Self-Custody: What Holding Your Own Keys Actually Means
Not your keys, not your coins is a slogan with real consequences on both sides. Self-custody removes counterparty risk and replaces it with your own operational discipline, which is not obviously the better trade.
Monday, August 10, 2026/3 min read
The slogan is old and the reasoning behind it is sound. Assets held on an exchange are a claim against that exchange, and a run of failures has demonstrated what happens when the claim turns out to be worth less than the balance on the screen.
What the slogan leaves out is that self-custody does not eliminate risk. It transfers it, from an institution's solvency to your own operational competence, and a meaningful number of people are worse at that than they expect.
What a wallet is, since the word is misleading
A wallet does not contain anything. Assets exist on a ledger, and the wallet holds the private key that authorises moving them.
The key is derived from a seed phrase, usually twelve or twenty-four words. Those words are the asset. Anyone who reads them controls the funds, from anywhere, permanently. There is no second factor, no support line and no reversal.
This is the part people underrate. Losing a bank card is an inconvenience. Losing a seed phrase is losing the money, and letting someone photograph it is handing them the money.
The three custody models
Custodial. An exchange or broker holds the keys. You get password resets, support, and recovery if you lose your phone. You also carry the risk that the institution fails, freezes withdrawals or is compromised. Regulated custodians with real audits are a genuinely different proposition from offshore venues with neither.
Self-custody, software. A phone or browser wallet where the keys sit on a device connected to the internet. Convenient, and exposed to malware and to whatever you click.
Self-custody, hardware. Keys held on a dedicated offline device that signs transactions without exposing the key. The standard recommendation for meaningful amounts, and cheap relative to what it protects.
How people actually lose funds
Rarely by cryptography being broken. Almost always by one of these:
A seed phrase typed into a website or app. Every legitimate wallet recovery happens on your own device; anything asking for the phrase on a web page is theft.
A seed phrase photographed, emailed to yourself, or stored in a notes app or password manager that later syncs to a compromised cloud account.
A single copy of the phrase, destroyed by fire, flood or a house move.
Signing a malicious approval, particularly a token allowance granting unlimited spending, which drains the wallet later without any further action from the user.
Sending to the wrong network or a mistyped address, which is unrecoverable.
Notice that four of the five are process failures rather than technical ones.
A workable setup
Write the seed phrase on paper, or stamp it into metal for anything substantial. Keep two copies in physically separate locations. Never digital, never photographed.
Consider a passphrase, sometimes called a 25th word, which means a stolen seed phrase alone is insufficient. It also means forgetting it loses everything, so it is not for the casual user.
Split by purpose. A small hot wallet for day-to-day activity, and a hardware wallet holding the bulk that interacts with almost nothing.
Test recovery before you need it. Restore the wallet from the written phrase onto a second device while the funds are still small. A backup you have never tested is a hope, not a backup.
Review and revoke token approvals periodically.
The honest recommendation
For small amounts, or for someone who trades actively and knows they will not maintain the discipline, a well-regulated custodian is a defensible choice and probably the safer one.
For amounts that would genuinely hurt to lose, and for holdings intended to sit for years, hardware self-custody with a tested paper or metal backup is the right answer.
What is not defensible is the middle: a large balance in a software wallet on the same phone used for everything else, with the seed phrase in a screenshot.
None of this is affected much by the regulatory picture, which continues to move slowly. The classification of sixteen assets as digital commodities settled a question for those tokens and left the general test open, and the custody infrastructure being assembled is aimed at institutions rather than individuals. The key on your desk is unaffected either way, which is rather the point of it.
This article is general information, not investment or security advice. Digital assets carry substantial risk of loss, including total loss through user error.
Published in The Outspoken Digest
Newsletter
The Digest, in your inbox
One edition, sent when it is ready. No noise, and your address is never passed on.
Read Next
More Crypto →
