Crypto wallets and custody: who really holds your coins

Custody is about who controls the private keys that move your crypto. If an exchange or broker holds the keys, it has custody and you have a claim against it. If you hold the keys in your own wallet, you have custody and nobody else can move the coins, but nobody can rescue you if you lose the keys either. Hot wallets keep keys on internet-connected devices for convenience; cold wallets keep them offline for security. Each choice trades one risk for another.

This guide explains what wallets actually do, the difference between custodial and self-custody, what exchange failures such as FTX teach, how seed phrases work and the mistakes that most often lead to permanent losses. If you trade crypto only through CFDs, you hold no coins at all, and the custody question becomes one about your broker; we cover that too.

Risk warning: crypto assets are highly volatile and largely unregulated outside the scope of the EU's MiCA regulation. Crypto held with an exchange is generally not protected by deposit guarantee or investor compensation schemes, and lost keys or mistaken transfers usually cannot be recovered. You can lose all of the money you put in.

What a wallet really is

A blockchain is a shared ledger recording which address holds which coins. Your coins never sit inside an app or a device; they are entries on that ledger. What a wallet holds is the private key: a very large secret number that proves you control an address and lets you sign transactions moving coins from it. Anyone who has the private key can move the coins. Anyone who does not, cannot.

From the private key comes a public address, which you share with people who want to send you coins. Sharing the address is safe. Sharing the private key is the same as handing over the coins.

Most modern wallets generate keys from a seed phrase (also called a recovery phrase): usually 12 or 24 ordinary words in a set order. The seed phrase can regenerate every key in the wallet on any compatible software or device. It is the master key. If you remember one thing from this guide, make it this: whoever sees your seed phrase can take everything the wallet controls.

For the underlying mechanics of blockchains and keys, see what cryptocurrency is.

Custodial vs self-custody

Custodial: the exchange holds the keys

When you buy crypto on an exchange or app and leave it there, the platform usually controls the keys. Your account shows a balance, but on the blockchain the coins typically sit in the platform's own wallets, often pooled with other customers' coins. What you have is a promise that the platform will let you withdraw.

The advantages are real. You cannot lose a seed phrase you never had, password resets exist, and trading is fast. The risks are also real:

• Insolvency. If the platform fails, you may become an unsecured creditor waiting years for a partial return.
• Misuse of client assets. A platform may lend out or otherwise use customer coins, with or without telling customers.
• Hacks. Large pools of coins attract attackers.
• Withdrawal freezes. Platforms can pause withdrawals during stress, outages or legal action.
• Account access. A platform can freeze an account for compliance reasons, and you have to resolve it with them.

Self-custody: you hold the keys

In self-custody, you install wallet software or use a hardware device that generates your keys, and you back up the seed phrase yourself. The platform risk disappears. In its place:

• Loss. Lose the device and the seed phrase, and the coins are gone for good.
• Theft. Anyone who finds or tricks you out of the seed phrase can empty the wallet.
• Mistakes. Sending to the wrong address or the wrong network is usually irreversible.
• Malware and fake apps. Compromised devices and counterfeit wallet apps steal keys.

Neither option is free of risk. The question is which risks you can manage better, and for how much money.

Hot wallets and cold wallets

Hot wallets keep the private keys on a device connected to the internet: a phone app, a browser extension or desktop software. They are convenient for frequent transactions and for interacting with decentralised applications. They are also exposed to malware, phishing sites, malicious browser extensions and approvals you did not understand when you clicked them.

Cold wallets keep the private keys offline. The most common form is a hardware wallet, a small dedicated device that stores the keys and signs transactions internally, so the keys never touch your computer. Paper backups of seed phrases are also a form of cold storage. Cold storage is slower and less convenient, which is the point: it adds friction between an attacker and your coins.

Many people who self-custody use both: a hot wallet holding small amounts for everyday use, and a cold wallet holding the rest. That mirrors the way you might keep a little cash in your pocket and the rest in a bank.

