Who really holds your crypto? Custody, keys and wallets explained
With crypto, whoever controls the private key controls the asset. Custody is the question of who holds that key, and the answer decides what you can lose, and to whom.
Education only, not investment, tax or legal advice. Crypto-assets are high-risk — risk disclosure.
The short answer
Crypto custody means how and where your crypto is stored and who controls the private key that authorises transfers. You can hold the key yourself (self-custody) or let a custodian hold it, which trades the risk of losing your key for the risk of that firm failing.
Key takeaways
- Crypto-assets are records on a blockchain; a private key is what lets someone move them, and losing it means losing access permanently.
- Hot wallets are connected to the internet and convenient; cold wallets are offline and safer from hackers but can be lost or damaged.
- With a third-party custodian, a hack, shutdown or bankruptcy can cut you off from your assets.
- Bank deposit insurance does not cover crypto, and SIPC does not cover crypto that is not a security.
What does custody mean for crypto?
In traditional finance, a custodian is a firm that safekeeps assets for someone else, such as a bank holding shares for a pension fund. For crypto, the SEC's investor education office describes custody as how and where you store and access your crypto-assets1.
The coins or tokens themselves are entries on a blockchain. What you actually store is a set of keys. A private key is a randomly generated code that lets you authorise transactions1; it must stay secret, while the matching public key can be shared safely2. An address is a short string derived from the public key, which others use to send you assets2. A wallet is the software or device that stores these keys and addresses2.
Figure · How a private key controls an asset
- 01Private keykept secret in a wallet
- 02Authorise transferkey approves the transaction
- 03Network checksvalid authorisation?
- 04Ledger updatedasset now at new address
Custody vocabulary in plain English
| Term | What it is | Share it? |
|---|---|---|
| Private key | Secret code that authorises transactions1 | Never |
| Seed phrase | A sequence of words that can restore a wallet or key1 | Never |
| Public key / address | Identifier others use to send you assets2 | Yes |
| Wallet | Software or device that stores keys and addresses2 | The device, no; the address, yes |
The technical side is covered in our explainer on crypto wallets and keys.
Should you hold your own keys or use a custodian?
There are two broad models1. With self-custody, you control and manage your private keys yourself and carry full responsibility for them. With third-party custody, a platform or professional custodian manages the keys for you, and you log in to an account to give instructions.
Self-custody versus third-party custody Source: [1]
| Self-custody | Third-party custody | |
|---|---|---|
| Who holds the private key | You | The custodian or platform |
| Main risk | You lose, damage or expose your key or seed phrase | The custodian is hacked, shuts down or goes bankrupt |
| If something goes wrong | Access may be lost permanently | You may lose access to your assets |
| Day-to-day effort | You manage backups and security | Similar to an online account |
Neither model removes risk. It moves the risk from your own habits to a firm's honesty, security and solvency. NIST notes that if a private key is lost, any asset tied to it is lost because the key cannot be regenerated, and if it is stolen, the thief gains full control of those assets2.
What is the difference between a hot wallet and a cold wallet?
A hot wallet is connected to the internet. It is convenient for frequent use but exposes your assets to online threats1. A cold wallet is typically a physical device kept offline. It is generally more secure from cyberattacks, but it can be lost, damaged or stolen1.
Figure · Hot wallet versus cold wallet
Hot wallet
- Connected to the internet
- Quick to use for payments and trades
- Exposed to hacking and malware
Cold wallet
- Usually an offline physical device
- Better shielded from online attacks
- Can be lost, damaged or stolen
The choice is not all-or-nothing. You can split holdings, keeping a small hot-wallet balance for spending and a larger amount in cold storage that you rarely touch.
What happens to your crypto if a platform fails?
This is where custody matters most. The SEC warns that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto-assets1. In a 2023 alert it added that some crypto firms had entered bankruptcy and that it was unclear how much, if anything, customers might recover6. It also flagged the conflicts that arise when one firm combines the roles of exchange, broker and custodian6.
Two practices increase the danger. Commingling means pooling customers' assets together instead of holding each customer's assets separately; rehypothecation means a custodian using deposited assets as collateral1. In its December 2022 case against FTX's founder, the SEC alleged that FTX customers' funds were diverted without disclosure to his privately held crypto hedge fund, Alameda Research, and used for venture investments, real estate and political donations5. Those are the regulator's allegations.
Some regulators have spelled out what they expect. New York's Department of Financial Services expects licensed custodians to keep customer crypto segregated from company assets, to preserve the customer's beneficial interest, and not to use customer assets for their own purposes unless the customer instructs it, under guidance updated on 30 September 20253. In the US banking system, the Office of the Comptroller of the Currency said in July 2020 that holding crypto keys for customers is a modern form of traditional bank custody4.
Risk warning
No deposit insurance for crypto
FDIC deposit insurance does not cover crypto assets8, and SIPC does not protect any digital asset that does not qualify as a security7. If a platform holding your coins fails, there may be no compensation scheme to fall back on. Only keep on a platform what you could afford to lose, and read our risk disclosure.
