preserve address confirmations, approvals, API and on-chain records, and unify the timeline.
- Establish incident classification, statutory reporting and client communication procedures, and separately assess loss mitigation and compensation.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- MiCA Article 75: Providing custody and administration of crypto-assets on behalf of clients — ESMA / EU legislature
- MiCA Article 73: Outsourcing — ESMA / EU legislature
