Custodial vs self-custody wallets: who holds the keys?

What does custody mean for a crypto wallet?#

People say their bitcoin is "in" a wallet. Technically, a wallet stores keys. The SEC describes a private key as a randomly generated passcode that lets you authorise transactions ^[1]. The Bitcoin whitepaper defines a coin as a chain of digital signatures, where each owner signs the transfer to the next owner ^[2]. Whoever can produce that signature controls the coin.

So custody comes down to one question: who holds the private keys? With third-party custody, you choose a professional custodian or service provider to hold your crypto for you ^[1]. An account on a crypto exchange where the company keeps the coins is the typical example. With self-custody, you control the assets and you are responsible for managing the private keys yourself ^[1]. "Custodial" and "non-custodial" are other names for the same split.

How do custodial and self-custody wallets compare?#

The table below puts the two set-ups side by side. Read the "main risk" row twice: neither column is empty.

Sources: SEC custody bulletin ^[1], Bitcoin whitepaper on irreversibility ^[2], FTC Celsius settlement on bankruptcy proceedings ^[3].

What can go wrong when a company holds your keys?#

The SEC lists the risk plainly: if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto ^[1]. It adds two practices to ask about. Some custodians use deposited crypto as collateral for their own purposes, such as lending, and some commingle customer assets instead of holding them separately for each customer ^[1].

The safety net you may expect from a bank is usually missing. The SEC says accounts with crypto asset entities do not get the SIPC and FDIC protections that registered broker-dealer and bank accounts generally have, and that customers might stop having legal ownership of deposited assets and might not get them back ^[4]. In the UK, the FSCS says it cannot protect you if a platform that exchanges or holds crypto goes out of business ^[5].

Two collapses show the pattern. At FTX, the SEC alleged an undisclosed diversion of customers' funds to Alameda Research, a trading firm, while the exchange was promoted as having automated risk measures to protect customer assets ^[6]. The US Department of Justice later said its founder stole over $8 billion of customers' money; he was sentenced to 25 years in prison ^[7].

Celsius filed for bankruptcy in July 2022. The FTC says it took title to and misappropriated customer deposits of more than $4 billion, after telling customers they could withdraw at any time and that it had a $750 million insurance policy for deposits ^[3]. Our page on FTX collapse explained goes through these cases in more detail.

What can go wrong when you hold the keys yourself?#

Self-custody removes the company risk and hands all of it to you. The SEC warns that if your wallets are lost, stolen, damaged or hacked, you may permanently lose access to your crypto ^[1]. There is no help desk behind a wallet you control.

There is also no one to reverse a transfer. Bitcoin was designed so payments go directly between parties without a financial institution, and so that transactions are computationally impractical to reverse ^[2]. If you send coins to the wrong address, or a thief signs a transfer with your keys, the transfer stands.

Scammers know this. In 2025 the FBI described fake "free token" offers sent to non-custodial wallet users: the link leads to a site that asks for the seed phrase, which then lets the criminal empty the wallet ^[8]. Our guide to seed phrase vs private key explains what those words unlock and how to protect them.

Where do hot and cold wallets fit in?#

Hot and cold describe a different thing: whether the wallet is connected to the internet. The SEC says hot wallets are convenient for transactions but expose your crypto to cyberthreats, while cold wallets, typically offline physical devices, are generally more secure from cyberthreats ^[1].

The two labels combine. A wallet app on your phone that holds your own keys is self-custody and hot. A hardware device kept in a drawer is self-custody and cold, which protects it from online attackers but not from being lost or damaged. Custodial accounts are reached through the provider's website or app, and how the provider stores the keys behind that account is its own decision.

How do you decide which set-up to use?#

1. Decide how much you would hold at all

   Use only money you can afford to lose. The UK FCA tells consumers to be prepared to lose all their money in crypto, including through firm failure and cyberattacks ^[9].

2. Check a provider before you deposit

   In the EU, check the ESMA register: clients of providers not authorised under MiCA do not get its client-asset protections ^[10]. In the UK, the FCA says crypto firms must be registered or have permission to promote ^[11]. Our guide is a crypto exchange safe walks through the checks.

3. Ask what the provider may do with your coins

   Look in the terms for lending, use as collateral or commingling. The SEC says some custodians do these things ^[1].

4. If you self-custody, plan the backup first

   Write down the seed phrase when the wallet is created, store it in a secure place and do not share it with anyone ^[1].

5. Lock down the logins either way

   Use strong passwords and multi-factor authentication on every crypto account ^[1]. See 2FA for crypto accounts for which methods resist phishing.

Mistakes beginners make with crypto custody#

• Treating an exchange balance like a bank deposit

  In the US there is no SIPC or FDIC protection for accounts at crypto asset entities ^[4], and in the UK the FSCS cannot step in if a crypto platform fails ^[5].

• Choosing a platform for its yield

  Celsius advertised up to 18% APY and said it was safer than banks, then filed for bankruptcy in July 2022 ^[3]. Ask how a platform pays that yield: the SEC notes some custodians lend out deposited crypto ^[1].

• Assuming self-custody means safe

  Without a working backup, a broken or lost device can mean permanent loss ^[1].

• Typing a seed phrase into a website

  The FBI has warned of fake reward links that ask for the seed phrase and then drain the wallet ^[8]. Treat any site or message that asks for it as a warning sign.

• Telling people what you hold

  The SEC advises not sharing the amount or types of crypto you own with anyone ^[1]. A known balance makes you a target.

Frequently asked questions#

The bottom line#

Custody is a choice between two kinds of failure: a company that can be hacked, go bust or misuse deposits, or your own backup that can be lost, stolen or phished. Neither comes with the deposit protection you may expect from a bank. Decide how much to hold, check any provider on its regulator's register, keep your seed phrase offline and private, and read the risk disclosure before putting money into crypto.

Education only. This page is not investment, tax or legal advice. Trading and crypto can lose you money. See our risk disclosure.