How can you check a crypto custodian?
Questions the SEC suggests asking
- 1
Who is this firm?
Research the custodian's background, and check any licence claims with the regulator's own register1.
- 2
What happens if it fails?
Ask how your assets would be treated in a bankruptcy and whether they are held separately from the firm's own1.
- 3
How does it store and use your assets?
Ask where and how keys are kept, and whether the firm lends, pledges or commingles customer assets1.
- 4
What does it cost?
Look for account, transaction, transfer and closure fees1.
Our guide on how to check a regulated firm walks through using official registers. If you hold crypto through a fund or exchange-traded product instead, the custody arrangements are set out in its documents; see our explainer on spot bitcoin ETFs and the comparison of stocks, bonds and crypto.
What custody mistakes do beginners make?
Common beginner mistakes
Sharing a seed phrase
No genuine support team needs it. The SEC's advice is never to share private keys or seed phrases1.
Falling for phishing
Fake wallet apps, look-alike websites and urgent messages are designed to capture keys. The SEC specifically warns about crypto phishing scams1.
Keeping the only backup in one place
A single paper copy can burn or flood, and a single device can fail. Plan for loss as well as theft.
Assuming a platform balance is yours by law
What you see is the firm's record of what it owes you. After some crypto bankruptcies, the SEC noted it was unclear how much customers could recover6.
Leaving everything on a trading platform
Convenience is real, but so is concentration risk when one firm holds the keys to all of it.
Frequently asked questions
What does 'not your keys, not your coins' mean?
It is a crypto saying meaning that if someone else holds the private key, you depend on them to honour your claim. With self-custody you control the key; with a custodian you rely on the firm staying secure and solvent1.
Can I recover crypto if I lose my private key?
Is a hardware wallet completely safe?
No. It keeps keys offline, which helps against online attacks, but the device can be lost, damaged or stolen1, and a seed phrase written down carelessly can be found by someone else.
Can banks hold crypto for customers in the US?
Yes. The OCC concluded in July 2020 that national banks and federal savings associations may provide crypto custody services, including holding cryptographic keys4.
The bottom line
Custody is about one thing: who holds the private key. Holding it yourself puts all the responsibility on you; handing it to a custodian makes you depend on that firm's security, honesty and solvency, usually without deposit insurance. Learn the vocabulary, understand hot and cold storage, ask any custodian how it stores and uses your assets, and never share a seed phrase.
Sources
- Crypto Asset Custody Basics for Retail Investors: Investor Bulletin — Investor.gov, U.S. Securities and Exchange Commission, 2025 Primary source
- Blockchain Technology Overview (NIST IR 8202) — National Institute of Standards and Technology, 2018 Primary source
- Updated Guidance Regarding Custodial Structures for Customer Protection in the Event of Insolvency — New York State Department of Financial Services, 2025 Primary source
- Federally Chartered Banks and Thrifts May Provide Custody Services For Crypto Assets (News Release 2020-98) — Office of the Comptroller of the Currency, 2020 Primary source
- SEC Charges Samuel Bankman-Fried with Defrauding Investors in Crypto Asset Trading Platform FTX (Press Release 2022-219) — U.S. Securities and Exchange Commission, 2022 Primary source
- Exercise Caution with Crypto Asset Securities: Investor Alert — Investor.gov, U.S. Securities and Exchange Commission, 2023 Primary source
- What SIPC Protects — Securities Investor Protection Corporation Primary source
- Understanding Deposit Insurance — Federal Deposit Insurance Corporation Primary source
How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.
Read next
Tech · ExplainerHow do crypto wallets and private keys work, and what happens if you lose them?A crypto wallet does not hold coins. It holds the secret that proves you control them. Understanding that one idea explains almost every way people keep, and lose, crypto.
Policy · ExplainerHow do you check whether a financial or crypto firm is regulated?A licence number in a website footer proves nothing until you check it yourself. Official registers are free, public and take a few minutes. Here is which one to use and what to look for.
Finance · ExplainerStocks, bonds and crypto: what do you own, and what can go wrong?A share, a bond and a crypto token can all sit side by side in one app, but they are very different things. One is a slice of a company, one is a loan, and one is a digital asset whose price rests on demand alone.
Markets · ExplainerWhat is a spot bitcoin ETF, and what did the SEC approve in January 2024?A spot bitcoin exchange-traded product lets you buy shares through an ordinary brokerage account while a trust holds the bitcoin. Here is what that structure gives you, and what it does not.
Finance · ExplainerWhat is a stablecoin, and how does it stay at one dollar?Stablecoins are crypto tokens built to stay boring: one token, one dollar. Whether they manage it depends on what backs them, who can redeem them and what the law requires.
Markets · ExplainerHow do crypto markets work, and who decides the price?There is no single crypto exchange and no official closing price. Here is how many separate venues, two kinds of trading machinery and a patchwork of rules add up to the number on a price ticker.