In traditional finance, custody is something most people never think about. Your brokerage holds your stocks. Your bank holds your cash. A custodian — a regulated financial institution — sits between you and your assets, keeping them safe, properly accounted for, and insured against loss.
In crypto, custody is one of the most important decisions you make. And unlike traditional finance, you have a genuine choice: let someone else hold your assets, or hold them yourself.
That choice has real consequences — as millions of people discovered when FTX collapsed in 2022, when Celsius froze withdrawals, when BlockFi filed for bankruptcy. In every case, users who trusted a centralized custodian with their crypto lost access to their funds. Users who held their own assets didn't.
This guide explains what crypto custody means, what your options are, and how to make the right choice for your situation.
In crypto, custody means control of private keys.
As we covered in our Crypto Wallet Safety guide, your private key is the cryptographic proof that you own specific assets on the blockchain. Whoever controls the private key controls the assets — completely and irrevocably. There’s no dispute resolution process, no account recovery, no way to override a private key once someone has it.
This means the custody question in crypto reduces to one simple question: who holds the private keys to your assets?
If you hold your own private keys — through a self-custodied wallet — you are the sole custodian of your assets. No company can freeze them, no platform insolvency can affect them, and no one can move them without your authorization.
If someone else holds the private keys — a centralized exchange, a lending platform, a custody service — they are the custodian of your assets. You have a claim on those assets, but you don’t directly control them. Your access depends entirely on that custodian remaining solvent, honest, and operational.
The phrase the crypto community uses to capture this distinction: “not your keys, not your coins.”
Self-custody means generating and controlling your own private keys — typically through a software wallet like MetaMask or a hardware wallet like Ledger or Trezor.
When you self-custody, your assets are protected by your private key and seed phrase. No company stands between you and your funds. No platform decision, regulatory action, or corporate insolvency can prevent you from accessing them.
The tradeoff is responsibility. There’s no customer support to call if something goes wrong. If you lose your seed phrase, your funds are permanently inaccessible — no recovery process exists. If your device is compromised or your seed phrase is stolen, your assets can be drained with no recourse.
Self-custody comes in two forms:
Hot wallets — software wallets connected to the internet. MetaMask is the most widely used example in DeFi. Convenient for regular transactions and protocol interactions, but more exposed to online threats because the private key exists on an internet-connected device.
Cold wallets — hardware devices that store private keys offline. Ledger and Trezor are the leading manufacturers. Because the private key never touches the internet, cold wallets are significantly more resistant to remote hacking. Every transaction requires physical confirmation on the device — adding friction that is also a security feature.
Most serious DeFi participants use both: a hot wallet funded with only what’s needed for active protocol interactions, and a cold wallet holding the majority of their long-term holdings.
Third-party custody means entrusting your assets to a company that holds the private keys on your behalf. This is what you’re doing when you leave crypto on a centralized exchange like Coinbase or Binance.
The advantages are real. The user experience is familiar — log in with email and password, contact customer support if something goes wrong, recover access if you forget your credentials. Fiat on-ramps and off-ramps are seamless. There’s no seed phrase to protect and no hardware device to manage.
The risks are equally real. You’re trusting the custodian to remain solvent, to actually hold the assets they claim to hold, to operate honestly, and to honor withdrawal requests. When custodians fail on any of these dimensions — as FTX, Celsius, BlockFi, and others did — users lose access to their funds.
The specific risk varies by custodian. Regulated exchanges like Coinbase operate under financial regulations that provide some structural protections. Unregulated platforms offer none. Even regulated custodians carry counterparty risk that self-custody eliminates entirely.
For institutional investors — family offices, hedge funds, corporations holding crypto on their balance sheets — a third category exists: institutional custody services.
Companies like Coinbase Custody, BitGo, and Anchorage Digital offer regulated, insured custody specifically designed for large institutional holdings. These services combine the security of professional key management with the compliance infrastructure — audits, insurance, regulatory oversight — that institutional investors require.
This category is increasingly relevant as real-world asset tokenization brings traditional institutional capital on-chain. As we covered in our Tokenization guide, institutional participants need custody solutions that meet their legal and fiduciary requirements while enabling on-chain activity.
For individual retail participants, institutional custody services are generally inaccessible — minimum asset thresholds and onboarding requirements put them out of reach. For high-net-worth individuals and businesses, they represent a middle path between the convenience risk of centralized exchanges and the full responsibility of self-custody.
Beyond the three primary categories, one custody architecture deserves special mention because of its security advantages: multi-signature (multisig) wallets.
A multisig wallet requires multiple private keys to authorize any transaction — typically structured as “m of n,” meaning m signatures out of n total keyholders must approve before anything moves. A 2-of-3 multisig, for example, requires any two of three designated keyholders to sign a transaction.
This architecture distributes the single point of failure that makes standard wallets vulnerable. Lose one key out of three in a 2-of-3 setup and you can still access your funds — the other two keys provide redundancy. Compromise one key and an attacker still can’t move your assets without the additional required signatures.
