HT-00 Custody service file, last reviewed
Institutional crypto custody: segregated accounts, HSM key storage and licensed entities
Hex Trust holds client digital assets in on-chain segregated accounts with keys kept in hardware security modules validated to FIPS 140-3 Level 3, through Hex Trust MENA FZE (VARA licence VL/23/08/002) in Dubai and Hex Technologies Pte. Ltd. (MAS Major Payment Institution licence PS20200664) in Singapore, with a published insurance limit of US$25,000,000 across all clients.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.
File index
How Hex Trust custody works
Institutional crypto custody at Hex Trust runs on Hex Safe, the platform that clients log in to. An account passes through five steps. Where the live site is silent, the step says what to ask for.
1. Onboarding and verification
Accounts are opened through institutional sales: the login page sends new clients to [email protected]. Client verification uses kyc.hexcustody.com, one of the five domains that Hex Trust lists as official, so check the address before you upload a document. The document list and the approval time are not published.
2. Account and wallet setup
An approved client works in Hex Safe at hexsafe.hextrust.com. Assets are held in segregated on-chain accounts, in hot, warm or cold wallets. Hex Safe also connects to MetaMask Institutional and WalletConnect, for clients that use decentralised applications.
3. Approval policies
An approval policy sets who may propose a transfer and who must approve it before a key signs. The trust centre lists “flexible approvals” among its ten custody principles. Ask which rule types are on offer, such as quorum sizes, address allowlists or transfer limits, and for the procedure that changes a policy.
4. Transfers in and withdrawals
Assets arrive at the addresses of your own account. For withdrawals, Hex Safe states a “2-hour SLA for cold wallets and near instant for warm wallets”. The wallets page says that Travel Rule and Chainalysis KYT screening are built in at no extra cost.
5. Statements and reporting
The live site does not describe statement formats, reporting frequency or audit confirmations. Ask for a sample statement and the schedule, and whether your auditor can confirm balances against the addresses of your account. Then request a custody proposal that answers all five steps.
Key storage: hardware security modules
Hex Trust keeps private keys in hardware security modules (HSMs): devices built to generate and use keys without exposing them to ordinary servers. The trust centre names the vendor, Securosys Primus. The storage arrangement page adds that keys are always wrapped, that is, kept encrypted under another key.
HSMs validated to FIPS 140-3 Level 3
The modules are validated to FIPS 140-3 Level 3, according to the live trust centre. FIPS 140-3 on the NIST website is the US standard for cryptographic modules, published on 22 March 2019 to supersede FIPS 140-2. It defines four levels of security. A validation belongs to one module model and firmware version, so ask for the certificate number.
Air-gapped vaults and data diodes
Two parts of the storage set-up, which the storage arrangement page calls “Safe Plus” and “Safe Vaults”, operate air-gapped, with no network connection to the outside. Keys are generated with a true random generator, and encrypted keys are stored in several vaults in different locations. The custody page also names a “Cross Domain Solution via data diodes”. A data diode lets data move in one direction only. Ask where the vaults are and who may enter them.
Hot, warm and cold wallet tiers
The custody framework offers hot, warm and cold wallets. As a rule, the colder the tier, the more isolated the key and the slower the withdrawal: Hex Safe quotes near instant for warm wallets and two hours for cold ones. Ask how each tier is defined and which assets sit in which tier by default.
HSM custody is one of three common key models, and the guide MPC, HSM and multisig key models compared sets out the trade-offs. The SOC reports, certifications and penetration testing that the trust centre lists are set out under security architecture and assurance reports.
Segregation and legal structure
Segregation answers one question: if the custodian fails, can its creditors reach client assets? Hex Trust answers on two levels. The technical level is visible on-chain. The legal level is found only in the contract.
On-chain segregated accounts
The live custody page says that client assets are “legally and technologically segregated through on-chain account structures”. Read plainly, each client's assets sit at addresses of their own and not in a pooled wallet. Confirm in the custody terms that no omnibus address is used for your assets at any stage, withdrawals included.
Insolvency-remote structure
“Insolvency-Remote Legal Structure” is the live site's own term, and the page does not state the legal basis behind it. Ask for three things: the custody terms or trust deed, a legal opinion on how client assets are treated if the contracting company becomes insolvent, and the name and jurisdiction of that company. The due diligence checklist for choosing a custodian lists the other questions.
What segregation does not promise
Segregation lowers one risk and leaves others in place.
In Singapore, MAS requires Hex Technologies Pte. Ltd. to tell clients that a trust account or segregated account kept for their benefit “may not fully protect” their money or digital payment tokens from loss if the company's business fails.
