Crypto wallets: custodial vs. non-custodial

When you buy cryptocurrency, the first practical decision is not which asset to choose but where it will be kept. There are two models: let a company hold the keys for you (a custodial wallet) or hold them yourself (a non-custodial wallet, also called self-custody).

Neither is safe by nature. Each trades one type of risk for another. This article explains the mechanism, the documented cases in which each model failed and what Brazilian regulation now requires of custody service providers.

What a wallet actually stores

Coins are not “inside” the wallet. They are recorded on the blockchain, which is public. What the wallet stores is the private key: a secret number that lets you sign transactions and therefore move the funds. If you need a refresher on how signatures and records work, see how the Bitcoin blockchain works.

The technical report by NIST, the U.S. standards institute, sums up the point in two sentences. If a private key is lost, the assets associated with it are lost, because it is computationally infeasible to regenerate it. If the key is stolen, the attacker gains full access to the assets it controls (NISTIR 8202, section 3.4.1, October 2018).

The same document notes that when a news story says a cryptocurrency “was stolen”, it almost always means that private keys were obtained and used, not that the network itself was compromised. That is why the discussion about wallets is, at bottom, a discussion about who holds the keys.

Ethereum’s documentation makes a useful distinction: the account is the key pair recorded on the network; the wallet is just the interface you use to operate it. In the page’s words, “an account is not a wallet” (ethereum.org, Ethereum accounts). You can switch wallet apps without switching accounts, as long as you take the key with you.

Recovery phrases and HD wallets

Older wallets stored loose keys, and every new key required a new backup. The Bitcoin developer guide calls this format obsolete and notes that a key created and lost before being backed up can mean funds “lost forever” (Developer Guide: Wallets).

The current standard is the hierarchical deterministic (HD) wallet, defined in BIP 32. In it, all keys derive from a single seed, organized as a tree. BIP 39 turns that seed into a list of 12 to 24 words, the recovery phrase. BIP 44 standardizes the derivation path (coin, account, address), which helps different programs find the same keys.

The practical consequence: in an HD wallet, the recovery phrase is the only backup you need. And it is also the only thing a thief needs. The Bitcoin guide also warns that different programs are not always fully compatible with each other, so it is worth noting which program and which settings generated the phrase. Protecting that phrase has its own article: how to protect a wallet’s seed phrase.

Custodial wallet: the company holds the keys

In a custodial wallet, the private keys are generated and held by a company, usually an exchange. You log in with a username and password, and the balance on the screen is an internal record of the company’s. When you request a withdrawal, it is the company that signs the transaction on the blockchain.

The advantages are concrete:

• Access recovery. Forgot your password? There is a recovery process, as with a digital bank.
• Convenience. Buying, selling and converting to Brazilian reais all happen in the same place.
• Less technical responsibility. You do not need to store a recovery phrase or understand key derivation.

The cost is dependence. Ethereum’s wallets page says that when you use a centralized exchange, you are trusting it with your funds, and that if the company runs into financial trouble, those funds may be at risk (ethereum.org, Ethereum wallets). Bitcoin.org’s security guide is more direct: when a third party controls your keys, you depend entirely on its security and honesty (Securing your wallet).

This is counterparty risk: the possibility that the other party fails through hacking, mismanagement, fraud or bankruptcy. In addition, the company can block withdrawals on its own decision, by court order or due to a regulatory requirement.

Non-custodial wallet: you keep the key

In a non-custodial wallet, the software generates the keys on your device, and the company that developed it does not receive them. Ethereum’s page states that wallet providers do not have custody of your funds and that you are responsible for keeping your keys safe (ethereum.org, Ethereum wallets).

What you gain:

• Direct control. No one can freeze, block or use your funds without your key.
• No counterparty risk over custody. If the app developer shuts down, the recovery phrase still works in another compatible program.

What you take on:

• There is no “forgot my password”. Without the key or the recovery phrase, the funds become inaccessible forever.
• Mistakes are permanent. A transaction sent to the wrong address cannot be reversed.
• You are the target of scams. Fake websites, fake support and malicious signature requests try to obtain your key or your approval. See phishing attacks on crypto wallets.
• Inheritance. Bitcoin.org points out that if no one knows where your wallets and passwords are, the funds may be lost forever (Securing your wallet).

Within self-custody there is still a choice about where the key lives: on a device connected to the internet or in an offline environment. That difference is covered in cold wallet or hot wallet.

