Exchanges, Wallets, and Custody: Who Actually Controls It

This is the highest practical risk in the pillar, and it is not price risk. Transactions cannot be reversed. A lost key is a permanent loss with no institution to appeal to. A stolen key produces a transfer the network considers perfectly valid. And multiple exchanges holding client assets have failed, with clients discovering only afterwards what their legal claim was — in several cases, an unsecured claim in an insolvency. More reported crypto losses come from this layer than from the price of anything. This article explains the custody models and where each fails. It deliberately gives no operational security instructions — specific guidance would be advice, would age badly, and is exactly the kind of content fraudsters imitate. It names no exchange, wallet, or custodian.

Blockchain basics established that a valid signature is a valid transaction — the network authenticates the key, not the person. So custody is not an administrative detail behind the investment; in this asset class custody largely is the risk.

Two models, and what each one exposes you to

Self-custody means holding the private key yourself. You can transact without permission, no third party can freeze or lose your holding, and no company failure affects it. The exposures are entirely operational and entirely yours. A key lost — hardware failure, a forgotten passphrase, a destroyed backup, a death without succession arrangements — is a permanent loss of an asset that still exists and can be seen on the ledger forever, held by nobody. A key stolen, whether by malware, deception, or physical coercion, produces transfers the network will honour. A transaction sent to a wrong address is gone. There is no support line, no chargeback, and no regulator to complain to, because there is no counterparty — which is precisely what self-custody means. Custodial holding means a third party holds the keys and credits you with a balance. This removes the operational burden and reintroduces something the design was meant to eliminate: a counterparty. Four questions determine what you actually have, and they are the same questions the stablecoin article asked of an issuer, because it is the same kind of problem. Are client assets segregated from the firm's own? Is your claim a proprietary entitlement to specific assets or a general unsecured claim on the company? Is the firm regulated, where, and does that regime cover custody of these assets? And is anything verified by independent audit rather than asserted? Several failures have turned on exactly these points, with clients who believed they owned assets discovering they were creditors of an insolvent business. The industry shorthand — "not your keys, not your coins" — is accurate but incomplete, because it implies self-custody is the safe answer. Both models carry loss modes; they are simply different ones, and the honest framing is a choice between operational risk you control and counterparty risk you do not, with no third option that removes both.

Hot, cold, and the mechanics readers should recognise

A wallet does not hold assets. It holds keys and constructs transactions; the assets are ledger entries. That sounds pedantic and it prevents a real error, because it explains why moving a wallet application does not move holdings and why the keys are the only thing that matters. Hot means connected to the internet — convenient and exposed to remote compromise. Cold means kept offline, which removes remote attack and substitutes physical risks: loss, damage, theft, and the succession problem. Custodians typically use both, with the large majority offline and a working balance hot, which is why exchange compromises have often drained a fraction of holdings rather than everything. Four mechanics worth recognising. Addresses are unforgiving: a transfer to a valid but wrong address is complete and irreversible, and sending an asset to an address on the wrong network is a common way to lose it. Transaction fees are paid in the network's native coin, so a holder of a token needs the host coin to move it — people discover this when trying to exit. An exchange balance is usually not an on-chain holding. Internal trades adjust a database; nothing touches the blockchain until a withdrawal, which is why an exchange can display balances it cannot honour. And withdrawals can be suspended. Firms have halted withdrawals during stress, sometimes permanently — an ability to see a balance is not an ability to move it, and that distinction only becomes visible at the moment it matters. On regulation. Oversight attaches to firms, not to the assets, and coverage varies enormously: whether client-asset rules apply, whether a compensation scheme exists if the firm fails, whether the firm is authorised at all in the reader's jurisdiction or merely accessible from it. This is the same jurisdictional point the FX broker article identified as the single most decision-relevant fact about an account, and it applies here with more force, because deposit-style protections that readers assume from banking generally do not extend to digital-asset custody. A firm may be registered for one purpose and unregulated for custody, which is a distinction that does not survive most marketing.