We make you wait 48 hours to withdraw from our Vault. On purpose. Happy to explain the design.

Xapo's BTC Vault is our long-term storage product, separate from the everyday wallet. Its defining feature is a mandatory 48-hour hold on every withdrawal. No opt-out, no VIP bypass, no support agent who can waive it. People sometimes read that as friction for friction's sake, so here is the actual threat model.

Very little Bitcoin is lost to broken cryptography. It is lost to stolen phones, phishing pages, SIM swaps and convincing phone calls, and all of those attacks depend on speed, because compromised access spoils fast. The Vault takes speed off the table. A withdrawal needs your PIN, fires an email to your registered address the second it is created, and can be cancelled from any device you can log in on for the full 48 hours. An attacker with your phone and your PIN starts a two-day countdown in which you only need to see one email.

Some honest detail:

The delay is one layer, and the layers assume each other can fail. The private key never exists as a complete object anywhere. We use MPC-CMP: the key exists only as shards across geographically dispersed, network-segregated environments. The key-share creation process is CCS Level 3 certified. On top of that sits a policy engine: customer withdrawals must come from the customer's own device, high-value operations need approvals from multiple teams, and destination addresses are whitelisted, so a transaction to an unapproved address dies before signing even with valid approvals. No single person at Xapo can move member Bitcoin.

On account-level controls: hardware security keys (physically tapped to the phone) can be required for Vault withdrawals and are phishing-resistant by design. TOTP is available for login and crypto withdrawals, and we will be straight with you about its limits: if the authenticator lives on the same phone as the app, it does little against phone theft specifically.

Custody-side: member Bitcoin is held 1:1 by Xapo VASP Limited under Gibraltar's DLT framework (GFSC regulated, segregated client assets), not lent or  rehypothecated, with financial statements audited annually by KPMG. Zero Bitcoin lost to a security incident in over a decade of operating.

None of this is a pitch against self-custody. Plenty of members run both, which is sensible at a certain size. The Vault covers the failure modes where one person with one phone is the whole security system.

Questions welcome. Full write-up here.

Crypto services are provided by Xapo VASP Limited, a Distributed Ledger Technology Provider regulated by the GFSC (Permission No. 26061). These are not provided by Xapo Bank Limited. Banking services are provided by Xapo Bank Limited, regulated as a Credit Institution by the GFSC (Permission No. 23171) for fiat balances only. Crypto asset deposits are not covered by the Gibraltar Deposit Guarantee Scheme. Where we use terms like "guaranteed", "protected" or "secure" regarding crypto, we refer only to our technical and operational security features, not to any form of government deposit protection or regulatory financial safeguard.