Side-by-side comparison

Question	Custodial	Non-custodial
Who controls the private key?	The company	You
The balance you see is…	An internal record of the company	A direct record on the blockchain
Lost access?	There is a recovery process	Only the recovery phrase can help
Main risk	Counterparty: hacking, fraud, bankruptcy, freezes	Your own mistake: loss, theft or scams
Who can block withdrawals?	The company, the courts, the regulator	No one, as far as custody itself goes

When third-party custody failed

Two well-documented cases show how counterparty risk materializes.

Mt. Gox (2014). On February 28, 2014, the Japanese exchange filed for civil rehabilitation with the Tokyo District Court. In its announcement, it reported that about 750,000 bitcoins deposited by users and about 100,000 of its own bitcoins had disappeared, and attributed the loss, with high probability, to theft (MtGox, February 28, 2014). On March 20, the company said it had found about 200,000 bitcoins in an old wallet and revised its loss estimate to about 650,000, still under investigation (MtGox, March 20, 2014). Repayments to creditors in bitcoin only began in 2024, and the trustee extended the deadline for part of them to October 31, 2026 (trustee announcements).

FTX (2022). On December 13, 2022, the SEC, the U.S. securities regulator, charged the exchange’s founder, Samuel Bankman-Fried, with diverting customer funds to the investment firm Alameda Research, which was linked to him, while presenting FTX as a safe and responsible platform (SEC, December 13, 2022). In March 2024, after a jury convicted him on seven counts of fraud, he was sentenced to 25 years in prison; according to NPR, at least US$8 billion in customer funds is believed to have been diverted (NPR, March 28, 2024).

The two cases have different causes, a hack in the first and deliberate diversion in the second, but the effect on customers was the same: the balance on the screen no longer matched available assets, and recovery depended on lengthy court proceedings.

What Brazilian rules require of crypto custodians

In Brazil, virtual asset services are now regulated by the Central Bank of Brazil. BCB Resolution No. 520, of November 10, 2025, governs the establishment and operation of these providers and took effect on February 2, 2026 (art. 92). Among the points related to custody, according to the text consulted on October 8, 2026:

• Segregation. Client assets must be kept in wallets separate from those the provider uses for its own operations (art. 30, I), and the provider is prohibited from using client assets in its own operations (art. 31).
• Proof of reserves and auditing. The segregation policy must describe the proof-of-reserves methods, a mechanism for showing that the company holds the assets it claims to hold, and provide for an independent audit with a report published on the provider’s website (art. 30).
• Key custody. The provider needs documented policies for generating, holding and managing private keys; if it uses multiple or segmented keys, they must be kept in different locations (art. 49).
• Client disclosure. The custody agreement must disclose the risks of each custody method offered (art. 73). If the client opts for self-custody, the provider must explain the necessary security measures and the risks involved (art. 57, § 2).

In our newsroom’s assessment, these requirements target exactly the failures in the cases above, such as commingling of assets and lack of reserve verification. But rules do not eliminate risk: a company can still be hacked, break the rules or go bankrupt. The resolution also changes nothing for those who self-custody; in that case, security is still up to you.

How to think about the choice

There is no single answer, and this section is not a recommendation. A few questions help organize the decision:

• Can you store a recovery phrase securely, for years, without a digital copy? If the answer is no, self-custody increases the risk of loss instead of reducing it.
• How much of the value depends on a single company? With third-party custody, the key question is whether the provider is authorized and what it discloses about segregation and reserves.
• What is the money for? Bitcoin.org suggests keeping only a small amount on your phone or computer for everyday use, like cash in your pocket wallet, and storing the rest more securely (Securing your wallet).
• Who inherits? In both models, someone you trust needs to know that the assets exist and how to access them.

Remember that the custody model does not protect against price swings. Crypto assets can lose much or all of their value, regardless of where they are stored. For the broader context, see what Bitcoin is and how it works.

Key takeaways

• Whoever controls the private key controls the funds. In a custodial wallet, that is the company; in a non-custodial wallet, it is you.
• Third-party custody trades the risk of your own mistakes for counterparty risk, which has already materialized in cases such as Mt. Gox and FTX. Self-custody eliminates the counterparty but does not forgive a lost key or a scam.
• In Brazil, BCB Resolution No. 520, in force since February 2, 2026, requires segregation of client assets, proof of reserves, auditing and clear disclosure of the risks of each custody method.