Custodial Commingling: Detecting Omnibus Account Risk

The SEC proposed a tailored crypto custody framework for advisers and regulated funds on October 1, 2026, published in the Federal Register on October 6 with a 60-day comment period. Among other things it would permit self-custody under certain circumstances and allow state trust companies to serve as custodians. Both widen a structural menu that has become very narrow, and narrowness is what makes commingling an allocator problem rather than a legal footnote.

Two Units of Account

Start with the primitive. On-chain, the address is the unit of ownership. In the custodian's records, a sub-ledger entry is the unit of claim. Commingling is nothing more exotic than those two units sitting at different granularity: one address, many claims.

Every control question then reduces to one architectural question. Which layer is authoritative when they disagree? The answer is always the sub-ledger, because an address cannot express an allocation. It holds a total and says nothing about who is owed what.

In an omnibus structure the custodian's database is the asset, and the chain is a consistency check on its total. An institution that believes it holds a bearer instrument actually holds a database entry whose aggregate happens to be publicly verifiable, and public verification of the aggregate is compatible with any allocation of it, including a wrong one.

Segregation therefore means two different things under one word. Address-level segregation gives each client its own on-chain address, so ownership is visible per client at the cost of operational complexity. Book-level segregation pools assets and tracks entitlement in an internal ledger reconciled daily against wallet totals, so ownership depends on that ledger and the legal terms. Contracts routinely say segregated without saying which.

What the Claim Becomes

The blast radius is set at insolvency rather than at the breach, and the recent record quantifies it. FTX creditors have received roughly $10 billion in payouts during 2026, with claims dollarized at the November 2022 petition date.

Being a claimant rather than an owner does not merely risk loss of principal. It converts an asset position into a dollar-denominated unsecured claim fixed at the moment of failure, which for an appreciating asset is the worst available outcome short of zero. The holder recovers 2022 dollars and forgoes everything the asset did afterward.

Concentration decides how many people that happens to at once. Data cited in April 2026 put Coinbase's Bitcoin ETF holdings near $77.1 billion, roughly 84 percent of the $91.7 billion US spot Bitcoin ETF complex, with Coinbase's own chief executive describing an 80-plus percent share. One widely repeated estimate is that a serious failure there would touch nine of the eleven US spot Bitcoin ETFs simultaneously. Dual-custody filings have followed, and most are paper additions: BlackRock named Anchorage alongside Coinbase for two funds with no current plans to move assets, and Grayscale added Coinbase Prime beside BitGo without setting an amount.

Four Things Visible From Outside

The hard part is that a correctly allocated omnibus and an incorrectly allocated one present identical on-chain state. The allocation is invisible. Four structural tells are not, and all four can be tested without the custodian's cooperation.

Deposit address uniqueness and stability is the first. Send two deposits of distinctive amounts and observe whether they land at the same address, and whether that address's balance is plausibly yours alone or obviously pooled. That is cheap and repeatable, and dispositive about structure even if silent on allocation.

Outflow destinations are the second. An address holding client assets that sends to exchanges, lending markets or staking contracts is doing something other than custody with the pool, and it is observable in real time.

Proprietary inflows are the third. If fee or operational receipts arrive at the same address holding client assets, house and client funds share a pool whatever the sub-ledger asserts.

The aggregate against your own claim is the fourth and the only one that is conclusive. If the address balance sits below your stated claim on its own, no sub-ledger access is required to know something is wrong.

Defenses That Hold and Defenses That Do Not

A custodian statement is not a defense. It is a report generated from the database you are trying to verify, which is the circularity the whole exercise exists to break.

Neither is the word segregated in a contract that does not say whether segregation is by address or by book entry. And proof of the aggregate reserve proves the total rather than your allocation, which is a different question entirely.

Three things hold. Contract for address-level segregation and verify it on-chain, because collapsing the granularity mismatch is the only structural fix rather than a mitigation. Where omnibus is genuinely unavoidable, require a cryptographic commitment to client balances in which your own entry is independently verifiable. And monitor the omnibus address independently of the custodian, since outflow destinations are public and the custodian has no obligation to volunteer them.

Alongside those, get an opinion on whether the account is bankruptcy-remote under the governing law. That determination does more to set the outcome than any operational control, and it is the one most often assumed rather than obtained.

Residual Risk and What Is Improving

Address-level segregation fixes allocation and nothing else. The custodian still holds the keys, so key-holder risk survives perfect segregation, and the operational complexity of per-client addresses is real at scale. A dual-custody arrangement that exists only in a filing provides no diversification, and an allocator treating a named second custodian as risk reduction without confirming assets have moved has accepted a disclosure in place of a control.

The direction of travel is better. Permitting self-custody in defined circumstances and admitting state trust companies both expand the menu beyond a handful of omnibus providers, which is the only thing that addresses concentration, since no amount of diligence on one provider reduces the correlation when nine funds share it. For an allocator the practical step is narrow: find out this week whether your assets sit at an address that is uniquely yours, and if the answer is no, treat the position as a claim on an operating company rather than as a holding.

For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.

‍