Custodial vs non-custodial wallets: who really holds your crypto?

What does “custody” mean in crypto?#

A crypto wallet is, at its core, a collection of private keys — secret numbers that prove you are allowed to spend the coins linked to an address ^[2]. An account is a pair of keys: a public key used to create the address you share, and a private key you keep secret because it is used to sign transactions ^[3]. If you are new to these terms, start with public keys, private keys and addresses.

Custody is the question of who holds those private keys. If an exchange or app holds them for you, the arrangement is custodial. If you hold them yourself, it is non-custodial, usually called self-custody. Both terms describe the same thing; you will see them used interchangeably.

Two ways to hold crypto

How does a custodial account work?#

When you buy crypto on a centralised exchange, the exchange links your account to a username and password that can be recovered in a traditional way — but you are trusting that exchange with custody of your funds, and if it has financial trouble your funds are at risk ^[3]. The balance you see on screen is the company’s record of what it owes you, not coins under your own keys. NIST, the US standards agency, noted in 2018 that instead of storing keys themselves, users may turn to an emerging industry of private key escrow services, which can also satisfy know-your-customer (KYC) laws because users must prove their identity when creating an account ^[4].

Bitcoin.org calls this counterparty risk: when you leave coins with a custodian, its security, solvency and policies stand between you and your money ^[1]. The SEC’s investor education office warns that people who deposit crypto with a platform might cease to have legal ownership of those assets, that some platforms have suspended withdrawals, and that some have entered bankruptcy with unclear recovery for customers ^[5].

Crypto accounts are also not backed by a government. The US Federal Trade Commission notes that crypto held in accounts is not insured the way dollars in an FDIC-insured bank are, so if the company storing your crypto goes out of business or is hacked, the government has no obligation to help you get it back ^[6]. In the EU, financial supervisors add that several exchanges and wallet providers have suffered cyber-attacks and severe operational problems ^[7].

What protection applies to crypto held with an EU platform?#

In 2022, EU financial supervisors warned consumers of a lack of recourse or protection, because crypto-assets and related services typically fell outside existing EU financial services rules ^[7]. Since then the EU’s Markets in Crypto-Assets Regulation (MiCA) entered into force in June 2023 and has applied in full since December 2024 ^[8]. It sets uniform EU market rules for crypto-assets ^[8]. Its provisions cover transparency, disclosure, authorisation and supervision ^[8], and it lays down specific rules for firms that provide crypto-asset services, including custody and administration of crypto-assets on behalf of clients ^[9].

The practical step for a beginner is checking authorisation. ESMA, the EU’s markets supervisor, publishes a register of authorised crypto-asset service providers, together with a list of non-compliant entities ^[8]. MiCA let member states allow firms already operating under national law before 30 December 2024 to continue until 1 July 2026, or until their MiCA authorisation was granted or refused ^[8]. ESMA noted that the mix of regimes during this transition may result in different levels of protection for consumers ^[8].

How does self-custody work?#

In self-custody, a wallet app or device generates your keys. The wallet provider does not hold your funds; it gives you a window to see your assets and tools to manage them, and you can switch to a different wallet app at any time ^[3]. When you create the wallet, it usually shows a recovery phrase (also called a seed phrase) that you must write down — it is the only way to recover the wallet ^[3]. Our guide to seed phrases explains how those words become keys.

The flip side is that there is no undo button. If you permanently lose access — for example by losing the recovery phrase — nobody, including developers, miners, wallet providers or exchanges, can recover the funds from a self-custodied wallet ^[1]. Theft is just as final: NIST notes that whoever steals a private key gains full access to all the digital assets it controls ^[4]. The threats also move to your own devices: a wallet that keeps keys on an internet-connected phone or computer is exposed if that device is compromised ^[10], which is why some people keep savings on a hardware wallet or other offline setup.

Which risks does each choice carry?#

Neither column is risk-free. Choosing one is choosing which risks you would rather manage.

What does a split look like in practice?#

Bitcoin.org suggests treating a phone or computer wallet like cash in your pocket: keep only small amounts there for everyday use and the rest in a safer environment ^[11]. A worked example shows why that matters.

Set-up B adds a different duty: the savings wallet’s recovery phrase must be backed up well, because nobody can reset it. Neither set-up protects against price falls; it only changes who can lose or block your coins.

How do you secure a custodial account?#

1. Check who you are dealing with

   EU supervisors suggest asking whether the firm is reputable and whether national authorities have blacklisted it — while noting that not being blacklisted is no guarantee of safety ^[7].

2. Use a unique, strong password

   A password manager can create and store a long, unique password for each account ^[12].

3. Turn on app-based two-factor authentication

   SMS codes are open to SIM jacking; an authenticator app or a physical security key is stronger ^[12]. The FBI’s IC3 logged 982 SIM-swap complaints with $25,983,946 in losses in 2024 ^[13].

4. Bookmark the real website

   Typing or searching for the site each time makes it easier to land on a look-alike phishing page; a bookmark avoids that ^[3].

5. Never share codes or keys

   No legitimate support agent will ask for your password, two-factor codes or recovery phrase ^[12].

How do you make self-custody safe enough?#

1. Write the recovery phrase on paper

   Do not store it on a computer ^[3], and do not screenshot it — screenshots can sync to cloud storage ^[12].

2. Keep more than one copy, in more than one place

   A backup that does not depend on a single location is less likely to be lost in a single event ^[11].

3. Keep savings offline

   Offline (cold) storage gives strong protection against computer vulnerabilities when done properly ^[11]. See cold wallet.

4. Keep software up to date

   Updates deliver security fixes for the wallet and for the device it runs on ^[11].

5. Plan for your family

   If nobody knows where your wallets or backups are, the funds may never be recovered when you are gone ^[11].

Is moving coins between the two risky?#

Moving coins from an exchange to your own wallet is a normal on-chain transfer, so the usual rules apply: transactions cannot be reversed, and you should check that the receiving address exactly matches the one you intend ^[12]. A sensible habit is to copy the address from your own wallet app, then compare it character by character before confirming. If you are moving a large amount, you can send a small amount first and check that it arrives before sending the rest. Moving coins between platforms also involves network fees; see transaction fees explained.

What mistakes do beginners make here?#

• Thinking an exchange balance is the same as owning coins

  On a custodial platform your balance is a claim on the company. If it fails, you may queue with other creditors.

• Treating self-custody as automatically safer

  Self-custody removes company risk but adds backup risk. A phrase stored in a photo or an email can be stolen; a phrase you lose cannot be replaced.

• Relying on SMS codes for two-factor login

  SMS codes can be hijacked through SIM swapping. Use an authenticator app or a security key where the platform supports it.

• Keeping one copy of the recovery phrase

  Fire, water or a house move can destroy a single sheet of paper. Keep more than one copy in separate safe places.

Frequently asked questions#

The bottom line#

Custodial versus non-custodial is not a question of which is good and which is bad. It is a choice about whom you trust: a company to stay solvent, honest and secure, or yourself to keep a recovery phrase safe for years.

If you decide to hold some coins yourself, the next step is understanding the backup you are responsible for — read seed phrases explained — and the scams that target both kinds of account in common crypto scams.

Sources#