Who holds the keys: a long read on custody
Strip away the interfaces and every crypto arrangement reduces to a single question: who is able to move the funds, and under what circumstances? This essay walks the full spectrum of answers, from fully custodial services to steel plates buried in the ground, and shows what each answer costs.
The one question under all the others
Money has always been a ledger plus an authority to edit it. In banking, the ledger is the bank’s database and the authority is its procedure; in cash, the ledger is the note itself and the authority is physical possession. Cryptocurrencies made the ledger public and, for the first time, made the editing authority portable: a private key is the right to write a specific line in a public book, and it fits in your pocket, your head, or someone else’s vault.
This is why “custody” — an dusty trust-law word — became the central engineering and ethical problem of the field. Every product, exchange and wallet is a particular answer to the question of where the signing ability lives, and every large failure you have read about is one of those answers being stress-tested. Once you learn to hear the question, marketing materials become almost readable as schematics: “instant withdrawals” means hot keys, “insurance” means a custodian, “we never hold your funds” means the keys are somewhere else — the interesting part being where.
The custodial end of the spectrum
A custodial service is one where the ability to sign lives with the counterparty and your access is contractual. The virtues of this arrangement are real: recourse when something goes wrong, recovery when you forget a password, speed because a trusted operator can move instantly, and often compliance that keeps your funds bankable. The costs are symmetrical: your access can be delayed, restricted or extinguished by the service’s policy, its regulators, or its collapse — and history supplies all three in quantity.
The mature position on custodians is neither paranoia nor trust but accounting. Treat a custodial balance as a receivable: an asset that depends on another party’s continued performance. A person who keeps only operational floats in custodial accounts — with the reserves elsewhere — has decided the question consciously. A person who keeps everything there because an interface felt safe has answered it by accident. For comparing how services describe their own side of the bargain, the exchange-knowledge write-ups on UsdtChange translate custodial language into plain terms.
Hot storage: the working surface
Hot storage is where a service’s daily mechanics live. It signs continuously, so it must be reachable, and reachability is the property every attacker wants. The craft of running hot wallets is therefore not cryptographic — the cryptography is settled — but operational: how small the balances are, how narrow the authority of each key, how fast anomalies trigger a sweep to cold. A service that answers these questions concretely has an architecture; one that answers “military-grade encryption” has a press release.
The user-facing corollary deserves emphasis: the thing to ask about is not whether hot wallets exist but what fraction of total holdings they carry. A well-run operation typically keeps hot balances at a fraction of daily flow — enough to honour normal withdrawals, small enough that a total compromise is an incident rather than an extinction event. Ask the question in that form and you will quickly sort venues into those that have thought about their own failure modes and those that have only thought about their marketing.
Cold storage: delay as armour
Cold storage is signing authority held offline, and its defence is structural: a key that has never been reachable cannot be reached. What it buys with that is time — movements require human action, physical media and often multiple people, which is exactly the friction that turns a remote attack from catastrophic to merely inconvenient. Institutions institutionalise this friction with multi-signature schemes and geographically separated custodians; individuals usually settle for hardware wallets and backups in more than one location.
The design failures of cold storage are almost never exotic; they are household. The single backup lost in a move; the steel plate stored in the same fire as the house; the phrase written in a notebook that a helpful relative discarded; the two copies kept in the same bank’s two branches during the same banking crisis. Redundancy, separation and a sober inventory of what could destroy all copies at once — that is the whole discipline, and it is more discussed than practised.
Watch-only: the architecture of honest services
Between the poles sits a pattern worth knowing by name. A watch-only setup holds addresses and public keys — everything needed to display, monitor and reconcile — and no private keys at all. For services, this separation is how you build a receiving side that can be exposed to the internet without putting money within reach of what touches it: the server shows deposit addresses and watches the chain, while the authority to move funds lives offline. For individuals, a watch-only view on a phone plus signing keys elsewhere gives everyday convenience without everyday exposure.
It is also a diligence instrument. A counterparty that can demonstrate watch-only receiving — addresses visible, balances trackable, signing provably elsewhere — has aligned its architecture with your interests rather than merely claiming to. The pattern is the organising idea behind non-custodial deal formats, where the operator holds receiving addresses but the customer’s funds are matched rather than pooled; the custody terms shelf of this glossary unpacks the vocabulary, and live examples of the deal format are described on UsdtChange .
The seed: the point of no delegation
Under every self-custody arrangement sits the seed phrase: the words from which every key derives. Its possession is literally the possession of the funds, on any compatible software, forever — which makes it the one artefact in this field that cannot be delegated, insured informally, or recovered by anyone’s support team. Every security habit in self-custody is a habit about these words: offline generation, multiple separated backups, and an absolute refusal to let the phrase be readable by software or photographed by anybody, including you in a hurry.
The rule that deserves framing on a wall: no legitimate service, support agent, “verification system”, “migration tool” or “staking activation” will ever need your seed phrase — because possessing it makes you redundant. Every request for the phrase is the same fraud wearing different uniforms. Internalise that, and the single most successful attack category in the entire industry simply stops applying to you.
Choosing a point on the spectrum
There is no universal right answer, only a fit between a person’s habits and a structure’s failure modes. The disciplined questions are: What happens if I make a mistake? What happens if the counterparty makes a mistake or disappears? What happens if I am attacked through my devices? A custody choice that has survived all three questions in writing is a plan; one that has never faced them is a hope.
A workable default for many people is a layered one: operational funds with a service whose custody story you can articulate, reserves in self-custody with redundant offline backups, and a watch-only view for monitoring both. Revisit the arrangement yearly — not because the technology changes fast, but because your life does: moves, households, devices and habits quietly invalidate old assumptions about where things are and who could reach them.
Frequently asked questions
Does self-custody mean I cannot ever use exchanges?
No. Layered custody is the practical default: operational floats where convenience matters, reserves in self-custody where sovereignty matters. The mistake is not using a custodian; it is not knowing which funds are custodial.
Is a hardware wallet automatically cold storage?
Only if the seed was generated on the device and the backups live offline. A hardware wallet whose phrase was typed into any computer during setup is a hot wallet with a nice case.
What is the single most valuable custody habit?
Never letting the seed phrase exist anywhere software can read it — no photos, no cloud, no password managers. That one rule neutralises the most common loss scenarios.
Related shelves
Custody terms: hot and cold wallets, watch-only, seed phrases
Custody is the oldest question in money wearing new clothes: who can actually move the funds? Five entries that turn marketing phrases like “your coins are safe with us” into a question with a checkable answer.
Learn moreSecurity terms: AML, KYC, risk scoring, frozen addresses
The vocabulary of money’s immune system. These are not laws you feel directly — they are procedures applied to you invisibly, and reading them in advance is the difference between a routine exchange and an unexpected rejection.
Learn more