Finance Brain
Courses
Home
Sign in
← Back to decks
Sign in to save your progress, vote, and build your own decks.Sign in

Crypto Custody and Security

In traditional finance, your assets are held by custodians (banks, brokerages) whose insolvency is partially protected by regulatory schemes (FSCS in the UK, SIPC in the US). In crypto, asset security depends entirely on who holds the private keys — the cryptographic credentials that authorise…

4 cards
Study this deck

Crypto Custody and Security

Not Your Keys, Not Your Coins

Man reflected in a computer screen

Photo by Jonathan Cosens Photography on Unsplash

In traditional finance, your assets are held by custodians (banks, brokerages) whose insolvency is partially protected by regulatory schemes (FSCS in the UK, SIPC in the US). In crypto, asset security depends entirely on who holds the private keys — the cryptographic credentials that authorise transactions.

The phrase "not your keys, not your coins" encapsulates a fundamental truth: if someone else controls the private keys to your crypto, you are an unsecured creditor of that custodian, not a direct owner of the assets. The history of crypto is littered with exchanges and custodians that have failed, been hacked, or committed fraud — in most cases leaving customers with no recovery.

Centralised Exchanges (CEX)

smartphone calculator on desk with financial charts behind

Photo by Jakub Żerdzicki on Unsplash

Centralised exchanges (Coinbase, Binance, Kraken) allow users to buy, sell, and hold cryptocurrency through a traditional account interface. The exchange holds assets in custody on behalf of users — users see balances but typically don't directly control private keys.

Risks of CEX custody:

  • Exchange insolvency: when FTX collapsed in November 2022, users lost approximately $8 billion in assets. FTX had misappropriated customer funds — a custodial failure enabled by inadequate regulatory oversight
  • Hacking: Mt. Gox (2014, $450 million lost), Bitfinex (2016, $72 million), and numerous others demonstrate exchange vulnerability
  • Regulatory seizure: exchanges can be ordered to freeze assets

However, regulated exchanges (Coinbase is publicly listed; Kraken and others are regulated in multiple jurisdictions) provide more recourse than unregulated ones. The FSCS does not cover crypto assets, but regulated UK exchanges are overseen by the FCA.

Self-Custody: Hardware Wallets

silver round coin on black leather case

Photo by DrawKit Illustrations on Unsplash

Self-custody means the user controls their own private keys, stored in a hardware wallet (physical device) or software wallet. No third party can access or freeze the assets.

A hardware wallet (Ledger, Trezor) stores private keys in a secure offline chip, signing transactions without exposing keys to an internet-connected device. It provides strong security against remote hacking but requires responsible physical management.

Risks of self-custody:

  • If the hardware wallet is lost or destroyed without a backup, assets are permanently inaccessible
  • If the seed phrase (the 12–24 word recovery phrase) is discovered by someone else, they can access all funds from any device

The seed phrase is the master key: it must be written down and stored in multiple secure physical locations. Digital copies (photos, cloud storage) are vulnerable to hacking. Many hardware wallet users store seed phrase copies in fireproof safes or bank safety deposit boxes.

The Trade-Off

brown and beige weighing scale

Photo by Piret Ilver on Unsplash

Centralised ExchangeSelf-Custody
Counterparty riskYes (exchange solvency)None
Hacking riskExchange-levelUser-level
Key managementNot requiredUser's full responsibility
Recovery if access lostAccount recoverySeed phrase only
Regulatory protectionPartial (varies)None

Educational content only. Not financial, investment, tax or legal advice. Learn more

Quiz me on this
What does "not your keys, not your coins" mean in practical terms for exchange-held crypto?
  1. It is a reminder to regularly change your exchange password to prevent unauthorised access
  2. ✓ If your crypto is held on an exchange that controls the private keys, you are an unsecured creditor of the exchange — if the exchange fails, is hacked, or commits fraud, you may have no legal claim on the underlying assets
  3. It refers to the encryption keys used to protect your exchange account login credentials
  4. It means that crypto held on exchanges cannot be transferred to other wallets because the exchange retains ownership
What is a seed phrase, and why is its physical security critically important?
  1. A seed phrase is the password used to log into a hardware wallet's management interface
  2. ✓ A seed phrase (12–24 words) is the master cryptographic key from which all private keys in a wallet are derived — anyone with the seed phrase can access all associated funds from any device, making its secure physical storage the most important aspect of self-custody
  3. A seed phrase is a unique identifier registered with the blockchain that allows fund recovery through the developer company
  4. A seed phrase is a multi-factor authentication code that expires every 30 days and must be renewed to maintain wallet access
What made the FTX collapse in 2022 particularly significant for crypto custody risk?
  1. FTX was hacked by external attackers who exploited a software vulnerability in Ethereum's smart contract layer
  2. ✓ FTX, run by Sam Bankman-Fried, was one of the world's largest and most reputable exchanges — its collapse from misappropriated customer funds demonstrated that even seemingly credible, institutionally-connected exchanges could represent catastrophic custody risk, losing approximately $8 billion of customer assets
  3. FTX's collapse triggered a chain reaction that caused Bitcoin to lose 99% of its value permanently
  4. FTX was the first exchange to be regulated by the US SEC, and its collapse demonstrated that regulation made exchanges more rather than less risky
What is the primary risk of self-custody compared to exchange custody?
  1. Self-custody exposes funds to regulatory seizure because the government knows your wallet address
  2. ✓ In self-custody, all security responsibility falls on the user — loss of the hardware wallet without a seed phrase backup, or theft of the seed phrase, results in permanent and total loss of assets with no recovery mechanism
  3. Hardware wallets are vulnerable to remote hacking because they require occasional internet connection for firmware updates
  4. Self-custodied assets cannot be sold on exchanges because they lack the exchange's internal verification marker