The Post-FTX Plumbing Is Growing a Balance Sheet

Introduction

BitMEX’s announcement of Zodia Custody’s Interchange, dated 20 April 2026, describes two features in the same product. Client collateral sits in cold, segregated custody inside what Zodia calls a Trading Vault, is mirrored to BitMEX for trading purposes rather than transferred, and settles daily in BTC, ETH, USDC or USDT. Once mirrored, the same client can access BitMEX’s full derivatives suite, including up to 250x leverage.

Both statements are accurate and point in opposite directions. Off-exchange settlement exists because FTX held customer assets it was free to move. The design answer was to stop sending assets to the venue at all. But a settlement network that supports 250x leverage, and that increasingly sits alongside loan books and prime brokerage lines, is a credit arrangement operating inside a custody wrapper.

Off-exchange settlement, or OES, is safer than pre-funding an exchange along one specific axis. The critical issue is which axis, and what residual exposure looks like once financing rides on the same rail. Evaluating that exposure requires knowing what a mirrored balance legally is, who can move it and under what conditions, how long the unsettled window runs, and which legal entity extends credit against the collateral.

Public documentation on these points is thin. Copper’s ClearLoop product page is a marketing page with a partner-executive quote. The FalconX partnership announcement that would document ClearLoop’s financing extension returned a 404 when we tried to retrieve it. BitGo’s prime brokerage page carries a single headline fragment about OCC approval to convert to a federally chartered national trust bank, with no supporting detail. The BitMEX post is the most substantive of the four and still describes the mirroring mechanism in product language rather than legal terms. Where the public record is empty below, we state that directly.

What pre-funding actually cost

Before OES, an institution that wanted to trade size on a centralized venue sent the collateral to the venue. The exchange held the private keys, credited an internal ledger balance, and margined positions against that entry. Client assets and exchange assets lived in the same wallets and, in the failure cases the industry later documented, on the same balance sheet. FTX’s collapse in November 2022 is the reference point because the commingling was not incidental to a hack or a market move. Customer collateral was available to the operator as a funding source, and the internal ledger entry that clients treated as ownership turned out to be an unsecured claim.

That structure produced two distinct costs that separate along mechanism lines.

The first is credit exposure on idle collateral. A fund running a basis trade might hold a large multiple of its required margin at a venue simply to avoid liquidation risk during volatility, and to be able to add. Every dollar of that buffer was an unsecured loan to the exchange, earning nothing, exposed to operator behaviour the client could not observe. OES targets this directly. If collateral stays in a segregated vault at a third-party custodian and only the margin entitlement is communicated to the venue, the buffer is no longer on the venue’s balance sheet.

The second cost is exposure on positions themselves. A derivatives position generates variation margin. Someone is owed money by someone else continuously, and that obligation exists regardless of where the collateral is custodied. A trader with a large unrealised gain at a venue is a creditor of that venue for the gain, whether the underlying collateral sits in the venue’s hot wallet or in a Zodia vault in the UK. OES compresses this exposure by settling frequently rather than eliminating it.

The distinction matters because vendor framing tends to collapse the two. The claim that assets never leave custody applies to the first cost while remaining silent on the second.

The mirror is a permission, not a transfer

The word doing the most work across all three architectures is mirroring. The BitMEX post says collateral is held in the Zodia Trading Vault and mirrored to BitMEX, remaining in cold segregated custody at every point of the trade until settlement, with automated settlement running through an Interchange Trading Vault and Settlement Wallet. What that describes structurally is an attested balance: the custodian locks a defined quantity of assets and signals to the venue that the assets are locked and allocated to that client’s account at that venue. The venue credits margin against the attestation. No on-chain transfer to the venue occurs at trade time.

Three structural consequences follow from this design.

The mirrored balance is a contractual construct, not a cryptographic one. Whether the venue holds a pledge, a security interest, a right under a tri-party agreement, or something closer to a bailment with an irrevocable instruction is determined by the documentation between custodian, venue, and client. That classification determines priority in an insolvency proceeding, and it is not disclosed publicly for any of the three networks. A locked balance in a custodian’s vault is not self-executing. Contractual terms must make the lock enforceable against the client, and must make the release enforceable against the venue.

Settlement cadence sets the size of the residual credit window. Interchange settles daily, per BitMEX. Between settlement cycles, accrued variation margin is unsettled. A client who is up on the day holds a claim against the venue for that amount, backed by nothing but the venue’s solvency. A client who is down owes the venue, and the venue’s recourse is the locked collateral. The exposure has not been removed; it has been resized from the full posted balance to roughly one settlement period of net variation margin plus whatever slippage occurs during a liquidation. That is a bounded improvement, and its magnitude is a direct function of cadence. Daily settlement on a venue offering 250x products creates a materially different exposure than daily settlement on a spot venue.

The custodian acts as an agent of the venue’s collateral claim, not as a neutral vault. For mirroring to support leverage, the venue must be able to reach the locked collateral when a position is liquidated, without asking the client. That means the custodian has agreed in advance to execute transfer instructions from the venue under specified conditions. The client’s protection is therefore not that the custodian controls the keys. It is that the conditions under which the custodian must act are narrow, verifiable, and correctly implemented. If a venue’s liquidation engine misprices a position or acts on a corrupted index, the custodian will still move the assets, because the custodian’s legal obligation at that moment is to honour the instruction.

