pledgeWho protects your Bitcoin collateral — and who doesn't
When you deposit BTC as loan collateral, you need to know three things: is it insured, is it legally separated from the platform, and can you verify it exists? The answers vary wildly across the 15 platforms we track.
The useful job of this page is not to rank lenders on a shopping axis. It is to help you read custody, reserve reporting, and failure-mode design before you trust anyone with collateral.
Data checked: June 21, 2026 · 15 tracked platforms
Collateral protection across all 15 platforms
| Platform | Insurance | Bankruptcy-Remote | Reserve Transparency | Rehypothecation |
|---|---|---|---|---|
| Unchained9.0/10 | Multi-sig (you hold a key) | No (but multi-sig protects) | Published | No |
| Ledn7.4/10 | Custodial; Open Book PoR | No | Published | Partial |
| Arch7.0/10 | Anchorage custody | Yes | Not published | No |
| Nexo5.3/10 | Third-party custodian | No | Not published | Partial |
| Figure7.1/10 | MPC standard | No | Not published | No |
| Lava3.4/10 | None | Custody unresolved | Not published | Confirm |
| YouHodler4.0/10 | Ledger Vault | No | Not published | Partial |
What happens to your BTC if the platform fails
This is the scenario most borrowers do not think about until it happens. We watched it play out with Celsius ($4.7B frozen), BlockFi (100K+ creditors), and Voyager ($1.3B in limbo). Your custody model determines everything.
Multi-sig custody (Unchained) — you hold a key
Unchained uses 2-of-3 multi-sig. You hold 2 keys and Unchained holds 1, so the borrower has majority key control. If Unchained disappears, the setup gives you a direct recovery path using your key plus the backup key. This is one of the clearest borrower-control structures we track, with stronger separation from a platform bankruptcy than standard custodial lending.
Bankruptcy-remote trust (Arch) — legally separated
Arch holds collateral in a bankruptcy-remote trust. If Arch fails, the trust is designed to be legally separated from the corporate estate, so borrower collateral should not be treated like a general creditor claim. This is the same structure used in structured finance.
Third-party custody (Ledn, Nexo) — depends on the custodian
Ledn holds collateral in custodial storage and publishes Open Book reporting plus semiannual third-party reserve reporting (The Network Firm LLP), but its disclosures allow collateral to be re-posted to institutional USD funding partners (partial rehypothecation). Nexo has used third-party custodians including Ledger Vault. If the lending platform fails, your BTC is at the custodian — not in the platform's bankruptcy estate. But if the platform can reuse collateral under account terms, the custodian may not hold enough segregated BTC to cover all claims. Confirm each platform's current agreement language before assuming collateral isolation.
Non-custodial (Aave, Maker) — smart contract custody
On genuinely non-custodial protocols like Aave and Maker (Sky), your collateral sits in a smart contract rather than a company-controlled account. That reduces platform-custody risk, but if the smart contract, oracle, or liquidation path fails, losses can be irreversible and there is no insurance, support desk, or regulator to resolve it. Note that Lava markets self-custody but its custody model is unresolved (reporting indicates custodial cold storage as of Nov 2025), so it does not belong in this clean non-custodial category.
What Celsius taught us about collateral protection
Celsius froze $4.7B in customer assets in July 2022. The root causes were exactly the gaps our safety scoring now checks for.
Rehypothecation
Celsius lent out customer deposits to generate yield. When those loans defaulted, customer BTC was gone. Our scoring penalizes rehypothecation heavily — Unchained, Arch, and Figure score 10/10 on this factor (no rehypothecation), while Ledn scores 7/10 (collateral may be re-posted to institutional funding partners) and Lava only 5/10 because its no-rehypothecation claim can no longer be treated as architecturally enforced given its unresolved custody.
Weak or missing reserve transparency
Celsius never published credible reserve reporting. Borrowers had no way to verify assets against liabilities. Ledn publishes Open Book reporting and Nexo has historical reserve-attestation materials (Moore Johannesburg/TrustReserve, not reverified as current), while YouHodler and Figure do not publish reserve reporting at all.
Commingled assets
Celsius mixed customer funds with corporate funds. Bankruptcy-remote structures (Arch) are designed to separate collateral from the corporate estate. Multi-sig (Unchained) reduces the platform's ability to move borrower collateral without participation from the borrower.
How to use this before narrowing the field
The clearest collateral-protection structures in our tracked set are multi-sig custody (Unchained, 9.0/10 — borrower majority key control) and bankruptcy-remote trusts (Arch, 7.0/10 — legal separation by design). They are not identical, but both give borrowers more structural protection than standard platform custody.
For maximum protection, prioritize platforms with no rehypothecation and published reserve reporting or on-chain verification. Keep the next step in the research flow, not the shopping flow: use the custody explainer, collapse post-mortems, or the loan-risk guide to pressure-test how the structure behaves when something breaks.
Keep the protection analysis moving
Related research
Custodial vs Non-Custodial
Who holds your keys and what happened when Celsius, FTX, and Voyager failed.
Platform Collapses: Post-Mortems
What happened to Celsius, BlockFi, and Voyager — and recovery rates.
Bitcoin-Backed Loan Risks
The 5 real risks — and how each lender handles them.
Multi-Sig vs Custodial
Decision framework for custody model selection.
Explore top lenders
Keep the next step in the research flow
Use this page to decide whether the real concern is custody design, reserve reporting, or platform-failure behavior. Then move into custody models, collapse post-mortems, or the broader loan-risk guide depending on which failure mode still needs pressure-testing.