The point
No. When your crypto sits inside any platform, Qatobit included, you hold a claim. The platform owes you that claim, backed by crypto it holds in wallets it controls. The platform holds the private key, the one thing that authorizes moving a coin on its blockchain. Two documented failures, WazirX in 2024 and Vauld in 2022, show what that gap can cost when a platform stops functioning.
What "yours" means when a platform holds it
Every crypto platform, whether an exchange, an app, or Qatobit, uses the same basic structure. It pools client crypto into wallets the platform controls. Your account records what the platform owes you. The private key sits with whoever controls the wallet holding the coin.
Custodial crypto works this way everywhere. A bank does the same thing with cash: it sits in the bank's vault, under the bank's control. Bank deposits carry deposit insurance up to a stated limit under Indian law. No equivalent protection scheme exists for crypto held on a platform today.
The alternative is self-custody: holding your own private key, usually inside a wallet only you control. Do that, and no platform decision can freeze your access, because no platform sits between you and the blockchain. You also become the only backup that exists. Lose the key, and there is no company to complain to and no process that gets it back.
Where institutional custody does help
Qatobit's operating standard rests on three things, read from the platform's own methodology documentation. A documented security and custody architecture comes first. Next, a CERT-In audit, named and verifiable at launch. Last, a live Proof of Reserves record that updates continuously rather than once a quarter.
Two of those three answer one question. Does the platform hold what it says it holds right now, and is that pool kept apart from the money it spends running its own business? Qatobit's structure keeps user funds separate from operational funds, with the accounting open to check whenever a holder wants to look. The same transparency covers how the indexes get built, because the methodology behind every index is public before a rupee moves.
A named, verifiable audit answers a narrower question. Has an outside party reviewed the architecture independently? Because the audit is named, a holder can go and look it up. It still says nothing about whether the platform survives as a business, or whether a court process could later freeze funds that genuinely exist.
The limits of institutional custody
None of that removes the risk category. A platform can hold real assets, pass every internal check, and still be unable to give them back to you on your own schedule. A freeze stops the monthly rebalance too. Nothing gets trimmed when it runs hot and nothing gets topped up when it falls behind, until access returns. WazirX and Vauld show two different ways a platform stops functioning.
WazirX, 2024
On 18 July 2024, the Lazarus Group, hackers linked to North Korea, breached WazirX's wallet infrastructure and stole approximately 234.9 million dollars in crypto. Withdrawals froze for every user immediately. Wikipedia's record of the 2024 WazirX hack and its court-approved restructuring carries the full sequence.
A Singapore court approved a creditor-backed restructuring scheme on 13 October 2025, with 95.7 percent of voting creditors in favour. The exchange resumed operations eleven days later, on 24 October 2025, more than fifteen months after the breach. Recovery happens through tokens under that scheme. Even the restructuring's own advisors disagreed publicly on the wait. One projected days, another two to three months, after the scheme took legal effect.
For fifteen months and counting, the crypto WazirX users held was not theirs to use.
Vauld, 2022
Vauld's failure had a different cause. On 4 July 2022, after users tried to withdraw roughly 198 million dollars in a matter of weeks, the platform suspended all withdrawals, buying and selling, and deposits at once. Vauld pointed to financial difficulty as the cause, with no external attacker involved.
Money that belonged to users became money nobody could touch, on a timeline the platform alone decided.
Holding a claim puts the platform's decisions between you and your own money. Security failures and financial ones both count. That stays true however solid the custody architecture looks on a calm day.
Every basket investor is already choosing
Self-custody removes the platform-failure risk WazirX and Vauld both show. It hands you a different risk: you become the entire system. Lose your private key, send crypto to the wrong address, or never tell anyone your recovery phrase, and there is no restructuring scheme and no court process waiting to help.
A basket that rebalances every month across several assets on a published methodology is close to unmanageable through self-custody alone. Somebody has to run the monthly trim and top-up on schedule, and that somebody needs the keys. It is the same reason you cannot pick the coins inside a QSI index once you have chosen to hold the basket.
Platform custody buys better odds. A platform that documents where crypto sits, and how it is kept apart from operational money, has closed off some of the crudest ways a platform fails its users. A live, checkable reserves record closes off more. Qatobit is pre-launch, with no operating history yet to point to.
Three things are worth checking directly before you park crypto on any platform, this one included. First, whether the reserves record updates live or once a quarter. Second, whether the platform states plainly that user funds sit apart from its own operating money. Third, whether a named, verifiable audit backs the custody architecture. All three are checkable in minutes, and none of them is a guarantee.
When the market is falling apart, the same monthly rebalance faces a harder test, and how a crypto index rebalances during a market crash walks through it.
Frequently asked questions
Do I own the actual coins when I invest through a crypto platform?
No. You hold a claim the platform owes you, backed by crypto sitting in wallets the platform controls. The private key, which authorizes moving those coins on their blockchain, stays with the platform.
What is a private key, and why does it decide who controls crypto?
A private key is the cryptographic code that authorizes moving a specific coin on its blockchain. Whoever holds that key controls the coin, regardless of whose name sits on the account showing a balance.
What happened to WazirX users' crypto after the 2024 hack?
The Lazarus Group stole approximately 234.9 million dollars from WazirX on 18 July 2024. Withdrawals froze for every user. A Singapore court approved a restructuring scheme in October 2025, and the exchange resumed operations more than fifteen months after the breach. Recovery now happens through tokens.
What happened to Vauld users when it froze withdrawals in 2022?
Vauld suspended all withdrawals, buying and selling, and deposits on 4 July 2022, after users tried to pull roughly 198 million dollars in a matter of weeks. The company cited financial difficulty. Users could not access funds that were legally theirs while the platform pursued restructuring.
Does institutional custody or Proof of Reserves guarantee a platform cannot fail?
No. Proof of Reserves can show that specific crypto exists in specific wallets on a given day, and fund segregation can show it is kept apart from company money. Neither one guarantees the platform survives as a business, or that a court process could never freeze access.
Crypto investments are subject to market risk. Not financial advice.
“A better allocation begins with a better explanation.”
Qatobit principle
Published construction. Fixed cadence. Versioned control.