A further mechanism remains undocumented in public sources. Networks that connect a single custodied pool to multiple venues advertise capital efficiency. Efficiency across venues requires either that a client allocates exclusive slices of collateral per venue, in which case the gain is limited to not pre-funding, or that entitlements at different venues overlap against a shared pool. The second case creates a netting problem when stress hits, since two venues liquidating the same client simultaneously would both instruct against the same assets. We could not determine from public documentation which model ClearLoop or Interchange uses.

Three networks, and what their public documents do not say

The three architectures anchoring this market differ in custodial structure, regulatory anchor, and how far each has pushed into financing. They also differ sharply in how much is verifiable.

Several figures circulate about ClearLoop’s scale, including throughput on the order of $50 billion per month across roughly eight venues with multi-custodian support from Komainu and BitGo. None of these appear on Copper’s public product page, and we could not verify them against primary disclosure. They may well be accurate. They should not be treated as confirmed, and an institution sizing counterparty limits against a network’s claimed throughput should ask for the attested number rather than the marketed one.

The same applies to financing claims. ClearLoop Loans and a FalconX direct-market-access leverage line are key elements of the ClearLoop structure because they represent where custody separation meets credit extension, yet the announcement documenting them is not retrievable. Zodia’s reported prime brokerage tie-up with Hidden Road is absent from the BitMEX post entirely. BitGo’s Go Network and the reported first IPO by a crypto custodian are likewise unevidenced in what we could retrieve, leaving only the OCC headline fragment, without a date or a statement of whether conversion is complete.

What the retrieved sources do establish is that these are institutional-perimeter products. Interchange is limited to eligible mutual Zodia and BitMEX institutional or professional clients in select jurisdictions. That restriction is itself a risk control, since it constrains the population that can be simultaneously liquidated through the rail, while also constraining the network’s growth.

Two insolvencies, two very different unwinds

The primary diagnostic is the failure walk-through across each leg of the arrangement.

If the venue fails

This is the case OES was built for and the case it handles best. Client collateral is on-chain under the custodian’s control, in a segregated vault, outside the venue’s wallets and outside its estate. A withdrawal freeze at the venue does not trap the collateral, because the collateral was never at the venue.

The residual exposures are narrower but real. Unsettled variation margin owed to the client is an unsecured claim against the estate. Open positions cannot be closed at a venue in administration, so a client running a hedge with a long at one venue and a short at another loses one leg while remaining exposed on the other, with collateral locked behind both. And the mechanical question of who releases the mirror is genuinely unresolved in public documentation. If the venue must consent to unlocking allocated collateral under normal operation, then the custodian needs a unilateral release right conditioned on a defined event of default. Defining that event, and proving it has occurred, is a legal process with a timeline measured in weeks or longer, not blocks. Assets that are safe from the estate can still be immobile for a long period.

If the custodian fails

This case receives far less attention and introduces more branches. Insolvency of the custodial entity is the branch most amenable to structural protection: assets held in segregated trust arrangements are, in principle, not property of the estate, and a UK-regulated custodian or a federally chartered national trust bank operates under rules designed to make that true in practice. A national trust charter, if BitGo’s conversion is completed as stated, brings federal examination and capital requirements that a state trust charter may not match, though we could not confirm the scope of the approval from the retrieved page.

Operational failure is the more dangerous branch. A key compromise, a ransomware event, a court-ordered freeze, or a signing infrastructure outage does not require the custodian to be insolvent. It only requires the custodian to stop attesting balances and processing settlement instructions. The moment attestation stops, every connected venue is holding margin credit it can no longer verify or enforce. The rational venue response is to suspend the affected accounts and, where positions are open and unsettled margin is accruing, to liquidate. That would happen across all venues connected to that custodian at once, to all clients using that custodian, in the same hour.

That creates a concrete contagion mechanism that did not exist under pre-funding. When collateral sat at the venue, a custodian’s operational status remained separate from trade margining. Mirroring makes a custodian’s availability a live input to margin adequacy at every venue it connects to.

A third failure surface sits between the two. The network layer, meaning the attestation bus, allocation logic, and settlement orchestration, is separate from the vault. Copper’s reported multi-custodian support, with Komainu and BitGo custody alongside Copper’s own, implies this separation. A network-layer outage with all custodians healthy would freeze collateral mobility without endangering title, which is the mildest of the three scenarios and likely the most frequent.

Financing on top of the settlement rail

The reported extension of these networks into lending alters the risk profile beyond custody.

Credit against mirrored collateral introduces distinct mechanics. A lender extending a loan against assets in a segregated vault needs enforceable recourse to those assets on default. If the lender takes only a lien and the assets never move, the arrangement is clean and the client’s position remains close to the OES base case. If the lender takes possession, or takes the right to reuse the collateral to fund its own book, the client becomes an unsecured creditor of the lender for the excess, and the segregated vault no longer isolates risk as intended.

