Crypto Wallets and Custody: Who Controls the Keys?

Whoever holds the keys controls the coins. Learn the difference between holding them yourself and letting a company hold them, and how to protect your seed phrase.

In this article
A hand holds a red-headed key beside a locked wallet and a closed recovery envelope.

What does custody mean in crypto?

answers one simple question: who can approve moving your coins? There are two main setups.

  • Self-custody: you hold the keys in your own wallet. Only you can sign a transfer.
  • Third-party custody: a company holds the keys for you. You log in, and the company moves the coins when you ask.

The company is often an , a business where you buy and sell crypto. Knowing your exchange password is not the same as holding the keys. As the US Securities and Exchange Commission (SEC) puts it, crypto wallets do not store the crypto. They hold the keys that prove ownership.

Who can approve a transfer? With self-custody, you manage signing access and must check your backups, devices and recovery steps. With third-party custody, the custodian manages signing access and you must check its terms, withdrawals and what happens if it fails. A login and signing control can be different things.
A login and the power to sign can be two different things.
Two ways to hold crypto
QuestionSelf-custodyThird-party custody
Who can sign a transfer?You, with your keysThe company
What should you check?Your backups and devicesThe terms, the withdrawal rules and what happens if it fails
What can go wrong?You lose your keys or get trickedThe company is hacked, freezes withdrawals or fails

Neither setup is safe by default. Each one puts the risk in a different place.

What is a seed phrase, and who can see it?

When you set up your own wallet, it shows you a : a list of words, often 12 or 24. These words can rebuild your keys on a new phone or device. That makes them very powerful.

  • Anyone who has your seed phrase can take your coins.
  • If you lose the phrase and your device, you may lose the coins for good. Nobody can reset it.
  • Real support staff never need it.

Write the phrase down and keep it somewhere safe and private. Don't keep it in a screenshot, an email or a shared file. Never type it into a website or form that someone sends you.

Your exchange password and your code are secrets too. 2FA (two-factor authentication) is the one-time code your phone gets when you log in. Scammers ask for these codes to break into accounts. Our crypto scams lesson shows how these tricks work.

Some things are fine to share. Your works like an account number: people need it to send you coins.

Try it yourself

Sort your crypto secrets

Sort each item into Never share or Okay to share. Then switch between an exchange wallet and your own wallet to see who holds the keys.

Never share (4 items): seed phrase, private key, exchange password and 2FA login code. Okay to share (2 items): your public address and a transaction ID. On an exchange, the company holds the keys and you have a login. In your own wallet, you hold the keys and nobody can reset them.

What would you expect?

What this shows: Whoever holds the keys controls the coins. On an exchange, that's the company. In your own wallet, it's you, with no reset button.

Four of the six items give control of your coins or your account, so they stay secret. A public address and a transaction ID are made to be shared. Custody decides who must guard the keys: you or the company.

Hot wallet or cold wallet: which is safer?

A is connected to the internet, like a wallet app on your phone. It is easy to use, but online attacks can reach it. A is usually a small device that stays offline. It is safer from hackers, but it can be lost, broken or stolen.

Hot and cold describe the connection, not the quality. A cold device can still sign a bad transfer if someone tricks you into approving it. So look at the whole process, not just the gadget.

What happens if an exchange fails or is hacked?

With third-party custody, you depend on the company. The SEC warns that if a custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto.

This has happened before. In February 2014, the Mt. Gox exchange in Japan closed its website. It said about 750,000 bitcoins belonging to its users were missing. Read the full story in Bitcoin's biggest crashes.

Before you leave coins on any platform, read its terms. Can it delay withdrawals? What happens to customer coins if it closes? If it says it is "insured", find out who gives the insurance, what it covers and who can claim. Leave a question blank if you can't find the answer. A blank is useful information too.

How can I practise recovering a wallet?

You can rehearse a recovery without using any real secret.

  1. Pick a made-up wallet and write "recovery words" on a blank card. Never use a real phrase for practice.
  2. Describe how the owner would get back in after losing their phone. For a real product, follow the wallet maker's own instructions.
  3. Describe what would happen if someone else found the card.
  4. Explain how a trusted person could find the steps in an emergency, without the secret being shown to anyone else.
  5. List the parts you would need expert help with.

Finish with a recovery plan and a list of gaps you still need to resolve. No real phrase or payment is needed for this drill; it does not recommend a wallet.

Is my crypto protected if something goes wrong?

Usually much less than money in a bank account. The details depend on where you live.

  • Canada: the Ontario Securities Commission says crypto is excluded from the Canadian Investor Protection Fund (CIPF).
  • UK: the FCA says you are unlikely to be covered by the Financial Services Compensation Scheme. It says to be prepared to lose all your money.
  • Australia: ASIC Moneysmart says you may not be protected if a platform fails or is hacked.
  • US: read the custody agreement for your exact account. Don't assume another country's rules apply.

A licence or registration is worth checking, but it is not a promise to pay you back. Next, learn what it costs to buy and sell in crypto orders and fees.

Questions beginners ask

Is it safer to keep crypto on an exchange or in my own wallet?

Neither is safe by default. On an exchange, you depend on the company's security and its ability to return your coins. In your own wallet, you depend on keeping your keys and seed phrase safe. Choose the risk you can actually manage.

Does changing my password fix a leaked seed phrase?

No. Your login and your seed phrase can control different things. If your seed phrase is exposed, follow the wallet maker's official security steps, found through its real website. Never take help from a stranger who messages you first.

What is the difference between a hot and a cold wallet?

A hot wallet is connected to the internet, like a phone app. A cold wallet is usually a small device kept offline. Cold wallets are safer from online attacks, but they can be lost, broken or stolen.

Will crypto support ever ask for my seed phrase?

No. Real support never needs it. Treat anyone who asks for your seed phrase, private key or 2FA code as a scammer, even if the message looks official.

Sources
  1. SEC investor bulletin: Crypto asset custody basics (Dec. 12, 2025)
  2. Mt. Gox: Civil rehabilitation announcement, February 28, 2014