Buying a hardware wallet safely

• Buy only from the manufacturer or an authorised reseller. Second-hand or marketplace devices can be tampered with.
• Set the device up yourself and let it generate a new seed phrase. A device that arrives with a pre-printed seed phrase is a scam.
• Download companion software only from the manufacturer's official site, typed in directly rather than via an advert or search result.

Seed phrases: storing the master key

The seed phrase is the single point of failure in self-custody. Good practice is boring and physical:

• Write it down on paper or stamp it into metal. Do not photograph it, store it in a notes app, email it to yourself or keep it in cloud storage.
• Keep it somewhere safe from fire, water and casual discovery, and consider a second copy in a separate secure location.
• Never type it into a website. Legitimate wallets only ask for it when you are restoring a wallet on your own device.
• Never share it with anyone, ever. Not with support staff, not with an exchange, not with someone helping you fix a problem. No legitimate service needs it.

Some wallets support an optional extra passphrase on top of the seed phrase. It adds protection if the words are found, but if you forget the passphrase, the funds are as lost as if you had lost the seed phrase. Only use it if you are confident you can keep both safe.

For larger sums, some people use multisignature wallets, which need two or more keys to approve a transaction. They reduce single-point failure but add complexity, and complexity itself causes mistakes.

Planning for someone else

If something happened to you, could your family find and access your crypto? Many self-custodied coins are effectively lost because nobody else knew they existed or how to reach them. Think about documenting what you hold and where instructions are kept, without writing the seed phrase into a will or any document that many people will see. A solicitor familiar with digital assets can help.

Exchange custody risk: what FTX showed

FTX was one of the largest crypto exchanges in the world. In early November 2022, after concerns about its finances became public, customers rushed to withdraw. The exchange could not meet the withdrawals and stopped processing them, and on 11 November 2022 FTX and around 130 affiliated companies filed for Chapter 11 bankruptcy protection in the United States. Customers who held coins on the platform found that they did not have coins they could take; they had claims in a bankruptcy.

FTX was not the first or only case. Mt. Gox, which at one point handled most bitcoin trading, collapsed in 2014 after losing large amounts of customers' bitcoin. In 2022, several crypto lending platforms, including Celsius, froze customer withdrawals and went on to file for bankruptcy. The lesson is not that every exchange will fail. It is that an exchange balance is only as good as the firm behind it, and that the warning signs are often invisible from the outside until it is too late.

What MiCA changes in the EU

Under the EU's Markets in Crypto-Assets Regulation, firms providing custody of crypto for clients are crypto-asset service providers (CASPs) and must be authorised. The rules require them to keep clients' crypto-assets separate from their own, keep a record of each client's holdings, and have policies for safeguarding them. The transitional period for firms that operated before MiCA ended on 1 July 2026 at the latest. These requirements improve the position of clients of authorised firms, but they do not make crypto custody risk-free, and they do not create a compensation scheme for lost crypto. Our guide to crypto scams and regulation explains how to check whether a provider is authorised.

Questions to ask any custodian

• Is the firm authorised in the EU under MiCA, or registered with the FCA in the UK, and does the register entry match its website?
• Does it say how client assets are held and segregated?
• Does it lend out or stake client coins, and can you opt out?
• What happens to your assets if the firm becomes insolvent, according to its terms?
• How quickly have withdrawals been processed in practice, and are there limits?

Self-custody mistakes that cause permanent losses

Sending to the wrong network

Many coins and tokens exist on more than one blockchain. Sending a token on one network to an address that expects another can leave it stuck or lost. Always check that the network selected when withdrawing matches the network the receiving wallet or platform supports.

Address poisoning and copy-paste errors

Some attackers send tiny transactions from addresses that look similar to ones you use, hoping you will copy the wrong address from your history. Malware can also swap an address on your clipboard. Check the full address, not just the first and last few characters, and use a saved address book where your wallet offers one.