Many DeFi protocol treasuries are managed through multisig wallets — requiring multiple team members or governance participants to authorize any transaction. For individuals with significant holdings, personal multisig setups provide similar protection: keys stored in separate physical locations, with no single location containing enough keys to authorize transactions independently.
Tools like Safe (formerly Gnosis Safe) make multisig wallets accessible without deep technical knowledge and are increasingly used by DeFi-native individuals managing substantial portfolios.
The right custody solution depends on your specific situation — the size of your holdings, your technical comfort, how frequently you need to transact, and what level of responsibility you’re prepared to take on.
For someone new to crypto with small holdings:
Starting on a regulated centralized exchange is reasonable while you learn. The user experience is forgiving, mistakes are more recoverable, and the custodial risk on a regulated platform is manageable for amounts you’re not relying on. As your holdings grow and your understanding deepens, transitioning to self-custody becomes increasingly important.
For an active DeFi participant:
A hot wallet — MetaMask specifically — is necessary for interacting with DeFi protocols. The question is how much to keep in it. The answer most experienced DeFi participants settle on: only what you need for near-term activity. Anything beyond that moves to a hardware wallet.
For someone holding significant long-term crypto:
A cold wallet is the baseline. Ledger and Trezor both offer solid options at different price points. The one-time cost of a hardware wallet — $79 to $279 depending on the model — is trivially small relative to the protection it provides on holdings worth thousands or tens of thousands of dollars.
For businesses or very high-net-worth individuals:
Multisig setups and institutional custody services both deserve evaluation. The added complexity of multisig is worth the additional security at significant holding sizes, and institutional custody provides the compliance infrastructure that some professional contexts require.
Regardless of which custody approach you choose for your primary holdings, if any of that involves self-custody, the seed phrase is what everything depends on.
Your seed phrase — the 12 or 24 words generated when you create a wallet — mathematically generates your private key. It’s the master backup that lets you restore wallet access on any compatible device if your original device is lost, damaged, or stolen. It’s also the single point of failure that, if lost or stolen, ends your access to everything in that wallet permanently.
Protecting your seed phrase:
Write it down by hand on paper immediately when you create a wallet. Never type it into a computer, photograph it, store it in a notes app, or save it anywhere digitally — every digital storage location is a potential attack surface.
Store it somewhere physically secure — a fireproof safe, a safety deposit box, or multiple secure locations for redundancy. Some users engrave seed phrases on metal plates for fire and flood resistance.
Consider storing copies in multiple locations — your home safe and a safety deposit box, for example — so a single physical event can’t destroy your only backup.
Tell a trusted person where to find the backup in case of emergency. Not what the words are — just where to find them.
Never share your seed phrase with anyone, for any reason, ever. No legitimate wallet provider, DeFi protocol, customer support agent, or technical support service will ever ask for it.
One question that comes up frequently in custody discussions: is crypto insured?
The answer depends on the custody model and the specific institution.
Regulated US exchanges like Coinbase carry FDIC insurance on cash balances held in their custodial accounts — but this covers cash, not crypto holdings. Crypto assets themselves are generally not FDIC-insured.
Some institutional custodians carry commercial insurance policies covering custodied assets against theft and certain loss events. The coverage limits and terms vary significantly and aren’t always publicly disclosed.
Self-custodied assets aren’t covered by any external insurance by default — though DeFi insurance protocols like Nexus Mutual, which we covered in our DeFi Insurance guide, can provide coverage against smart contract exploits for assets deployed in DeFi protocols.
The honest picture: crypto custody insurance is limited, variable, and not a reliable safety net for most users. It’s an argument for self-custody rather than against it — the best insurance against custodial failure is not having a custodian who can fail.
Crypto custody is the foundational security decision in DeFi. Every other security practice — choosing audited protocols, maintaining a healthy Health Factor, revoking unnecessary token approvals — builds on top of the custody decision you make about who controls your private keys.
The collapse of FTX, Celsius, and others wrote this lesson in the most expensive ink possible: trusting a third party with custody of your crypto means accepting that custodian’s solvency, honesty, and operational continuity as risks you bear. For users who want to eliminate that risk, self-custody is the answer — and the tools to do it safely have never been more accessible or more user-friendly.
Start with a hardware wallet for anything you’re holding long-term. Keep a hot wallet funded with only what you need for active DeFi interactions. Write your seed phrase down, store it securely, and protect it with the same seriousness you’d protect the combination to a vault containing everything you own.
In traditional finance, the bank is your custodian. In DeFi, the choice is yours — and making it deliberately, with full understanding of the tradeoffs, is one of the most important decisions you’ll make in this space.
Disclaimer: Educational content only — not investment, financial, tax, or legal advice. Cryptocurrency and DeFi involve substantial risk, including the potential for total loss of capital. See our full Terms & Conditions and Privacy Policy.