Custodial vs non-custodial wallet: who holds the keys and who carries the risk

A custodial wallet leaves the private keys with a company, so your balance is a claim that depends on that company staying solvent and honest; a non-custodial wallet gives you the keys, so access depends on your own backups.

By Sonic Wallet Editorial Team· Updated · 9 min read

Key takeaways

  • A custodial wallet is an account where an exchange or other company holds the private keys and owes you the coins; a non-custodial wallet keeps the keys on your own device and backup. Custody trades control for convenience and password resets, while self-custody removes company failure risk but leaves theft, loss and inheritance entirely to you.
  • In a custodian's bankruptcy, the account terms decide whose coins they are. In January 2023 a federal judge ruled that about $4.2 billion held in Celsius Earn accounts belonged to Celsius, which left those customers as unsecured creditors.
  • FTX valued claims in dollars at November 2022 prices, about $16,872 per bitcoin, so payouts of 105% to 120% of a claim by July 2026 were still far below what the same coin was worth in 2026.
  • Mt. Gox shut in February 2014 with about 850,000 bitcoin reported missing. Creditors received their first repayments in bitcoin and bitcoin cash in July 2024, more than ten years later, and the trustee's deadline now runs to October 31, 2027.
  • Neither FDIC insurance nor SIPC covers crypto held at an exchange, and self-custody has no help desk: a lost recovery phrase means lost coins. Wherever the keys sit, crypto is volatile and can fall by most or all of its value.

Every crypto balance comes down to one question: who can sign for the coins? With a custodial wallet, a company holds the private keys and shows you a number it owes you. With a non-custodial wallet, usually called self-custody, the keys sit on your own phone, computer or hardware device, and nobody else can move the coins or give them back. Neither choice shields you from price swings: crypto is volatile and can lose most or all of its value. The crypto hub covers the wider basics of buying and holding.

What is the difference between a custodial and a non-custodial wallet?

A custodial wallet is an account where a company controls the private keys for you, while a non-custodial wallet is software or hardware where only you control them.

The coins never sit inside either kind of wallet. They are entries on a public ledger, and a private key is what authorizes moving them; how blockchains work explains that ledger. When an exchange holds the key, the figure on your screen comes from the company's internal books, and the coins behind it usually sit in shared wallets alongside other customers' holdings. When you hold the key, your balance is read straight from the chain, and nothing moves until your own device signs a transaction.

Custodial services include crypto exchanges, brokerage and payment apps that sell crypto, crypto lenders and trust companies that safeguard coins for clients. Using one means relying on that firm staying secure, open and solvent, a point the SEC's December 2025 custody bulletin makes directly.

Non-custodial wallets come as phone or desktop apps, browser extensions, dedicated hardware devices and multisignature setups that need several keys to approve a payment. Most create a backup of between 12 and 24 words under the BIP-39 standard, and entering those words into another compatible app restores the same wallet, coins included. Wallets built on multi-party computation replace that single word list with key shares held on separate devices or by separate parties; the seed phrase vs MPC comparison weighs those two designs.

How do custodial and non-custodial wallets compare?

They differ on five practical points: who controls the coins, how you recover access, what attackers target, how easy daily use is and where you stand in a bankruptcy.

Custodial walletNon-custodial wallet
ControlThe company holds the keys and can delay, limit or block withdrawals under its termsOnly someone with your keys or recovery phrase can move the coins
RecoveryPassword resets and identity checks through customer supportOnly from your own recovery phrase backup; no reset exists
What attackers targetThe platform's wallets, plus your login, email and phone numberYour recovery phrase, your devices and the transactions you approve
ConvenienceBuy and sell with dollars, trade instantly, nothing to back upYou manage backups, network fees and address checks, and need a separate step to turn coins into dollars
Legal position if the company failsSet by the terms: you may own specific coins held for you, or be an unsecured creditor in a court processNo company in the middle; a wallet maker going out of business does not touch the coins
Federal protectionFDIC insurance and SIPC do not cover crypto held at an exchangeNone; losses from theft or mistakes fall on you
InheritanceHeirs usually claim the account with a death certificate and estate documentsHeirs need the phrase and instructions; without them the coins are unreachable

Recovery is where the two diverge most. A custodial account behaves like online banking: forget the password and support can restore access once it has checked your identity. A self-custody wallet has no equivalent. FINRA's guide to storing crypto warns that losing a private key, or having it stolen, can cost you access to the assets, and no one can issue a replacement.

Hacking risk moves rather than disappears. An exchange concentrates many customers' coins in one place, which makes it a prize: in February 2025 the FBI attributed the theft of about $1.5 billion in virtual assets from a single exchange to North Korean hackers. A self-custody holder is a smaller target, but attackers go after the person directly, with fake support agents, look-alike apps and messages asking for the recovery phrase. The CFTC's advice is short: never give your private key or seed phrase to anyone. Crypto scams walks through the common scripts.

Legal standing is the row people skip until it matters. A custodian's terms of service say whether coins are held for you or become the company's property once deposited, and that wording shaped the outcome in every recent bankruptcy. Whether crypto is safe on an exchange explains pooled wallets, proof of reserves and how courts have read those terms.

What happened to customers when Mt. Gox, FTX and Celsius failed?

In all three, customers became creditors in court proceedings that lasted years, and what they recovered depended on the platform's terms and how claims were valued.

