Custodial vs non-custodial wallets

The difference comes down to who holds the private keys, the secret numbers that authorize spending. With a custodial wallet, a company holds them and you have an account. With a non-custodial wallet, also called self-custody, you hold them yourself.

What is a custodial wallet?

A custodial wallet is an account with a business, most often a crypto exchange such as Coinbase or Kraken, or a payment app. You sign in with a password, and the company controls the keys behind the scenes. Your balance is a record in the company's own books, and the company promises to pay it out on request.

This is familiar territory. There is customer support, a forgotten password can be reset after an identity check, and buying or selling takes a few taps.

The risk is the company itself. If it is hacked, mismanaged or fraudulent, customers can be left waiting in a bankruptcy court. Mt. Gox, once the largest bitcoin exchange, failed in 2014, and FTX collapsed in November 2022. A custodian can also freeze an account or pause withdrawals. Whether any protection scheme applies is covered in Is crypto insured?

What is a non-custodial wallet?

A non-custodial wallet is an app or device that generates keys and leaves them with the user. No company can move the funds, freeze them or lose them in a bankruptcy. The wallet is backed up by a seed phrase, a list of 12 or 24 words.

The risk moves to the owner. There is no password reset. A lost seed phrase can mean permanently lost funds, and a phrase given to a scammer means stolen funds with nobody to appeal to. Inheritance is also harder, since heirs need both the keys and the knowledge to use them.

What does "not your keys, not your coins" mean?

The slogan is the self-custody camp's argument in six words. It says that a balance on an exchange is only a claim against a company, and that real ownership requires holding the keys. Each exchange failure wins it new converts.

Critics call it too simple. For many people the likelier danger is their own mistake: a discarded backup, a phishing link, a signature given to a malicious app. A custodian with a professional security team may guard keys better than a newcomer can, and large institutions commonly use one.

How do the two compare?

• Control. Custodial: the company can freeze or delay. Non-custodial: only the key holder can act.
• Recovery. Custodial: account reset through support. Non-custodial: none without the seed phrase.
• Main risk. Custodial: the company fails or is hacked. Non-custodial: the user errs or is deceived.
• Typical use. Custodial: buying, selling and trading. Non-custodial: long-term holding and using blockchain apps.

The choice is not all or nothing. Many holders use both, for different purposes.