Custody terms: hot and cold wallets, watch-only, seed phrases

Custodial versus non-custodial

One sentence: a custodial setup means someone else can move your money without asking you, and a non-custodial one means nobody can — including, on your bad days, you.

The long read. The dividing line is not branding; it is the location of the ability to sign. If a service holds the keys, your access is a policy — revocable, delayable, and hostage to the service’s fortunes, its compliance queue and its solvency. If the keys are yours, your access is physics: a seed phrase that works the same on your best and worst days, and whose loss no customer-support department can undo. Neither pole is “safe” in the abstract — they distribute risk differently, between counterparty failure and self-inflicted failure.

The honest self-assessment is which failure mode you are better equipped to survive. Someone who can store a phrase offline, in redundancy, for years is a natural fit for self-custody; someone who has twice locked themselves out of an email account may be handing a fortune to a probability. The middle path many services take — holding receiving addresses while never holding signing keys — is described in the custody long read in our guides, and it is the pattern worth recognising on any exchange venue you meet.

Hot wallet

One sentence: a hot wallet is one connected to the internet, trading convenience for exposure.

The long read. Hot wallets live where the work is: they sign frequently, they are reachable from anywhere, and their security is therefore the security of a door that is used a hundred times a day. Every practical operation — receiving, routing, paying out — runs through hot storage, which makes it both indispensable and the natural target. The history of exchange failures is, to a first approximation, the history of hot wallets: the overwhelming majority of large losses were not cryptography broken but operational hygiene failing — keys reachable, approvals too broad, humans bribed or fooled.

For a user evaluating a service, the useful question is not “do you have a hot wallet” — everyone does — but what fraction of holdings lives there and what the turnover discipline looks like. A well-run operation keeps hot balances small relative to flows and sweeps the rest somewhere colder. That architecture, not a logo or a promise, is what limits the blast radius of the next bad day, and a service that cannot articulate it has told you something important by omission.

Cold wallet

One sentence: a cold wallet keeps signing keys away from any network, so moving funds requires deliberate human action on offline media.

The long read. Cold storage converts speed into safety. A key that has never touched an internet-connected machine cannot be reached by anything that travels the internet — which is a nearly complete defence against remote attack, paid for in minutes-to-hours of operational delay. The classic implementations are hardware devices and paper or steel backups, and the design discipline is boringly physical: keys generated offline, backups in separated locations, and procedures that assume any single copy can be lost, found by the wrong person, or destroyed.

The irony of cold storage is that its strongest property is also its least convenient: the delay that protects you from attackers also protects you from your own panic. Institutional practice embraces this deliberately — large movements requiring multiple people and physical presence — because the scenarios cold storage defends against are precisely the ones where speed is the enemy. For an individual, even a minimal version (one offline backup, stored where neither fire nor landlord nor memory can lose it) already places you ahead of most of the field.

Watch-only wallet

One sentence: a watch-only wallet displays addresses and balances without holding any ability to spend from them.

The long read. Watch-only is the pattern of a shop window: everything is on display, nothing is for the taking. The software holds public keys — enough to derive addresses, track incoming transactions and reconcile accounts — and holds no private keys at all, which means a compromised watch-only setup leaks information, not money. In service operations this is how receiving sides are usually built: a server can show customers their deposit addresses, monitor the chain for arrivals, and trigger the next step of a workflow, while the authority to move anything lives elsewhere, offline.

The same pattern works privately. A wallet you keep in view on an everyday device, with spending keys stored elsewhere, gets you convenient monitoring without a convenient heist. The term also clarifies what to ask of a counterparty: a service that can show you balances and addresses while demonstrably not being able to sign has aligned its architecture with your interests — a property worth more than any insurance badge, and one that the non-custodial deal descriptions on UsdtChange use as their organising principle.

Seed phrase

One sentence: a seed phrase is the compact sequence of words from which an entire wallet’s keys are derived, and it is the last word in every custody question.

The long read. The seed is the point where friendly interfaces dissolve into raw mathematics: a list of ordinary words that deterministically expands into every key and address a wallet will ever produce for you. Possession of the phrase is possession of the funds — not metaphorically but mechanically, on any compatible software, anywhere, forever. This is why every serious security conversation about self-custody reduces to the storage of one artefact, and why the phrase’s brevity, which looks like a convenience, is its most dangerous property: it fits in a photograph, a screenshot, a cloud note, and travels through all of them at the speed of a mistake.

The handling rules that follow are unfashionably physical. The phrase is written or engraved, offline, in more than one location, and it never lives where it can be read by software: no cloud sync, no password manager note, no “temporary” photo. Anyone who asks you to type a seed phrase into a website — for “verification”, “migration”, or “staking activation” — is running the oldest and most reliable fraud in the field, because no legitimate service has any use for it. That single rule, kept without exceptions, neutralises an entire category of attack.

The shelf in one glance

Custody is one question asked five ways: who can sign? Custodial services answer “we can”; hot wallets answer “anything online can, quickly”; cold wallets answer “almost nobody can, slowly”; watch-only answers “nobody here can, by design”; and the seed phrase answers “whoever holds the words can, always”. Learn the answers a venue gives before you care about its rates.

• Custodial — your access is a policy, not a property.
• Hot wallet — speed and exposure in one package.
• Cold wallet — delay as a defence.
• Watch-only — a window, not a vault door.
• Seed phrase — the words that are the money.