What custody means
A cryptocurrency balance is not an entry that an authority can be asked to release. It is value that can only be spent by signing a transaction with the matching private key — there is no account manager who can move it on request and no password reset that recovers it. Control follows the key and nothing else, which is why custody is the foundational security question in crypto.
Self-custody means the owner holds their own keys directly: funds can only be moved by software the owner runs, and no other party can sign on their behalf. The freedom is complete and so is the responsibility — a lost key is lost funds, with no recourse. Third-party custody means a custodian holds the keys and signs on the owner's instruction; the owner gains operational convenience and managed recovery, but in exchange trusts that custodian's controls, because the party that can sign is the party in control.
Custody is therefore distinct from ownership. A custodial arrangement can record that funds belong to a particular owner while a different party holds the signing key: the ledger says who the funds belong to; the key decides who can move them. Those two facts stay aligned only for as long as the custodian's signing controls hold — which is why how a custodian signs, and what stands between a request and a signature, is the substance of the arrangement.
Why it matters for crypto payments
Accepting crypto means receiving funds to addresses and, eventually, sending them out — and both require signing. A payment system signs to sweep deposits and to push payouts, so somewhere in the flow there are keys that can move money. The custody question for a merchant is therefore concrete: who holds those keys, and what controls govern when they are allowed to sign on the merchant's behalf?
A custodial integration is neither a vault that makes funds untouchable nor a black box to be trusted blindly. What protects the money is the discipline around the keys — limiting which credential can authorise which action, requiring approval before value leaves, and recording every signing event so it can be reviewed. A custody claim is only as strong as those controls; evaluate the process, not the promise.
Custody on halfin
halfin is payment infrastructure that signs on a merchant's behalf, so its custody boundary is described through three things — signing, permissions, and audit — and not as a guarantee beyond them. Funds move through halfin's keys, and the assurances are about how those keys are used rather than a vault promise: a payout is signed only after it is approved, API keys carry scoped permissions so a credential can authorise only the actions it is granted, and signing events are auditable so money movement can be reviewed instead of taken on trust.
For a merchant, this is where the abstract custody question becomes operational. Sending a single or mass payout ends in a signed, broadcast transaction, so it sits behind approval and permission checks rather than firing the instant the API is called. Mass payouts fan out as individual lines, each carrying its own idempotency key, so a retried request re-sends the same instruction instead of paying twice. The point is not that funds are locked away, but that every movement is gated, scoped, and recorded.
Webhooks close the loop. Because the events that report money leaving — payout.completed and payout.failed — are HMAC-signed, an integration can confirm a notification genuinely came from halfin before acting on it. The rule is to verify the signature first and treat it, not the payload's appearance, as the source of truth.
- Custody = who controls the private keys, because the key holder is the party that can move the funds.
- Self-custody puts keys in the owner's hands; third-party custody puts them with a custodian who signs on the owner's instruction.
- A custody claim is only as strong as its signing controls — evaluate the process, not the promise.
- halfin describes its boundary through signing, permissions, and audit: approval-gated, permission-scoped, auditable money movement — not a custody guarantee beyond that.