Segregation also does nothing about market risk: the value of the assets can fall whatever the account structure. The risk disclosure sets out the risks in full.
Insurance: limit, scope and exclusions
Hex Trust publishes an insurance framework for custody. These are its terms as read on the live site.
- Limit across all clients
- US$25,000,000
- Incident report
- Within 24 hours
- Payment after claim approval
- Within 30 business days
- Cost to custody clients
- No additional cost
From the live insurance framework and wallets pages, accessed .
- Limit The framework gives a “maximum coverage of US$25,000,000 across all clients”: one pool shared by every client, not an amount per account. Do not read it as cover for the full value of your holdings.
- Scope Two events are named: dishonest or fraudulent acts or omissions of the custodian, and physical loss of or damage to private keys caused by natural disaster or violent acts. Incidents are reported to [email protected].
- Exclusions Neither named event covers a fall in the market value of the assets. Treat any other event as not covered until the policy wording says otherwise, and ask for the list of exclusions.
The live custody page shows “up to $25M+” in its text and “up to $50M+” in its structured data. Confirm the limit, the insurer and the policy period before you rely on either figure.
Supported networks
The live custody page names 34 networks. They are grouped here in alphabetical order.
| Initial | Networks | Count |
|---|---|---|
| 0 to A | 0G, Algorand, Avalanche | 3 |
| B | Babylon, Base, Bitcoin, Bitcoin Cash, BSC | 5 |
| C to D | Celestia, Core, Cosmos, Dymension | 4 |
| E to H | Ethereum, Etherlink, Flare, Grass, Hedera, HyperEVM | 6 |
| I to N | Injective, Kaia, Linea, Mantra, Neutron, Nillion | 6 |
| O to S | Optimism, Polkadot, Polygon, Solana, Songbird, Stacks | 6 |
| T to X | Tezos, Ton, XRPL, Xion | 4 |
| Networks named | 34 | |
Tokens are a separate list. The help centre keeps the current assets supported on Hex Safe. The site's own totals differ from page to page (30+, 35+ and 36+ blockchains, and “500+ tokens”), so this file counts only the networks that are named. Confirm each asset you hold, on the network you hold it on, before you sign.
Custody fees and service levels
Hex Trust does not publish a custody fee schedule: the live site has no pricing page, and custody is quoted for each client. The table sets out what is stated in public.
| Item | Basis | Published figure |
|---|---|---|
| Custody fee | Quoted per client | Not published |
| Onboarding fee | Not stated | Not published |
| Minimum balance | Not stated | Not published |
| Insurance cover | Included with custody wallets | No additional cost |
| Travel Rule and Chainalysis KYT screening | Included with custody wallets | No extra cost |
| Withdrawal SLA, warm wallet | Hex Safe service level | Near instant |
| Withdrawal SLA, cold wallet | Hex Safe service level | 2 hours |
Last reviewed .
A custody proposal should state the fee basis (a percentage of assets under custody, a fixed fee, or both), any minimum, network fees and the cost of adding a network. The pricing page explains how custody pricing is set and what to compare between quotes.
Who can open an account, and with which entity
Hex Trust is a group of companies, and a custody agreement is signed with one of them. Which one depends on where your institution is based, and each licence limits the clients that company may serve. The about page describes the legal entities behind Hex Trust in full.
| Jurisdiction | Entity | Regulator and licence | Eligible clients | Not covered |
|---|---|---|---|---|
| Dubai, UAE | Hex Trust MENA FZE | VARA VASP Licence: Custody Services, VL/23/08/002 | Institutional Investors and Qualified Investors | Retail clients; Aura, token wrapping, wXRP, DPT lending and staking |
| Singapore | Hex Technologies Pte. Ltd. (UEN 201924026H) | MAS Major Payment Institution licence PS20200664: digital payment token service | Clients other than retail consumers | Retail consumers; Aura, token wrapping, wXRP, DPT lending and staking |
| Hong Kong | Not named on the live site | Trust company registration and TCSP licence (AML), not an SFC-licensed platform; number not published | To confirm | To confirm |
| European Union | No current entity confirmed | None confirmed | Not offered | This page is not addressed to clients in the EU |
VARA register and MAS directory entries opened on .
The VARA entry for Hex Trust MENA FZE showed the status Active and an issue date of 15 November 2023, and the live Dubai page gives 12 July 2027 as the renewal date. Check the licences and register entries by entity before you sign. The guide on how custody is regulated in Dubai, Singapore and Hong Kong explains what each kind of licence covers.
