Omnibus account

Nothing on the blockchain marks your coins as yours; the platform's internal ledger does, and its terms make that ledger the definitive record. Bitstamp's trust appendix works the arithmetic through: hold GBP 100 inside a GBP 1,000 pool and you own one tenth of it. That fraction is also how losses reach you, because a shortfall anywhere in the pool lands on every account in it.

How it works

An omnibus account splits apart two records that most people assume are one: what the chain shows, and what you own. The chain shows coins sitting at addresses the platform controls. What you own is a row in a database saying how much of that pile is allocated to your account number, and the contract you accepted at signup decides what the row is worth.

Bitstamp Europe S.A. calls the crypto side an "omnibus wallet(s) in the name of Bitstamp", and Bitstamp Global Ltd says your assets "will be held in omnibus accounts held by us with sub-custodians". Three clauses in the Global Ltd trust appendix spell out what joining such a pool does to your rights.

• Your entitlement is a share, not a coin. Your interest may be "a proportional share in a pool of fungible intangible property" rather than "rights to or interests in specific underlying, individually identifiable Virtual Assets", and those rights "may be contractual rather than proprietary in nature".
• The operator's books size that share. Its internal ledgers "shall be deemed to be accurate, complete and binding on you and us, except in the case of manifest error".
• You cannot pick your corner of the pool. You have no right to require that your assets sit with any particular sub-custodian, and no right to require that your cash sits with any particular bank, because each currency trust is treated as a single pool.

Bitstamp's trust appendix then does the arithmetic in its own words. If it holds GBP 1,000 in the pooled currency trust, with GBP 100 of that held for you and GBP 900 for other members, you are entitled to a pro rata share of one tenth of the property in that trust. The second illustration in the same document is the one that stings: suppose the cash sits at three banks, A, B and C, and bank A fails with everything there lost, then every member of the trust shares pro rata in the reduced pool remaining at B and C. Being the customer whose deposit happened to be routed to B saves you nothing, because there is one pool and one fraction. Diversification inside an omnibus structure is the operator's diversification, not yours.

Why this matters when you buy bitcoin

Pooling is the default wherever a platform keeps your coins after the purchase, so the useful question is rarely whether an exchange pools, but what happened when its pool came up short. Of the 63 exchange records on this site, nine carry a dated security record, and those are the ones where that question has an answer written down rather than guessed at. The default is not universal: Relai's record here describes a Swiss app whose purchases settle by default to a wallet whose keys live on your phone rather than on Relai's servers, which leaves no pool to share.

Bitstamp is the case worth reading, because its contract and its history point in opposite directions. The terms say a shortfall is shared: Bitstamp Global Ltd asks you to accept that if only part of the holding can be retrieved, you "share the loss proportionately to your share in the Virtual Assets held in the omnibus account", and that if a sub-custodian fails "you may have only an unsecured claim against" it. What the site's Bitstamp review records about the one occasion the pool actually emptied is not that.

Two practical points follow. Leaving the pool means withdrawing, and a withdrawal is not always available on demand: Bitstamp Europe S.A. reserves up to fourteen days from the initiation of an Instant Purchase before those coins can be taken out, which is a fortnight of pool membership nobody plans for. And withdrawing only removes the fraction if the destination is a key you hold, which is worth checking against the 41 wallet reviews here: the Wallet of Satoshi record says the app is custodial, so a balance moved there is a claim on Living Room of Satoshi Pty Ltd rather than coins you control.

The 18,866 BTC Bitstamp absorbed

Bitstamp's January 2015 hot wallet theft is the clearest test of what a shortfall clause means in practice, and the outcome was not the one such a clause describes. The exchange review on this site records the sequence: attackers phished six employees over several weeks in late 2014, took a wallet file from one server and its passphrase from another, and on 4 January 2015 drained 18,866 BTC from the hot wallet, worth 5,263,614 dollars at the clearing price of 279 dollars per bitcoin.

The shortfall clause quoted above is the current one, and read literally it hands every customer holding a bitcoin balance a proportional haircut the moment the pool is short. January 2015 went the other way. Bitstamp suspended the service, rebuilt the platform on new hardware, reopened on 9 January 2015 with multisignature wallets in place, and honoured every balance in full. The company absorbed the loss.

Holding both facts at once is the point of this page. The contract sets the floor, which is a fraction of whatever survives. A company's balance sheet, its insurance and its appetite for reputational damage set what actually happens, and none of those three is a promise you can enforce. Where an operator has never been tested, the floor is all you have.

Omnibus account vs custodial wallet

An omnibus account and a custodial wallet describe different halves of one relationship. A custodial wallet is the thing you hold, an account balance at a firm that controls the keys. An omnibus account is how that firm stores the coins standing behind every such balance, which is a handful of large wallets in its own name rather than one wallet per customer.

The distinction turns practical at deposit addresses. Most exchanges hand each customer a unique bitcoin address, and it is easy to read that as a compartment of your own. It is a routing label. Coins sent there get swept into the shared wallet, and after the sweep the address proves where a deposit entered and nothing about where the balance now sits. Segregation you could verify would mean an address you can open in a block explorer holding your balance and no one else's, which an omnibus structure by definition never produces.

Omnibus account vs proof of reserves

Proof of reserves is a consequence of omnibus accounting rather than an alternative to it. Pooling is exactly why you cannot check your own holdings on a block explorer, and a Merkle proof is the workaround: the operator publishes a total for the pool, and you verify that your balance was counted inside that total.

What the technique cannot reach is everything the terms say about your slice. A proof attests to what the pool held at one instant. It stays silent on whether your entitlement is proprietary or merely contractual, on whose ledger governs when two numbers disagree, and on how a shortfall gets divided once there is one. Bitstamp shows the gap from both ends: our review records a one-off send to self in May 2014 that proved control of 183,497 BTC and was never repeated on a schedule, and a November 2022 post describing a proof of reserves audit as an aim rather than an existing practice, with no way for an individual customer to check their own inclusion.