Crypto wallets: exchange custody vs self-custody and seed phrases

Keys, not coins

A crypto wallet does not hold coins the way a purse holds cash. Your crypto is recorded on a blockchain; the wallet holds the keys that let you move it. Canada’s Financial Consumer Agency (FCAC) describes the two keys like this: the public key “is like an email address. You use it to receive crypto assets from other people”, while the private key “is like a password that you store in a digital wallet. You use your private key to access your accounts and to send crypto assets to other people”.

Whoever controls the private key controls the crypto. The practical question is therefore who holds it: a company, or you.

Two ways to hold crypto

The FCAC sums up the choice: “A wallet provider may manage your wallet for you through a crypto trading platform (CTP). You may also have the option of storing your wallet and managing it yourself.”

• Custodial: an exchange or app holds the keys and shows you a balance. You log in with a password and two-factor codes, and the platform’s own rules decide how you regain access if you lose them. The risk sits with the company: “If the crypto trading platform or wallet provider that has your crypto assets goes out of business or bankrupt, you may lose your money.” The UK Financial Conduct Authority (FCA) gives a real case: “In 2022, crypto lender, Celsius, filed for bankruptcy and owed its users $4.7 billion, meaning many investors could not get their money out and did not get anything back.” Platforms can also be hacked; the FCAC warns that attackers “can steal your keys and gain access to your wallets and your crypto assets.”
• Self-custody: you hold the keys in a wallet app or a hardware device. No exchange can fail with your coins inside or hold back your withdrawal (a stablecoin issuer can still freeze its own tokens at any address), but no company can rescue you either. In the FCAC’s words: “If you lose your private key, you lose access to your wallets and your funds.” The EU’s financial supervisors are blunter: “Losing private keys to crypto-assets results in the permanent and irreversible loss of access and ownership.”

Neither option is protected like a bank deposit. In the UK, for example, the FCA says it is “highly unlikely you will be covered by the Financial Services Compensation Scheme”.

Who can recover what

• Forgotten exchange password or lost phone: only the platform can restore access, under its own procedures. Keep the login email, the two-factor backup codes and your identity documents up to date.
• Exchange stops serving your country or closes: you depend on its withdrawal process and, if it fails, on insolvency proceedings. Canada’s tax agency advises crypto users to “regularly export a history of your activity” in case “the exchange ceases operating, stops offering services in Canada, or you lose access to your account” — good practice anywhere.
• Lost seed phrase and broken device (self-custody): nobody can recover the funds.
• Seed phrase seen by someone else: that person can empty the wallet from any device. Singapore Police advise that if a seed phrase has been compromised, you should “transfer all remaining assets to a new, uncompromised wallet immediately.”

The seed phrase

Many self-custody wallets show a seed phrase (also called a recovery phrase) when you create them: a list of words that can rebuild the wallet and all its keys on another device. It is the wallet. The Singapore Police Force (SPF) gives clear rules for it:

• “Legitimate wallet applications will not request your seed phrase outside of secure wallet setup or recovery processes.”
• With a hardware wallet, “Your seed phrase should only ever be entered directly on the hardware wallet device during initial setup or when recovering your wallet.”
• “Store it in physical form (e.g., written on paper) at a secure location and do not share it with anyone.”
• Real platforms do not ask for it either: the SPF says licensed crypto platforms in Singapore will never request users’ “login credentials, two-factor authentication codes, or seed/recovery phrases”, nor tell them to move their assets to another wallet “for security or investigation purposes”.

Anyone who asks for your seed phrase — someone claiming to be support staff, a website, a new online friend — is trying to take your crypto.

Hot wallets, cold wallets and signing requests

The FCAC explains: “A hot wallet is connected to the Internet. A cold wallet isn’t.” The SPF recommends: “Store cryptocurrencies in hardware wallets where possible, as these are less vulnerable to online attacks.” It adds a warning: some hardware wallets show “limited transaction details when approving signing requests”, which can lead you to approve a malicious transaction.

A wallet can be emptied without your seed phrase if you sign the wrong request. The SPF describes scams that trick people into approving a “permit signature” — “a feature that allows users to pre-authorise a future cryptocurrency transaction by signing a message off-chain” — after which scammers can move funds “without further approval, even if a hardware wallet is used.” Read every request before you approve it, and regularly revoke permissions you no longer need.

Habits that protect you

1. Keep the seed phrase offline, on paper, in a safe place — never in a photo, a chat or a cloud note.
2. Follow the FCAC’s list: “keep your wallets and any backups in a safe place”, “don’t share your private key with anyone” and use a strong password.
3. Turn on two-factor authentication everywhere; the SPF suggests “an authenticator application rather than SMS-based verification, which is more susceptible to interception.”
4. Keep your phone, computer and wallet apps updated, and avoid logging in “over public or unsecured Wi-Fi networks”, as the EU supervisors advise.
5. Before sending, check the address and the network; a blockchain transfer cannot be called back.
6. Plan for your family. The FCAC asks you to “Consider what will happen if you become ill or die and no one can access your wallets”, because “If no one knows the locations and passwords of your wallets, no one can recover the funds.”

Crypto is risky whichever way you hold it, and the rules on owning it differ by country; our “is crypto legal” pages quote what each country’s regulators say.