One year after its initial guidance, the U.S. Securities and Exchange Commission has issued a new bulletin cautioning retail investors on cryptocurrency custody risks, expanding on third-party vulnerabilities like rehypothecation and linking to advancing digital asset regulations.
The SEC's Office of Investor Education and Assistance released this updated Investor Bulletin on December 14, 2025, following its December 2024 guidance on crypto wallet basics and custody choices.
Reiterating that private keys are irrecoverable and seed phrases must be securely stored, the new bulletin delves deeper into third-party custodian risks. It warns of potential hacks, shutdowns, or bankruptcies, plus issues like rehypothecation (using client assets as collateral) and commingling funds. Investors should vet custodians for regulatory compliance, complaint history, insurance coverage, supported assets, security protocols, data sales practices, and fees such as annual charges or transaction costs.
This comes amid U.S. regulatory progress, including approvals for asset tokenization and bank-issued stablecoins, even as past exchange and custodian failures underscore sector vulnerabilities.