Crypto Wallets and Self-Custody Explained

When you buy crypto on an exchange, the exchange holds it for you. That is convenient, but your coins are then only as safe as the firm holding them, and crypto firms have failed with customer money inside. This lesson covers what a wallet is, when to hold coins yourself and how to move them off an exchange safely.

What a wallet actually holds

A crypto wallet does not contain coins. Your bitcoin or ether sits on the blockchain, a shared public record kept by computers across the network. What the wallet holds is a private key: a long secret number that signs the transactions that move the coins recorded at your address. Whoever has the key can spend the coins. Lose it, and there is nobody to call.

The address is the part you share. It works like an account number for receiving, and because the blockchain is public, anyone can look up its balance and history. The private key is the part you never share. Most wallets hide the raw key behind a seed phrase, a list of words from which the wallet can rebuild every key it uses.

Custodial or self-custody

With a custodial account, usually an exchange, the firm holds the keys and you hold a claim on the firm. Forget your password and the firm can reset it. With self-custody you hold the keys yourself. Nobody can freeze your coins, and nobody can recover them for you.

The case for self-custody comes from history. Mt. Gox in 2014 and FTX in November 2022 froze customer withdrawals, and customers waited years for partial recovery. Celsius, a crypto lender that promised high yields, froze withdrawals and went bankrupt in 2022. In the UK the Financial Services Compensation Scheme does not cover crypto. FCA registration, which you can check on its public register, is for anti-money-laundering purposes and does not mean a firm is safe.

The case against is that the risk moves onto you. Lose the seed phrase, or hand it to a scammer, and the coins are gone. A sensible split for many holders is a small working balance on an exchange and the long-term holding in a wallet they control. Trading money, like the account degencoder uses for every call in the daily issue, has to sit where the trades happen. Coins you plan to hold for years do not.

Hot wallets and hardware wallets

A hot wallet is an app on your phone or computer, or a browser extension. It is free and handy for small amounts you use often, but the keys live on a device connected to the internet, where malware or a stolen phone can reach them.

A hardware wallet, also called a cold wallet, is a small device that keeps the keys offline. Transactions are signed inside it and you confirm the details on its own screen, so you can check what you are approving even if your computer has been compromised. Buy one new, directly from the maker, and set it up yourself so that it generates a fresh seed phrase. Treat any device that arrives with a recovery phrase already filled in as compromised.

Which one makes sense depends on the amount. As an example, say a hardware wallet costs £70. Against a £300 holding that is 23% of the money (£70 / £300 = 0.23), which is hard to justify. Against £5,000 it is 1.4% (£70 / £5,000 = 0.014), a small price for removing the risk of an exchange failing. Once losing your crypto would genuinely hurt, a hardware wallet usually earns its cost.

The seed phrase

A self-custody wallet shows you its seed phrase, also called a recovery phrase, when you set it up. It is usually 12 or 24 words, and those words are the wallet. Anyone who has them can rebuild your keys on their own device and take everything, without ever touching yours.

• Write it on paper, by hand and in order, then check every word.
• Store it offline somewhere private and secure, away from the device.
• Never photograph it or keep it in a notes app, an email or cloud storage.
• Never type it into a website. You only enter it to restore a wallet on a device you control.

No legitimate exchange, wallet maker or support team will ever ask for your seed phrase, by email, chat or phone. Anyone who asks is trying to steal from you. Crypto Scams and How to Spot Them covers the forms this takes.

Moving coins off an exchange, step by step

1. Secure the exchange account first. Use two-factor authentication from an authenticator app rather than text messages, which a criminal can intercept by persuading your mobile network to move your number to their SIM card. If the exchange lets you restrict withdrawals to approved addresses, turn that on.
2. Get the receiving address from your own wallet. On a hardware wallet, confirm it on the device screen.
3. Choose the right network. The same coin can exist on more than one network. Pick one your wallet supports, because coins sent on the wrong network may never arrive, or may be slow and uncertain to recover.
4. Check the address. Compare the pasted address with your wallet character by character, or at least at the start, middle and end. Some malware swaps a copied address for the attacker's, and some scammers send tiny transfers from look-alike addresses, hoping you copy theirs from your history.
5. Send a small test amount first. Once it shows in your wallet, send the rest.

The test costs a second withdrawal fee. As an example, with a fee worth £2 per withdrawal, moving £3,000 with a test send costs £4 in total, about 0.13% (£4 / £3,000 = 0.0013). That is cheap insurance, because blockchain transactions are generally irreversible and there is no bank to reverse a payment sent to the wrong address. Crypto Exchanges and Fees Explained covers withdrawal fees in more detail.

If you lose the phrase

Lose the device but keep the phrase, and no harm is done. Restore the words on a new device or wallet app and your coins appear again, because they never left the blockchain. Lose the phrase but keep a working device, and move everything to a new wallet with a new phrase straight away. Do the same if you think anyone else has seen it.

Lose both, and the coins are gone for good. Nobody can reset a seed phrase, and a complete one cannot be guessed. Be very wary of anyone who offers to recover lost coins for a fee.

Planning so someone you trust could recover your coins

Self-custody has a quiet failure mode: coins that only you know how to reach, and then something happens to you. The aim is to leave enough for someone you trust to recover them, without handing anyone the phrase today.

• Write a short letter that says what you hold, which kind of wallet it is in, where the phrase is stored and how to restore it. Leave the phrase itself out.
• Keep the letter with your will, or with whoever would handle your affairs, and update it when you change wallets or move the phrase.
• For large sums, take advice on setups that need more than one key to move coins, so that no single person or lost item can lose or take the lot.

Key takeaways

• A wallet holds the keys to your coins; the coins themselves stay on the blockchain.
• On an exchange you hold a claim on a firm; in self-custody the risk sits with you.
• The seed phrase is the wallet: keep it on paper and offline, and never give it to anyone.
• Move coins with a test transaction first, on the right network, after checking the address.