Wallets, Keys and Custody
Owning crypto means controlling a private key, not holding an account balance somewhere — and how that key is stored, who else can access it, and what happens if it's lost defines every meaningful custody decision.
Prerequisites: Public Key Cryptography and Address Derivation
There is no bank teller to call if you forget your crypto password, and no chargeback if someone else spends your coins. That's because "owning" crypto isn't holding a balance in someone's ledger — it's controlling a private key, a large secret number that can sign transactions moving funds recorded on a public blockchain. Whoever holds the key controls the funds, full stop, which is why the phrase "not your keys, not your coins" is the field's founding piece of advice.
A wallet doesn't store coins — coins live on the blockchain. A wallet stores the private key that proves ownership and signs transactions. Custody is entirely a question of who holds that key.
The key hierarchy and the custody spectrum
From a private key, elliptic-curve math derives a matching public key, and from the public key a shorter public address — the string you'd give someone to receive funds. The private key is the only piece that must stay secret; losing it means losing access forever, and anyone who obtains it can move the funds instantly and irreversibly.
- Self-custody (hot or cold wallets). You alone hold the private key — a hot wallet keeps it on an internet-connected device (convenient, more exposed to hacking); a cold wallet (hardware device, paper backup) keeps it offline (safer from remote attackers, but a lost or damaged device with no backup means permanent loss).
- Multisignature (multisig). A transaction requires signatures from M of N separate keys (e.g., 2-of-3), so no single compromised key can move funds — used by exchanges, DAOs, and security-conscious individuals to remove any single point of failure.
- Custodial (exchange) wallets. The exchange holds the private key on your behalf; you hold an IOU-like account balance instead. Convenient and recoverable via password reset, but it reintroduces exactly the counterparty risk crypto's design was meant to remove — if the exchange is hacked, insolvent, or freezes withdrawals, your claim is only as good as their solvency.
Worked example
An investor splits $100,000 of bitcoin: $70,000 in a hardware wallet they control alone, $30,000 on an exchange for active trading. If the exchange is hacked and loses customer funds, the investor's exposure is capped at the $30,000 held there — the $70,000 in self-custody was never on the exchange's books and is unaffected, illustrating why many practitioners treat "keep only trading capital on an exchange" as a basic risk-management rule rather than paranoia.
What this means in practice
Custody choice is a real risk decision, not a technical footnote: the 2022 collapse of FTX wiped out customer balances precisely because those customers held exchange IOUs, not self-custodied keys. Institutions solve this with qualified custodians and multisig or MPC (multi-party computation) schemes that split key control across parties, trying to get exchange-like convenience without a single custodian holding unilateral control.
Losing a private key and having it stolen are both unrecoverable in the same way: there is no password reset on the blockchain itself. Recovery phrases (seed phrases) are the only backup mechanism for a self-custodied key — anyone who writes theirs into a phone note or cloud photo has effectively made it as accessible to an attacker as it is to themselves.
Further reading
- Antonopoulos, Mastering Bitcoin (ch. 4-5)
- Antonopoulos & Wood, Mastering Ethereum (ch. on accounts and keys)