Rehypothecation is standard practice in prime brokerage. Financing spreads are thin, and the economics of a lending book generally depend on the collateral being productive. When a settlement network offers loans at rates competitive with exchange margin, funding must originate from either a well-capitalised balance sheet accepting a thin spread, or collateral reuse. The historical contrast is clear: hedge fund clients of Lehman Brothers International (Europe) whose assets had been rehypothecated ranked as unsecured creditors in administration, and recoveries took years. Clients whose assets remained segregated experienced a different outcome.

The counterargument is that regulated custodial entities face structural constraints against reuse. A trust bank holding assets in a fiduciary capacity, or a UK-regulated custodian operating under client asset rules, generally cannot treat custodied property as its own funding. That constraint protects the assets held by the regulated entity, but financing is frequently extended by an affiliate outside the trust perimeter. FalconX providing leverage against collateral in a Copper vault, or Hidden Road providing prime services against collateral in a Zodia vault, involves at least three legal entities and at least two sets of documentation. Whether the credit provider’s claim reaches inside the custodial ring-fence, and on what conditions, is entity-level detail that none of the retrieved sources address. We flag this as unresolved rather than resolved unfavourably.

OES also does not reduce market risk. A client at 250x remains at 250x regardless of custody arrangement. In a fast liquidation cascade, the venue’s engine closes positions and the custodian releases collateral against the venue’s instruction. The path of the cascade, the slippage, and the auto-deleveraging behave as they would with pre-funded margin. The custody structure changes the resolution procedure, not the market event. Presenting collateral protection and high leverage as complementary features of one product describes the mechanics accurately while conflating two separate risks.

A clearing layer without a clearinghouse

If a handful of providers sit as common collateral infrastructure across venues that otherwise compete and share no risk, the market has developed a clearing layer without establishing a clearinghouse.

A central counterparty concentrates risk deliberately and balances it through structural mechanisms: membership standards, initial margin models, a mutualised default fund, a defined loss waterfall, and a resolution regime. Concentration enables multilateral netting and orderly default management. Nothing in the retrieved documentation for ClearLoop, Interchange, or BitGo describes a default fund, a loss-sharing waterfall, or member loss mutualisation. These networks appear to operate as bilateral collateral arrangements sharing a common operator. That combination carries the systemic footprint of a CCP without its loss-absorbing machinery, an inference drawn from the absence of disclosure. Public detail on insurance coverage, capital buffers, and guarantee arrangements at all three providers was unavailable in retrieved sources.

Consolidation into regulated entities offers clear advantages. A market where institutional collateral concentrates in a UK-regulated custodian whose shareholders include Standard Chartered, or in an entity approved to become a federally chartered national trust bank, faces stricter supervision than one where collateral is scattered across offshore venues lacking an examination regime. Capital requirements, segregation rules, and periodic examination address structural vulnerabilities evident in 2022. Concentration into supervised entities converts diffuse, unobservable risk into concentrated, observable risk.

That argument does not resolve correlation risk. A venue integrated with several OES networks depends on all of them for the portion of its margin book each carries. A fund using one custodian across eight venues makes that custodian a single point of failure for its trading operation, contradicting standard diversification practices. Because no public data exists on institutional volume flowing through these providers, the chokepoint hypothesis cannot currently be tested empirically; it remains a structural condition awaiting disclosure.

Diligence requirements for counterparties

The questions that follow from this analysis are concrete and largely unanswered by vendor material:

• Which legal instrument governs the mirrored balance at each venue, and where does the venue’s claim rank in that venue’s insolvency?
• What events trigger the custodian’s unilateral right to unlock allocated collateral without venue consent, and how long does establishing such an event take?
• Under what conditions must the custodian execute a venue’s transfer instruction, and what verification, if any, does the custodian perform before acting?
• Can the same collateral back entitlements at more than one venue simultaneously, and if so, which party absorbs the shortfall when two venues instruct at once?
• Which legal entity extends credit under any financing product, does it sit inside or outside the custodial ring-fence, and does its documentation permit reuse of client collateral?
• What insurance or capital stands behind the custodian’s own operational failure, as distinct from its insolvency?

These questions were standard for tri-party repo and prime brokerage arrangements before crypto markets formed, with answers detailed in documentation rather than marketing copy. Crypto implementations currently rely on mechanism terms such as mirrored balances that lack settled legal definitions.

The central condition to monitor is settlement cadence relative to leverage. Daily settlement was calibrated for spot and modestly levered derivatives collateral. As venues push mirrored collateral into products offering triple-digit leverage, and as networks extend credit against the same pool, the unsettled window becomes the binding exposure rather than a minor friction. If cadence tightens toward intraday or continuous settlement as leverage grows, the architecture holds. If leverage and lending expand while cadence remains daily, residual credit risk will widen through counterparties outside the client’s direct selection.

References

• ClearLoop: Collateral Mobility Network, Copper
• BitMEX Integrates Zodia Custody’s Interchange for Off-Venue Settlement, 20 April 2026
• Digital Asset Prime Brokerage Services, BitGo