Swan Trinity: The Custody Trust Model Gets Re-Architected, But the Collusion Assumption Remains Unproven
August 2025. Coldcard hardware wallets compromised at scale. The self-custody narrative took a direct hit. Entropy wins. Always check the fees.
Now Swan Bitcoin announces Trinity โ a custody product where the customer holds zero keys. Three institutions. Each holding one key. A 2-of-3 multisig structure, inferred but not confirmed. Swan. BitGo. And an unnamed third party, possibly domiciled in the UK.
This is not a technology story. This is a trust re-allocation story. And the critical variable โ the identity and independence of that third key holder โ remains undisclosed. The entire security model rests on an assumption that cannot yet be verified. The product hasn't launched. There's no whitepaper. No audit plan. No governance framework. What exists is a podcast announcement and a narrative about institutional independence.
The collaborative custody model has been the standard for Bitcoin-native custody since Casa and Unchained Capital popularized it. The structure: customer holds two keys, the company holds one. A 2-of-3 multisig where the user retains meaningful control. The security assumption is that the user is honest and at least one institution is honest.
Trinity inverts this. The customer holds nothing. Each of three institutions holds one key. The security assumption shifts to: at least two institutions will never collude and can maintain independent operations.
Cory Klippsten, Swan's CEO, announced this on the Unchained podcast before formal product disclosure. The product targets Q4 launch. Mike Belshe, BitGo's CEO, is credited with the original idea. A few very small companies already offer similar structures.
The timing is deliberate. The Coldcard theft event in August created a demand shock for institutional custody alternatives. Swan's Sovereign service โ a self-custody advisory product โ grew to 1,300-1,400 clients in the aftermath. Trinity is positioned as the next step for users who want security without responsibility.
Let me be precise about what's technically new here. Nothing. Key splitting is mature cryptography. 2-of-3 multisig has been deployed in Bitcoin since the early multisig experiments. The technical increment is organizational: which entities hold which keys, and under what legal obligations.
From my audit experience โ I spent months dissecting the FTX withdrawal engine in 2022, tracing how internal ledger entries masked insolvency โ I can tell you that the failure modes in custody are rarely cryptographic. They are operational. They are legal. They are collusive.
The Trinity model replaces one trust assumption with another. Collaborative custody assumes the user is competent and at least one institution is honest. Trinity assumes at least two institutions are honest and never collude. That is a stronger assumption, not a weaker one. Impermanent loss is real. Do your math. The same applies to trust assumptions.
Consider the math. Three institutions. Any two can sign and move all funds. The collusion threshold drops from "one institution goes rogue" to "two institutions coordinate." That's not a trivial elevation. Business partnerships create dependencies. Swan and BitGo have worked together since September 2023, when BitGo Trust became Swan's custodian. They have established legal frameworks and operational integration. That history is efficiency. It is also a potential vector for soft collusion โ data sharing, joint risk assessments, aligned incentives that never rise to the level of formal conspiracy but erode the independence assumption.
The third institution is the wildcard. If it's a UK-based company, as reported, you introduce cross-jurisdictional complexity. US and UK bankruptcy law. Asset recovery across borders. Dispute resolution mechanisms that don't exist yet. The entire security model rests on three institutions maintaining genuine independence. But the third institution's technical capability, compliance posture, financial stability, and operational experience are all unverified.
Compare this to MPC-based custody. Fireblocks and ZenGo use multi-party computation for distributed signing. That's cryptographically more sophisticated and operationally more flexible than three institutions each holding a full key. Trinity is, from a pure cryptography standpoint, a step backward. The differentiation is institutional structure, not cryptographic innovation.
The "no customer keys" positioning cuts both ways. For institutional investors and Bitcoin newcomers, it eliminates the hardware wallet burden. No seed phrases. No Coldcard exposure. For long-term Bitcoin holders, self-custody is the value proposition. Trinity may find its market among high-net-worth individuals who prioritize security but lack technical capability. That's a real segment. It's also a segment that's been underserved.
The competitive landscape matters here. Casa and Unchained serve the technically capable holder who wants control. Coinbase Custody and BitGo serve large institutions with regulatory compliance. Trinity occupies the middle: users who want institutional-grade security without managing keys. That's a genuine gap. But it's also a gap that BitGo could fill itself โ the company already has the custody infrastructure and the regulatory licenses. The moat is the Swan-BitGo relationship, not the technology.
The fee structure is another unknown. Three institutions each need compensation. If Swan charges a custody fee, BitGo charges a custody fee, and the third institution charges a custody fee, the total cost could be three times a single-custodian arrangement. For institutional clients, that's a meaningful line item. The value proposition has to justify the cost premium. Whether it does depends on how much clients value the distributed trust model over a single regulated custodian.
On the regulatory front, the multi-institution structure actually helps. State-level money transmitter laws and trust company regulations favor entities with established compliance frameworks. BitGo Trust is a South Dakota-chartered trust company. Swan works with Bakkt and Equity Trust. The compliance infrastructure exists. But the cross-jurisdictional element โ if the third key holder is UK-based โ introduces questions about bankruptcy isolation and asset recovery that no amount of technical sophistication can resolve.
Klippsten's framing โ "you won't have two institutions colluding to steal your coins" โ is narrative, not mechanism. Financial history is littered with institutional collusion. LIBOR manipulation. The 2008 credit default swap market. Institutions collude when incentives align and detection risk is low.
The governance gap is the problem. The agreement between the three institutions โ its terms, its enforcement mechanisms, its dispute resolution process โ is undisclosed. There's no published technical whitepaper. No audit plan. No insurance framework. No verification mechanism for clients to confirm their assets exist and are properly segregated.
From my EIP-1559 work in 2021, I learned that the most interesting dynamics emerge in edge cases. The edge case here: what happens when one institution enters bankruptcy? The legal treatment of key shares โ whether they're classified as client assets or institutional assets โ determines whether recovery is possible. That's not a technical question. It's a legal one. And it's unanswered.
The deeper problem is verification. How does a client know their bitcoin exists? How do they audit the three institutions? In traditional finance, custodians provide regular statements and independent audits. In crypto, the equivalent would be cryptographic proofs or third-party attestations. Neither has been disclosed for Trinity. The absence of a verification mechanism is itself a risk signal.
There's also the narrative risk. "Not Your Keys, Not Your Coins" isn't just a slogan in this community. It's a first principle. Swan has built its brand on self-custody advocacy. Trinity's positioning โ "you don't need any keys" โ directly contradicts that. The backlash from the Bitcoin core community could damage Swan's other product lines. Vault and Sovereign serve users who believe in self-custody. Trinity serves users who've been scared out of it. These are different audiences with different values.
Until the third institution is named and its independence verified, Trinity is a product with an unproven security assumption. The Q4 launch window is tight. Development cycles for custody products โ software, compliance, legal documentation โ typically exceed two quarters. Delays are likely. If the launch slips, the Coldcard-driven demand window may close.
The custody market is bifurcating. Self-custody purists will hold their keys. Passive investors will delegate entirely. Trinity serves the latter. Whether that's a sustainable model depends on whether three institutions can maintain genuine independence under operational and legal pressure. The third key holder's identity will tell us more than any whitepaper. 2017 vibes. Proceed with skepticism. The math is simple. The trust is not.