Custodial or self-custody wallet? How to choose and stay safe

Two ways to hold crypto

Coins don't sit inside a wallet app. They are recorded on a blockchain, and whoever controls the matching private key can move them. A private key is a long secret number; most wallets let you back it up as a seed phrase (also called a recovery phrase), usually a list of 12 or 24 ordinary words that can recreate your keys in any compatible wallet.

With a custodial wallet, such as an account at an exchange, the provider controls the keys. Your balance is an entry in its books, and you reach it with a login, much like online banking. With a self-custody (or non-custodial) wallet, the keys are created on your own phone, computer or hardware device, and nobody else has a copy.

In the interest of transparency: nowcoin, which publishes this blog, is a custodial wallet. We hold the keys to the wallets behind our customers' balances, and customers do not. This guide is meant to help you choose well either way.

The trade-offs

Neither column is simply safer. Custody shifts the risk from your own mistakes to a company's conduct. Self-custody removes the company but makes every mistake final: blockchain transfers can't be reversed, and no help desk can recreate a lost seed phrase.

A useful question is which worries you more: losing a piece of paper, or a company losing your money. You can also use both, for example a custodian for an active balance and self-custody for longer-term holdings.

When custodians fail: FTX and Celsius

FTX was one of the largest crypto exchanges; by 2022 its customers traded around $10–15 billion a day, according to the appeals court that later reviewed the case. Its collapse took less than two weeks.

Evidence at trial showed that while Bankman-Fried, FTX's founder, assured customers their funds were safe, he moved billions of dollars from customer accounts to Alameda Research, his trading firm. The money went into unrelated investments, Alameda's losses, political donations and property. On 7 November 2022 he posted "FTX is fine. Assets are fine"; the SEC later called that post false and misleading. The next day, withdrawals stopped.

In September 2026 Bankman-Fried asked the US Supreme Court to hear his case; as of this writing, the court has not decided whether it will.

Customers waited more than two years for their money. By July 2026, payments to the main customer classes had reached 105% of their allowed claims, but US bankruptcy law valued those claims in dollars at November 2022 prices. Customers got cash rather than their coins, and missed any later rise in prices.

It wasn't only FTX

Celsius, a crypto lending platform, froze withdrawals in June 2022 and filed for bankruptcy the following month. In January 2023 the court ruled that, under Celsius's own terms of use, coins deposited in its interest-paying Earn accounts had become the company's property. About 600,000 accounts holding some $4.2 billion were affected, and their holders became creditors in the bankruptcy rather than owners of the coins.

The lesson is not that every custodian is a fraud. It is that custody means trusting a company's honesty, its controls and its legal terms, and you can check only some of that from outside.

If you choose a custodian

A few questions separate careful providers from risky ones:

• Is it licensed where you live? Regulators publish registers. In the EU, the MiCA regulation requires authorised providers that hold clients' crypto-assets to keep them separate from their own, both on the blockchain and legally, so the provider's creditors can't claim them in an insolvency. The last transitional periods ended on 1 July 2026.
• What do the terms say? Check whether your coins remain yours and whether the provider may lend or reuse them. Interest products are where Celsius customers lost their claim to ownership.
• What does a "proof of reserves" prove? Some exchanges publish one. The PCAOB, the US audit regulator, has warned that such reports are not audits and show assets at a single moment, which on its own can't prove there is enough to cover what customers are owed.
• Which security tools does it offer? Look for sign-in with an authenticator app or security key, a withdrawal address book, alerts and a list of signed-in devices.

It also helps to keep with any single provider only what you need there.

If you hold your own keys

Self-custody starts with the seed phrase. Write it on paper or metal, store it offline and out of sight, and never type it into a website, photograph it or keep it in email or cloud notes. Anyone who sees it can take everything. If you lose it and your device fails, the coins are gone for good.

Hardware wallets

A hardware wallet is a small device that creates and stores your keys offline and signs transactions inside itself, so malware on your computer can't copy the keys. You confirm each payment on the device's own screen, which Trezor calls "the source of truth". Buy one new, from the maker or an authorised reseller: a device that has passed through unknown hands may have been tampered with.

Multisig and MPC

A multisig wallet needs several keys to approve a transfer, written as "m-of-n". A 2-of-3 wallet, for example, moves coins only when two of its three keys sign, so you can store the keys in different places and survive losing one.

MPC (multi-party computation) reaches a similar goal another way. The key is split into shares held by different devices or parties, and a set number of them work together to sign, so that no single one holds the whole key. Some custodians and wallet apps use it; who holds the shares decides whether it is really self-custody. Both approaches add safety and complexity, so write down how to recover your set-up, for yourself and for your family.

Good habits either way

Many losses come not from clever hacking but from stolen logins, a swapped address or a persuasive stranger. These habits protect you whichever wallet you use. Our guide to crypto scams and phishing covers the tricks themselves.

Sign in safely

Use an authenticator app, or better a passkey or security key, for two-step sign-in, not text messages. CISA, the US cybersecurity agency, advises against SMS codes because texts aren't encrypted and phone numbers can be hijacked through SIM swapping. Once the app works, switch SMS off, and remember that even app codes can be phished: type them only into a site you opened yourself.

Give every account its own long password, at least 16 characters as CISA suggests, and let a password manager remember them. A password leaked from one site is often the first thing attackers try on others.

Now and then, review the list of signed-in devices, sign out any you don't recognise, and change your password. In a self-custody wallet, the equivalent is reviewing which sites are connected and revoking token permissions you no longer use.

Send safely

Before each withdrawal, check three things: the coin, the network and the address. The same coin, such as USDT or USDC, can exist on several networks, and sending it on one the recipient doesn't support can mean the funds never arrive. Compare the whole address, not just its first and last characters, because scammers create lookalikes.

An address book turns one careful check into a lasting one. Some services also let you block withdrawals to any address not already saved, sometimes with a waiting period for new entries that gives you time to react if someone gets into your account.