How noncustodial wallets transfer control and risk

Crypto wallets come in all shapes and sizes, and non-custodial wallets give you, and only you, control over your wallet's keys. (Control of the keys is not control of everything: issuers of tokens like USDT and USDC can freeze their tokens at any address, and app-level contracts can restrict transfers.)

Many wallets generate a mnemonic recovery phrase that encodes entropy used to derive a seed. That seed can deterministically derive many private keys.

A private key is secret signing material. Wallet software uses it to authorize transactions; it is not an account login.

Cryptographic signatures prove that a transaction was authorized by the holder of a key. They do not prove legal ownership or guarantee that nobody copied the key.

A public key is derived from a private key. Blockchains commonly derive an address from the public key or another account scheme; the address is the identifier users share to receive assets.

Custodial services control keys on a user's behalf. Centralized exchanges are a common example, but hosted wallets and institutional custodians also fit the category.

Regulated exchanges commonly require identity checks under know-your-customer and anti-money-laundering rules, though requirements vary by service and jurisdiction.

Using a custodian means trusting its security, solvency, controls, and legal obligations. Regulation can reduce some risks without eliminating them.

Funding methods vary. Linking a bank account can reveal related payment activity to the exchange and its banking partners.

Custodial risks

When using a centralized exchange, your funds are held in custody by the platform, which means it controls the private keys.

History has shown the vulnerabilities of this approach.

Centralized exchanges can pause trading, deposits, or withdrawals under their terms or during operational stress. A trading pause is not the same as a seizure, and the relevant controls differ by platform and asset.

The risks extend beyond temporary freezes.

Exchange wallets, which hold massive amounts of cryptocurrency, are prime targets for hackers. The Mt. Gox and QuadrigaCX disasters serve as stark reminders: Mt. Gox was hacked, while Quadriga collapsed after its founder died as the only person holding the exchange's keys (investigators later concluded it was run as a fraud). In both cases users lost their holdings.

These incidents gave birth to the crypto community's warning: "Not your keys, not your coins."

Such events undermine confidence in both the centralized crypto ecosystem and traditional finance, as users lose faith in financial intermediaries.

While centralized finance relies on trust, these failures have accelerated interest in decentralized finance (DeFi) and permissionless systems that replace some institutional dependencies with dependencies on code, networks, governance, and oracles.

Protecting recovery material

One primary risk of self-custody is losing the signing or recovery material, making your digital assets unrecoverable.

Within most user-friendly wallets, you can restore access with the mnemonic phrase even if you forget the local app password. Without the phrase, private keys, or another configured recovery method, the assets may become inaccessible.

The recovery phrase needs a secure, recoverable backup. A local wallet password protects one device or encrypted file and should not be stored beside the phrase if that would let one compromise expose both. Common practices include durable offline backups stored in separate secure locations. Encrypted digital backups may be appropriate for some threat models, but they increase exposure to device compromise, weak passwords, and cloud account recovery.

The exact amount cannot be known because an inactive key and a lost key look the same on-chain.

Self-custody can give a user direct control of blockchain keys and allow peer-to-peer transactions without an account custodian. Token issuers, interfaces, networks, and local law can still constrain what those assets can do.

Remittances

Remittances provide a useful test case for self-custody because the sender and recipient may otherwise depend on several intermediaries.

The World Bank reported $466 billion in officially recorded remittances to low- and middle-income countries in 2017.

Globally, the World Bank's second-quarter 2017 remittance-price report put the simple global average cost of sending $200 at 7.45% in the first quarter of 2017 and 7.32% in the second quarter. Applying that percentage to total flows gives scale, but it does not produce an exact aggregate fee bill because corridors, transfer sizes, and pricing methods differ.

Low-fee blockchains can reduce the network-settlement portion of a transfer. They do not remove exchange spreads, compliance costs, volatility, fraud risk, or the last-mile cost of converting digital assets into local currency.

In the World Bank's second-quarter 2017 dataset, banks were the most expensive provider type, with a simple average cost of 11.18% for sending $200.

New freedoms and new responsibilities

Non-custodial wallets enable a new level of freedom. Holding keys lets you authorize transactions without asking a custodian. It does not guarantee that every token, contract, interface, or counterparty will remain available.

A compatible wallet can call DeFi contracts without a conventional brokerage account. Access is pseudonymous at the address layer, not anonymous, and still depends on the chain, interface, assets, and user's technical ability.

Whether self-custody is safer than a custodian depends on the asset, institution, user, recovery design, and threat model. The choice involves more than bank failure versus one recovery phrase; multisignature policies, hardware wallets, insured custody, account recovery, and issuer controls produce a range of arrangements.

This article focuses on wallet custody and remittance access. For a security procedure and recovery framework, continue with Self Custody: Part 1 and Part 2.