“Not your keys, not your coins” is the most repeated sentence in crypto and one of the least examined. It is true. It is also only half of a trade, and the other half is rarely stated with the same confidence.
What custody means
When you hold crypto on an exchange, you do not hold crypto. You hold a claim against the exchange, recorded in its database. The exchange holds the assets. If it is solvent and honest, your claim is good and the arrangement is convenient. If it is not, your claim is an unsecured position in whatever process follows.
Self-custody means holding the keys yourself. There is no claim and no counterparty. The account is controlled by whoever can produce the key.
What self-custody removes
- Counterparty insolvency. No platform can lose your assets in its own failure.
- Withdrawal restrictions. Nobody can pause your access.
- Commingling. Your assets cannot be mixed with a company’s operating funds — a failure mode that has repeatedly turned a shortfall into a total loss for customers.
These are not hypothetical. Our tracker records exchange failures where the difference between segregated and commingled assets determined what customers recovered.
What self-custody adds
This is the half that gets skipped.
- You are the recovery process. There is no password reset, no support desk, no fraud team. A lost recovery phrase is a permanent loss with no appeal.
- You are the security team. Device hygiene, phishing resistance, transaction verification and backup integrity all become your responsibility.
- Mistakes are final. A transaction to a wrong address cannot be reversed by anyone.
- Inheritance becomes a real problem. Assets nobody else can access are assets nobody else will ever access.
Most losses experienced by individual self-custody users are not exotic. They are lost phrases, phishing approvals, and transactions signed without reading them.
The recovery phrase is the account
The single most important thing to internalise: your recovery phrase is the account. It is not a backup of the account, or a way to prove ownership. Anyone who has the words has the funds, immediately and irreversibly.
Everything follows from that. It never gets typed into a website. It never goes in a photo, a cloud note or an email. No legitimate support process needs it. A hardware wallet keeps the phrase off an internet-connected machine — that is the whole point of the device.
Hardware wallets: what they do and don’t do
A hardware wallet protects the key from software on your computer. It does not decide whether a transaction is a good idea; it shows you the transaction and asks. If you approve a malicious request, the device performs correctly and you lose the funds.
The Ledger Connect Kit incident illustrates this exactly: users lost funds through a compromised web front end while their hardware behaved as designed. The protection a device offers depends on someone reading its screen. See how to read a transaction before you sign it.
The honest position
Self-custody is not strictly safer. It replaces a risk you cannot control — someone else’s solvency and competence — with risks you can control but must actually control. For a person willing to learn the practices and maintain them, that trade is usually worth making. For someone who will not, a well-regulated custodian may genuinely be the lower-risk choice, and pretending otherwise has cost people their savings.
Conisec does not tell readers which to choose. That is a personal decision about your own circumstances, and it is not one a publication can make for you.
Not advice. Conisec reports for information only. Nothing in this article is financial, legal, tax or security advice. Verify against the primary sources linked above before acting on anything.