Skipping a test transaction

For a large transfer, send a small amount first and confirm it arrives. The extra network fee is a cheap insurance premium.

Approving malicious contracts

On smart-contract networks, connecting a wallet to a website and approving a transaction can give that site permission to move tokens. Wallet drainers exploit this. Only connect to sites you have reached directly, read what you are approving, and periodically revoke approvals you no longer need. See Ethereum and altcoins for how smart contracts work.

Fake support and seed phrase phishing

Scammers pose as wallet or exchange support on social media and messaging apps, and the conversation always ends with a request for your seed phrase or a link to a fake "validation" site. Real support will never ask for it.

Worked example: the cost of a test transaction

The figures are illustrative. You want to move 0.5 of a coin worth about €25,000 from an exchange to your hardware wallet. The exchange charges a fixed withdrawal fee equivalent to €5 per withdrawal.

• Sending the whole amount in one go costs €5.
• Sending a small test amount first, then the remainder, costs €10.

The extra €5 is 0.02% of the amount being moved. Against the risk of sending €25,000 to the wrong network or a mistyped address, with no way to reverse it, that is a small cost. Check your platform's actual fees before you move anything, as fees vary between platforms and networks.

Custody when you trade crypto CFDs

If you trade crypto through CFDs, you never hold coins, keys or seed phrases. Your exposure is a contract with your broker, settled in cash. The custody question becomes: what happens to your cash if the broker fails? In the EU and UK, regulated brokers must hold retail client money in segregated accounts, and an investor compensation scheme may cover eligible clients up to a limit if the firm cannot return their money. That cover relates to the firm failing, never to trading losses. Our guide to crypto CFDs vs buying crypto compares the two routes, and how to check a broker licence shows how to confirm who you are dealing with.

Common mistakes

• Believing "not your keys, not your coins" means self-custody is safe. It removes one risk and adds others. Many people have lost more to their own mistakes than to exchanges.
• Keeping a large balance on a platform because it is convenient, without checking how it holds client assets.
• Storing the seed phrase digitally, in photos, cloud notes or email.
• Buying a used or marketplace hardware wallet.
• Rushing a transfer when someone is pressuring you, which is exactly what scammers aim for.
• Telling people how much crypto you hold. It makes you a target, online and offline.
• Assuming a deposit guarantee applies. Crypto balances are generally not covered.

Frequently asked questions

What is the difference between a hot wallet and a cold wallet?

A hot wallet keeps its private keys on an internet-connected device such as a phone or browser, which is convenient but exposed to online attacks. A cold wallet keeps them offline, usually on a hardware device or paper backup, which is less convenient but much harder to attack remotely.

What happens if I lose my seed phrase?

If you still have access to the wallet, move the funds to a new wallet with a new seed phrase that you back up properly. If you have lost both the device and the seed phrase, the coins cannot be recovered by anyone. There is no password reset in self-custody.

Is it safe to keep crypto on an exchange?

It depends on the exchange, and it is never risk-free. You rely on the firm staying solvent, honest and secure. Authorised EU providers must segregate client crypto under MiCA, which helps, but crypto held this way is generally not covered by compensation schemes, and history includes several large exchange failures.

What happened to customers' money at FTX?

When FTX could not meet a wave of withdrawals in November 2022, it stopped processing them and filed for bankruptcy on 11 November 2022. Customers became creditors in the bankruptcy rather than holders of coins they could withdraw, and had to wait for the legal process to determine what they would receive.

Will anyone ever legitimately ask for my seed phrase?

No. Exchanges, wallet makers, support teams and recovery services have no legitimate reason to ask for it. Anyone who asks for your seed phrase is trying to steal your crypto.

Do I need a wallet to trade crypto CFDs?

No. A crypto CFD is a contract with your broker and does not involve holding coins. Your risks are the trading risk and the broker's ability to return your cash, which is why checking the broker's authorisation matters.