Self custody vs exchange decides who holds the keys, who can authorize transfers, and who must recover access after a failure. Self-custody puts that burden on you; an exchange assigns key control to the provider.
A crypto wallet does not hold coins in the way a physical wallet holds cash. It holds the credentials used to access and move assets recorded on a blockchain. The SEC’s Office of Investor Education and Assistance explains that the private key authorizes transactions, while the public key can receive assets and verify activity. That distinction is the foundation for comparing self-custody with an account at an exchange.
Source date: This explainer reflects the SEC staff bulletin on crypto-asset custody published December 12, 2025. Product terms, legal status, and customer protections can change, so check a provider’s current disclosures before acting.
The short version
With self-custody, you control the wallet’s private keys. You do not need an exchange to approve a transfer, but you also take responsibility for backups, device security, and recovery.
With an exchange account, the provider normally controls the private keys for assets held on the platform. You sign in with an account credential and ask the provider to execute withdrawals or trades. That may simplify access and support, but it adds dependence on the provider’s systems, policies, and financial condition.
Neither arrangement removes risk. It moves risk to a different place.
What control actually means
A private key is the credential that authorizes a blockchain transaction. It cannot usually be reset like an ordinary account password. Many self-custody wallets therefore create a seed phrase, a set of words that can restore the wallet if the original device or software is lost.
That seed phrase is effectively a master recovery secret. Anyone who obtains it may be able to recreate the wallet and move its assets. If the owner loses both the working wallet and every valid backup, there may be no help desk capable of restoring access.
An exchange account changes the interface. The customer uses a username, password, and often multi-factor authentication. The provider manages the underlying wallets and controls the private keys. A password-reset process may restore account access, but only while the provider is operating and willing and able to honor the request.
If the mechanics of public and private keys are unfamiliar, start with WPBV Radio’s plain-language guide to crypto wallet keys and coins.
What can go wrong with self-custody
Self-custody removes the need to trust a custodian with transaction authority. It does not remove operational mistakes.
Common failure points include:
- losing the seed phrase or private key;
- storing the recovery phrase where it can be stolen, photographed, or copied;
- signing a malicious transaction after following a phishing link;
- sending assets to the wrong address or an incompatible network;
- losing or damaging a hardware wallet without a tested backup;
- leaving a software wallet on a compromised device.
The SEC staff bulletin distinguishes hot wallets, which are connected to the internet, from cold wallets, which are generally kept offline. Hot wallets can be easier to use but remain exposed to online threats. Cold storage can reduce some online exposure, yet a physical device can still be lost, damaged, or stolen.
Cold storage is therefore not a substitute for a recovery plan. A sensible plan answers three questions before funds arrive: where the recovery material is stored, who can access it, and how restoration would be tested without exposing the secret.
What can go wrong with an exchange account
An exchange can provide familiar account recovery, customer support, and a consolidated interface. The trade-off is that the customer depends on the provider for access and execution.
The SEC bulletin asks investors to examine whether a custodian uses hot or cold storage, subcontracts custody, commingles customer assets, lends or otherwise uses deposited assets, and charges withdrawal or transfer fees. It also advises asking what happens if the custodian is hacked, shuts down, or enters bankruptcy.
Those questions matter because an exchange balance is not the same thing as personally controlling a private key. A provider may pause withdrawals, restrict an account, suffer an outage, or fail. The legal treatment of customer assets can depend on the account agreement, the provider’s structure, and the jurisdiction.
Do not assume that the protections attached to a bank deposit or a conventional brokerage account automatically apply to a crypto platform. Investor.gov has warned that many crypto-asset entities do not provide the protections associated with registered broker-dealers or insured banks. Check the provider’s current registrations and disclosures rather than relying on a logo or a generic claim of “insurance.”
A practical comparison
| Question | Self-custody | Exchange account |
|---|---|---|
| Who controls the private keys? | The user | Usually the provider |
| Who approves a transfer? | The wallet holder | The provider after account authentication |
| Can a password reset restore access? | Usually no; recovery depends on the seed phrase or backup | Often, while the provider and account-recovery process are available |
| Main operational risk | Lost or stolen secrets, malicious signing, device failure | Provider failure, account restriction, withdrawal limits, compromised credentials |
| Main dependency | The user’s security and recovery process | The provider’s security, policies, liquidity, and legal obligations |
| Typical convenience | More setup and responsibility | Easier account access and support |
This table is a starting point, not a verdict. A person can also use both arrangements for different purposes, but that creates two sets of controls to maintain.
Questions to ask before choosing
For self-custody:
- Can you explain the recovery process without opening the wallet?
- Is the seed phrase stored offline and away from cameras, cloud notes, and shared devices?
- Is there a second, geographically separate backup?
- Have you verified the receiving address and network before a meaningful transfer?
- Does anyone else need a documented inheritance or emergency-access process?
For an exchange account:
- Which legal entity holds the account, and in which jurisdiction?
- Who actually holds the private keys?
- Are customer assets segregated or commingled?
- Can the provider lend, pledge, or otherwise use deposited assets?
- What are the withdrawal limits, delays, and fees?
- What protection applies after theft, insolvency, or a shutdown?
- Is strong multi-factor authentication available, and can account-recovery settings be locked down?
A small test transfer can confirm that an address, network, and withdrawal process work as expected. It does not prove that a platform is solvent or that a recovery plan will work years later.
The decision is about failure ownership
The cleanest way to compare the two models is to ask who owns each failure.
Self-custody gives the user direct authority and direct responsibility. An exchange account delegates key control and creates a claim on a provider’s systems and procedures. The convenient option can still be fragile; the independent option can still be badly operated.
Choose only after you can describe the failure path in one sentence: “If I lose access, this is the exact person, secret, device, or process that can restore it.” If that sentence is vague, the custody setup is not finished.
Primary sources
- SEC Office of Investor Education and Assistance: Crypto Asset Custody Basics for Retail Investors, December 12, 2025.
- Investor.gov: Exercise Caution with Crypto Asset Securities, March 23, 2023.
This article is educational and is not investment, legal, or tax advice.
