Crypto Wallets and Custody: Who Holds the Keys?

In crypto, the question isn’t where your coins are. It’s who holds the keys that move them. Every storage choice is a trade-off between convenience and control.

What to know

1. With a custodial account, a company holds the keys; with self-custody, you do.
2. A seed phrase gives full control of a wallet to anyone who sees it, so never type it into a website or share it.
3. Hardware wallets keep keys offline but must be bought from the manufacturer and backed up properly.
4. App-based two-factor authentication and an email address used only for crypto stop many account takeovers.

Crypto is controlled by private keys. Every storage option is really an answer to one question: who holds them?

Custodial vs. self-custody

	Custodial (exchange or app)	Self-custody (your own wallet)
Who holds the keys	The company	You
Forgot your password	Account recovery through the company	Only your seed phrase can restore access
Company fails or freezes withdrawals	Your funds can be stuck	Not affected
Main risks	Platform failure, hacks, account takeovers	Lost or stolen seed phrase, sending to the wrong address

Hot and cold

• Hot wallets are apps on your phone or computer, connected to the internet. Convenient for small, frequent use.
• Cold storage keeps keys offline, usually on a hardware wallet. Better for larger amounts you rarely move.

Red flag

Buy a hardware wallet only from the manufacturer or an authorized seller, never secondhand. Tampered devices and fake “pre-configured” wallets that come with a seed phrase already written down are a known way to steal funds.

Protecting a seed phrase

1. Write it down on paper or stamp it in metal, never in a photo, email or cloud document.
2. Store it somewhere secure, protected from fire, water and curious visitors.
3. Never enter it on a website or into a form, even one that claims to “validate” or “sync” your wallet.
4. Think about who would find it if something happened to you; see planning for crypto in your estate.

Securing exchange accounts

• Use app-based or hardware-key two-factor authentication; SMS codes are vulnerable to SIM-swap attacks.
• Use a unique password and an email address you don’t use elsewhere.
• Turn on withdrawal address allowlists if the platform offers them.
• Ask your mobile carrier about a port-out or SIM lock to make SIM swaps harder.

Whichever route you choose, remember that a custodial platform’s promises are only as good as the platform; see what happens when exchanges fail.

Common questions

What happens if my hardware wallet breaks?

You can restore your funds on a new device using your seed phrase. Without the seed phrase, the funds are gone, which is why the backup matters more than the device.

Should I store my seed phrase in a password manager or cloud drive?

Most security guidance says to keep it offline, written on paper or stamped in metal, stored somewhere safe from fire and theft. Anything connected to the internet can be hacked.

Will support ever ask for my seed phrase?

No legitimate exchange, wallet maker or support agent will ever ask for it. Anyone who does is trying to steal your crypto.