Custody and wallet security for a token project means controlling treasury funds and privileged contract roles with multi-signature wallets or qualified custodians, adding timelocks to sensitive actions, documenting wallet ownership, and moving inventory to partners such as market makers only to contractually named accounts. Coinbase’s technical review explicitly considers single points of control in a protocol’s architecture.
Key takeaways
- Coinbase says the degree of centralized control and single points of control is a key area of its security review.
- Put admin roles (mint, pause, upgrade) behind a multisig and, ideally, a timelock.
- Send market-maker inventory only to accounts named in the contract, with a small test transfer first.
- Label treasury, team, and liquidity wallets publicly; aggregators and exchanges check them.
The security basics for a listing project
| Asset or role | Recommended control |
|---|---|
| Treasury | Multisig with independent signers, hardware keys, documented policies |
| Mint / pause / upgrade roles | Multisig plus timelock, or renounced where appropriate |
| Liquidity positions | Locked or held by multisig, publicly disclosed |
| Market-maker inventory | Contractually named accounts, test transfers, regular reconciliation |
| Team allocations | Vesting contracts, public addresses |
Moving inventory to a market maker
- Sign the agreement first; it should name the receiving accounts.
- Verify addresses through a second channel (call, signed message).
- Send a small test amount and confirm receipt.
- Send the balance with multisig approval.
- Reconcile balances monthly against the market maker’s reports.
Monitoring
Set alerts for large movements from treasury, team, and liquidity wallets, admin-role changes, and unusual exchange inflows. Many teams use on-chain monitoring tools or their custodian’s alerts. Exchanges also expect prompt notice of incidents: MEXC’s listing terms, for example, require disclosure of hacks or attacks within 12 hours.
Frequently asked questions
Should a token project use a multisig?
For treasury and privileged contract roles, yes. A multisig requires several independent signers, so one compromised key cannot move funds or change the contract.
How should we send tokens to a market maker?
Only under a signed agreement, to an exchange sub-account or wallet identified in that agreement, after a test transaction, with approvals from more than one signer. Never to a personal wallet.
Do we need a qualified custodian?
Not always, but institutional investors and some jurisdictions expect it for larger treasuries. It is a trade-off between operational control, cost, and assurance.
Sources
- Coinbase: A Guide to the Digital Asset Listing Process at Coinbase
- MEXC: Listing Terms and Conditions (section 2.1.6, private key control)
Last reviewed 11 November 2026. Exchange and platform policies change; always confirm on the official page before acting.
Need a market maker or listing help?
Tell us about the project: chain, venues, timing, and which services you need. If there is a fit, we introduce you to a partner who covers it. Free for projects.
Request an introductionDisclosure: CEX Ready may be paid by partners for introductions. We never guarantee listings, prices, or volume.