Third-party custody compared with self-custody and exchange custody
An institution can hold digital assets in three ways. Each has drawbacks, third-party custody included.
| Question | Third-party custodian | Self-custody | Exchange custody |
|---|---|---|---|
| Who holds the keys | The custodian, acting on the client's approval policy | The institution's own staff, on its own devices | The exchange |
| How assets are held | Depends on the custodian; Hex Trust states segregated on-chain accounts | At the institution's own addresses | Often pooled with other customers' assets; it depends on the venue |
| Outside supervision | A licensed company with a register entry to check | None over the key process, unless the institution is itself supervised | Depends on the venue and its licence |
| Access to assets | Inside the custodian's SLA: at Hex Trust, near instant (warm) or 2 hours (cold) | As fast as internal procedures allow | Immediate for trading; withdrawals on the venue's terms |
| Drawbacks | Dependence on one counterparty, onboarding time, withdrawal SLAs instead of instant access, a recurring fee | Key loss or theft falls on the institution, which must build, staff and audit its own controls | Credit and operational exposure to the venue; custody and trading sit under one roof |
Custody is also the base for two further services, where the entity that serves you offers them: OTC execution from custody accounts and staking from custody accounts. Staking is not offered in Singapore or Dubai.
Institutional custody FAQ
Is Hex Trust a licensed custodian?
Yes, through named companies. Hex Trust MENA FZE is licensed by VARA in Dubai for Custody Services (VL/23/08/002), and Hex Technologies Pte. Ltd. is licensed by MAS in Singapore as a Major Payment Institution (PS20200664). The Hong Kong status is different: TCSP licence (AML), not an SFC-licensed platform.
How are client assets segregated?
On-chain and by legal structure, according to the live custody page: each client's assets are held in segregated on-chain accounts. The legal basis for the insolvency-remote structure is not published, so ask for the custody terms and a legal opinion. In Singapore, MAS requires a warning that a segregated account may not fully protect client assets if the business fails.
What does the insurance cover?
Two named events, up to a limit of US$25,000,000 shared across all clients, not per client. The events are dishonest or fraudulent acts or omissions of the custodian, and physical loss of or damage to private keys from natural disaster or violent acts. Incidents must be reported within 24 hours.
Which assets and networks are supported?
The live custody page names 34 networks, among them Bitcoin, Ethereum, Solana, XRPL, Hedera and Polygon. The token list is kept on the Hex Trust help centre and changes as assets are added. Confirm that each asset you hold is supported, on the network you hold it on, before you sign.
How fast are withdrawals?
Near instant from warm wallets and within two hours from cold wallets, according to the service level stated for Hex Safe. These are stated service levels, not a promise for every transfer: your own approval policy and compliance screening can add time.
What does custody cost?
Hex Trust does not publish a custody fee: it is quoted for each client. Two items are stated as included with custody wallets: insurance cover at no additional cost, and Travel Rule and Chainalysis KYT screening at no extra cost. Ask for the fee basis, any minimum and any onboarding fee in the proposal.
The FAQ page answers more questions about custody, OTC execution and staking.
Regulatory disclosure
Custody is provided by the Hex Trust company that serves your jurisdiction, not by the brand as a whole.
Dubai. Hex Trust MENA FZE is licensed by the Virtual Assets Regulatory Authority (VARA) for Custody Services under VASP licence VL/23/08/002 (VARA public register: Hex Trust MENA FZE) and may serve Institutional Investors and Qualified Investors only. OTC execution in Dubai is a separate service of HT Markets MENA FZE, licensed by VARA for Broker-Dealer Services under licence VL/23/08/003 (VARA public register: HT Markets MENA FZE).
Singapore. Hex Technologies Pte. Ltd. (UEN 201924026H) is licensed by the Monetary Authority of Singapore (MAS) as a Major Payment Institution under the Payment Services Act 2019, licence PS20200664 (MAS Financial Institutions Directory entry). It does not serve retail consumers.
Hong Kong. The live trust centre lists a trust company registration and a Trust or Company Service Provider licence, without a number or the name of the company that holds them. In plain terms: TCSP licence (AML), not an SFC-licensed platform.
European Union. No current EU entity or authorisation is confirmed on the live site, and this page is not addressed to clients in the EU.
Not covered. Wealth Management (Aura), Token Wrapping, wXRP and DPT lending or staking appear on the global Hex Trust website. They are not offered in Singapore or Dubai, and are not regulated by MAS or under VARA. The Dubai and Singapore companies do not serve retail clients. As the risk warning says, digital assets do not benefit from any form of financial protection, and the insurance described on this page is limited in amount and scope.
This page is for information only, not investment advice. Further guides are collected under custody insights.
Ask for a custody proposal
Tell institutional sales where your institution is based and which assets and networks you hold. The proposal should name the contracting entity and its licence, the fee basis and the service levels.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.