Custodial or self-custody wallet: how to choose

Every crypto balance is controlled by a private key, a long secret number that signs transactions. The choice between a custodial and a self-custody wallet is really a choice about who holds that key. In a custodial setup, a company keeps the keys and gives you an account with a username and a password. In self-custody, the key lives in an app or a device that you control, and the company that made the app never sees it. Beginners often meet both ideas at the same moment, because an exchange account and a wallet app look similar on a phone screen. Underneath, the two work in very different ways, and the difference decides what happens when something goes wrong.

With a custodial account, you log in, and the company moves assets on your behalf. If you forget the password, the company can run an identity check and reset it, because it holds the keys and knows who you are. The price of that convenience is trust. The assets sit under the company's systems, and a freeze, a hack or an insolvency on its side affects your balance too. With self-custody, the wallet creates a recovery phrase, a list of words that can rebuild the keys on any device. Nobody sits between you and the funds, so no one needs to approve a transfer. The same fact means no one can reverse a mistaken one.

Picture a first-time user named Dana who has only ever used a company-run account. She installs a wallet app on her phone, writes the twelve recovery words on paper and moves a small test transfer into it. A few weeks later her phone falls into a lake. Dana installs the app on a new phone, enters the words, and her balance reappears. Her neighbor Omar did not write his words down. When his laptop failed, his wallet failed with it. He contacted the app maker, which explained politely that it had never held his keys and had nothing to reset. Both people used self-custody. Only one had a working backup.

Each model has its own typical mistakes. In custody, people reuse a weak password, skip two-factor authentication on the account and its email, or assume the company would make them whole after a loss. In self-custody, the usual errors are photographing the recovery phrase, storing it in an email draft, typing it into a fake website that copies a real one, or never testing the backup. Scammers target both groups. They send messages that pose as support staff and ask for a login code or for the recovery phrase. A real support team never needs the phrase, because the app can check your account without it. Anyone who asks for it is trying to empty the wallet, whatever logo appears on the message.

A few checks help before any deposit. Who holds the keys, the company or you? What do the written terms say about recovery if you lose access, and about what happens to your balance if the company closes or freezes accounts? Is two-factor authentication available through an authenticator app or a hardware key rather than text messages? For a wallet you control, where will the recovery phrase live, in how many places, and have you restored from it on a spare device once? Can you find the app only through the developer's official website? Some people split their holdings between the two models. That is a personal arrangement, and this page does not recommend one.

Plain-language explanations of wallets and their recovery rules are published by ethereum.org, in its wallet guide and its community support FAQ. Both are worth reading before choosing a setup, because they describe how access is lost and why nobody can restore it afterwards, a risk that applies to self-custody in particular and, in a different form, to company accounts. This page is general education and cannot say which arrangement suits your circumstances. Legal protection for a company-run account differs from one country to another, and so do the rules that apply to the firm itself, so check what applies where you live through your own financial authority. Nothing here is financial, legal or tax advice, and no setup removes the need to protect passwords and recovery words.

• The core question is who holds the private key: a company in custody, or you in self-custody
• A company can reset a lost password; with self-custody only the recovery phrase restores access
• Test the backup on a spare device and never share the phrase, whoever claims to be support