Crypto Wallets and Custody Explained: Keeping Digital Assets Safe

Owning crypto comes down to controlling a private key, a long secret number that authorizes transactions on the blockchain. Whoever holds the key can move the assets; whoever loses it, or gives it away, generally cannot get them back. There is no bank to call and no chargeback. That makes custody, meaning who holds the keys and how, the most important practical decision after deciding to own crypto at all.

Custodial versus self-custody

Custodial means a company holds the keys for you. Most people who buy crypto on a trading platform start here: the account shows a balance, but the platform controls the underlying wallets.

• Pros: password recovery, customer support, easy trading, tax forms.
• Cons: you depend on the platform's security, solvency and willingness to process withdrawals. Several high-profile crypto lenders and exchanges have failed, and customers became creditors in bankruptcy proceedings.

Self-custody means you hold the keys, usually through a wallet app or a hardware device.

• Pros: no intermediary can freeze, lend out or lose your assets.
• Cons: you are fully responsible for security, backups and avoiding mistakes such as sending to the wrong address.

Some services offer a middle ground, such as multi-signature setups where several keys are required to approve a transaction, held by different people or a mix of you and a service provider.

Hot and cold wallets

A "wallet" does not actually store coins; it stores the keys that control them on the blockchain.

"Hot" wallets are connected to the internet and convenient; "cold" storage keeps keys offline and is harder to attack remotely. A common arrangement is a small hot wallet for spending and cold storage for the bulk.

The seed phrase

Most self-custody wallets generate a seed phrase (also called a recovery phrase), typically 12 or 24 ordinary words, that can regenerate all the wallet's keys on a new device. It is the master key.

Practical habits:

1. Write it down by hand at setup, on paper or a metal backup plate designed to survive fire and water.
2. Never photograph it, type it into a computer, or store it in cloud notes or email.
3. Store copies in more than one secure location, such as a home safe and a safe-deposit box, so one fire or burglary does not destroy access.
4. Buy hardware wallets directly from the manufacturer or an authorized retailer, and never use a device that arrives with a seed phrase already filled in.
5. Test recovery with a small amount before moving large sums.

Securing a custodial account

If you keep crypto on a platform, the account login is effectively the key.

• Use a unique, strong password and a password manager.
• Turn on two-factor authentication with an authenticator app or a physical security key rather than text messages, which are vulnerable to SIM-swap attacks.
• Ask your mobile carrier about a port-out or SIM lock, which makes it harder for someone to hijack your number.
• Enable withdrawal allow-lists where offered, so funds can only be sent to addresses you approved in advance.
• Check the platform's licensing and custody terms, including whether customer assets are segregated.

The scams that cause the most losses

The Federal Trade Commission and the FBI have repeatedly warned that crypto is a leading payment method in fraud reported by Americans. Patterns to recognize:

• Investment and "pig butchering" scams. A new online acquaintance, often met through a dating app, social media or a "wrong number" text, guides the victim to a slick trading site that shows fake profits, then demands taxes or fees to withdraw. The money is gone from the first deposit.
• Impersonation. Callers posing as a bank, a crypto platform, a government agency or tech support claim your account is compromised and tell you to move funds to a "safe" wallet.
• Crypto ATM demands. Anyone insisting that a bill, fine or bail be paid by feeding cash into a crypto ATM is a scammer. Government agencies do not accept payment this way.
• Fake wallet apps and phishing sites that capture seed phrases or login details, often promoted through search ads.
• Giveaways and "doubling" offers, frequently using deepfaked video of well-known figures.
• Malicious token approvals, where a website asks a browser wallet to sign a permission that lets it drain assets.

If something goes wrong, report it quickly to the FBI's Internet Crime Complaint Center (IC3), the FTC at ReportFraud.ftc.gov, the platform involved and your state attorney general. Be wary of "recovery services" that promise to get stolen crypto back for an upfront fee; they are a common second-stage scam.

Planning for heirs

Crypto in self-custody can vanish for good if the owner dies without leaving a way in. A basic plan:

• Keep an inventory of platforms, wallets and the types of assets held, updated periodically.
• Store instructions for accessing seed phrases in a way an executor can use but a burglar cannot, for example a sealed letter with an estate attorney and the backup in a separate location.
• For custodial accounts, check whether the platform supports a beneficiary or transfer-on-death designation.
• Consider whether a spot crypto exchange-traded product in a brokerage account would be simpler for heirs to inherit.

A simple security routine

Most losses come from a handful of mistakes: sharing a seed phrase, reusing passwords, trusting unsolicited contact, and having no backup. A short routine, covering a unique password with app-based two-factor authentication, cold storage for long-term holdings, a seed phrase on paper or metal in two places, and a rule never to move funds because someone else urged you to, addresses nearly all of them.

This article explains crypto custody and security in general terms and is not investment or legal advice. Consider your own circumstances and consult a licensed professional before acting.