Crypto Custody and Regulatory Shifts: Navigating the SEC's New Guidance Amid Rising Scams

The collapse of HyperFund, a $1.7 billion cryptocurrency Ponzi scheme orchestrated by Xue Samuel Lee and promoted by Brenda Chunga, has become a watershed moment for U.S. crypto regulation. As the SEC and DOJ dismantled the fraudulent operation, which promised unrealistic returns on non-existent mining ventures, the agency faced mounting pressure to address systemic gaps in crypto custody frameworks. In response, the SEC issued a landmark no-action letter on September 30, 2025, permitting registered investment advisers (RIAs) and investment companies to use state trust companies (STCs) as custodians for crypto assets, provided they meet stringent conditions. This shift marks a pivotal evolution in regulatory credibility and risk mitigation for crypto investors, particularly in a post-HyperFund landscape where scams have eroded trust.

The SEC's 2025 Guidance: A New Framework for Custody

The SEC's no-action letter clarifies that STCs-authorized by state banking authorities-can now be treated as "banks" under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. To qualify, STCs must implement robust cybersecurity protocols, segregate client assets via written agreements, and maintain audited financial statements. These requirements aim to address long-standing uncertainties about the role of state-chartered entities in crypto custody, which previously left investors vulnerable to misappropriation and fraud.

Critically, the guidance mandates that RIAs and registered funds disclose material risks to clients and ensure that using STCs aligns with fiduciary duties. This emphasis on transparency reflects the SEC's broader strategy to balance innovation with investor protection. For instance, the no-action relief explicitly prohibits STCs from lending or pledging client assets without consent, a safeguard designed to prevent the kind of asset misuse that characterized HyperFund.

However, the decision has sparked debate within the SEC. Commissioner Hester Peirce praised the move for providing much-needed clarity, while Commissioner Caroline Crenshaw warned it risks eroding federal custody protections by deferring to state-level oversight. This tension underscores the agency's struggle to reconcile regulatory flexibility with the need for centralized safeguards in a rapidly evolving market.

Mitigating Scams: From HyperFund to Systemic Reforms

The HyperFund scandal, which exploited gaps in crypto custody and investor due diligence, has galvanized the SEC to adopt a more proactive stance. According to a report by NASAA, digital asset and social media scams surged in 2025, with fraudsters leveraging decentralized finance (DeFi) platforms and unregulated custodians to siphon funds. The SEC's new custody rules directly address these vulnerabilities by tightening controls over private key management and requiring third-party audits for STCs.

Moreover, the agency has expanded enforcement priorities under "Project Crypto", a framework that applies the Howey test to determine whether tokens qualify as securities. This approach has led to high-profile settlements with platforms like Gemini Trust Co. and Voyager Digital's former CEO, signaling a zero-tolerance stance toward fraudulent practices as seen in the HyperFund case. The SEC's collaboration with FinCEN and the DOJ has also strengthened cross-agency efforts to track illicit flows, as seen in the coordinated takedown of HyperFund's operators.

Investor Trust and Regulatory Credibility: A Post-2025 Assessment

The effectiveness of the SEC's 2025 guidance in restoring investor trust hinges on its ability to reduce regulatory arbitrage and enforce consistent standards. Pre-2025, crypto hedge funds often operated under exemptions like the private fund adviser rule, which allowed them to bypass custody requirements if they managed less than $150 million in assets as evidenced by HyperFund's ability to attract over 100,000 global investors through social media campaigns.

Post-2025, the SEC's no-action letter has fostered a more unified custody framework. By mandating segregation of client assets and requiring STCs to undergo annual audits, the agency has created a baseline for institutional-grade security. Additionally, the rescission of restrictive accounting practices under SAB 122 has encouraged more financial institutions to enter the crypto custody space, increasing competition and reducing reliance on unregulated custodians.

Investor trust metrics, however, remain mixed. While the SEC's emphasis on transparency and enforcement has bolstered confidence among institutional investors, retail participants remain wary of regulatory inconsistencies. For example, the lack of a centralized stablecoin framework under the GENIUS Act has left some stablecoins exposed to liquidity risks, undermining their perceived safety. Nonetheless, the SEC's shift toward proactive guidance-such as its no-action relief for DePIN token distributions-demonstrates a commitment to fostering innovation without compromising investor protections as reported by regulatory trackers.

Comparative Analysis: Pre-2025 vs. Post-2025 Frameworks

A comparative analysis of pre- and post-2025 custody frameworks reveals significant strides in regulatory credibility. Before 2025, the SEC's reliance on enforcement actions over clear rules created ambiguity, enabling scams like HyperFund to thrive. The 2025 guidance, by contrast, provides a structured approach to custody, aligning with global trends toward harmonized crypto regulations as noted in regulatory analysis.

Key improvements include:
1. Standardized Safeguards: STCs must now adhere to cybersecurity and private key management protocols, reducing the risk of hacks and unauthorized access according to recent updates.
2. Enhanced Disclosure Requirements: RIAs are mandated to inform clients about the risks of using STCs, ensuring informed decision-making as detailed in agency publications.
3. Cross-Agency Collaboration: The SEC's partnership with FinCEN and the DOJ has improved scam detection and enforcement, as seen in the HyperFund case.

Despite these advancements, challenges persist. The decentralized nature of crypto custody means that regulatory arbitrage remains possible, particularly in jurisdictions with lax oversight. Additionally, the SEC's reliance on no-action letters-rather than formal rulemaking-has drawn criticism for bypassing democratic processes as observed in global commentary.

Conclusion: A Path Forward for Crypto Investors

The SEC's 2025 custody guidance represents a critical step in mitigating crypto scams and rebuilding investor trust post-HyperFund. By clarifying the role of STCs and enforcing robust risk management frameworks, the agency has created a more secure environment for institutional and retail investors alike. However, the effectiveness of these measures will depend on consistent enforcement and the development of complementary legislation, such as the GENIUS Act, to address systemic risks in stablecoins and cross-border transactions as recommended by legal experts.

For investors, the key takeaway is to prioritize custodians that meet the SEC's 2025 standards, including segregation of assets and third-party audits. While regulatory shifts have improved the landscape, due diligence remains essential in a sector still prone to innovation-driven risks. As the SEC continues to refine its approach, the post-HyperFund era may yet prove to be a turning point in the maturation of crypto markets.