Mt. GoxFTXCelsius
Withdrawals stoppedFebruary 2014November 8, 2022June 2022
Court processTokyo bankruptcy from 2014, converted to civil rehabilitation in June 2018Chapter 11 in Delaware from November 11, 2022Chapter 11 in New York from July 2022
What was missingAbout 850,000 bitcoin at first, about 650,000 after a March 2014 findMore than $8 billion of customer money, according to federal prosecutorsAbout $4.2 billion in Earn accounts that the court ruled belonged to Celsius
How claims were valuedBitcoin claims repaid partly in bitcoin and bitcoin cash after 2018In dollars at petition-date pricesIn dollars at petition-date prices, paid in crypto or cash
Repayments beganJuly 202420252024
Recovered so farLargely complete for creditors who finished the paperwork; deadline extended to October 31, 2027105% to 120% of claim value by July 2026About 72.1% of claim value for eligible creditors by February 2026

Mt. Gox, 2014

The Tokyo-based bitcoin exchange closed its site on February 25, 2014 and applied for court protection three days later, saying about 750,000 customer bitcoins and 100,000 of its own had disappeared. In March it reported finding 199,999.99 bitcoin, cutting the shortfall to roughly 650,000. Reuters reported that the bankruptcy valued each bitcoin at about $483 for claims. The June 2018 switch to civil rehabilitation meant bitcoin claims no longer had to be converted into money, and repayments in bitcoin and bitcoin cash finally began on July 5, 2024. In October 2026 the trustee moved the last deadline to October 31, 2027 for creditors still completing the process.

FTX, 2022

FTX paused all customer withdrawals on November 8, 2022, according to the SEC's complaint, and filed for Chapter 11 three days later. Prosecutors said the founder took more than $8 billion of customer money; a jury convicted him and in March 2024 he received a 25-year sentence. The repayment plan took effect on January 3, 2025 and fixed every claim in dollars at petition-date prices, with bitcoin at $16,871.63. By the latest payout, customers had received 105% of allowed customer claims, or 120% for convenience claims of $50,000 or less, as of the fifth distribution on July 31, 2026.

Celsius, 2022

Celsius, which paid interest on deposited coins, froze withdrawals in June 2022 and filed for bankruptcy the next month. About 600,000 Earn accounts held roughly $4.2 billion of crypto, and on January 4, 2023 the court ruled that under the Terms of Use those coins had become Celsius's property. Customers whose coins had only ever sat in a separate custody program were allowed to withdraw them. The plan took effect on January 31, 2024, and Earn customers and other eligible creditors have since received about 72.1% of the petition-date value of eligible claims, including Earn claims, after the fourth distribution in February 2026.

Worked example: One bitcoin left on FTX versus one bitcoin in self-custody

A customer holding exactly 1 bitcoin on FTX when it filed had a claim fixed at the petition-date price:

  • Claim: 1 × $16,871.63 = $16,871.63
  • That is under the $50,000 convenience-claim limit, so the cumulative 120% payout applies: $16,871.63 × 1.20 = $20,245.96
  • A customer with 4 bitcoin had a claim of $67,486.52, above the limit, so 105% applies: $67,486.52 × 1.05 = $70,860.85

Those payments arrived in dollars during 2025 and 2026. The same coin kept in a self-custody wallet would be worth $78,218.70 (Nov 2, 2026) today, but only if its owner kept the backup safe and never approved a malicious transaction. Bitcoin's price moves sharply in both directions, so that figure can be far lower when you read it, and a self-custody holder whose backup failed would have recovered nothing at all.

When does each type of wallet make sense?

Custody tends to fit balances you trade often or need to turn into dollars quickly, and self-custody tends to fit holdings you plan to keep and can secure yourself.

Three questions settle most cases. How much is at stake compared with what you could absorb if a platform froze for two years? Can you keep a written backup offline, check addresses character by character and spot phishing? And who would need access if you died or became incapacitated? A large balance held for years points toward self-custody; frequent trading, a small balance or low confidence with backups points toward a custodian.

If you stay custodial, the company's structure matters more than its app: who licenses and examines it, whether its terms hold coins for you, and whether it can lend or pledge them without asking.

Custody or self-custody: questions to answer first

  • Would losing access to this balance for two years or more, as FTX and Celsius customers did, cause real hardship?
  • Do the custodian's terms say it holds your coins for you, or does ownership pass to the company?
  • Does the platform lend, stake or pledge customer assets, and can you opt out?
  • Can you keep a recovery phrase offline in two separate places that would survive a fire or burglary?
  • Will you check the full receiving address on a trusted screen before every transfer?
  • Do you trade or cash out often enough that withdrawal fees and delays would matter?
  • Would an heir know where the backup is and how to use it?
  • Is the amount large enough to justify a hardware wallet or a multisignature setup?

What are the risks of custodial and non-custodial wallets?

Custodial risk is mostly about the company, through fraud, hacks, frozen withdrawals and bankruptcy, while self-custody risk is mostly about you, through lost backups, phishing and malware.

On the custodial side:

  • Misuse of deposits. A platform can lend, pledge or simply take customer coins, as prosecutors said happened at FTX, and customers may not learn of it until withdrawals stop.
  • Frozen access. Account reviews, court orders or a platform-wide halt can lock a balance for months or years.
  • Thin legal protection. FDIC insurance does not cover crypto or the failure of a crypto company, and SIPC does not protect digital assets that are not securities. FDIC vs SIPC explains what each program does cover.
  • Account takeover. A stolen password or a hijacked phone number can let a thief withdraw from your account, so your email and phone security matter as much as the platform's.

On the self-custody side:

  • No recovery. A lost phrase, or a broken device without a backup, means the coins are gone for good.
  • Social engineering. Fake support agents, counterfeit wallet apps and websites that ask for the phrase empty wallets every day.
  • Mistaken sends. A transfer to the wrong address or network usually cannot be reversed; sent crypto to the wrong network covers the cases where something can be done.
  • Inheritance gaps. Coins can be stranded permanently if heirs cannot find or use the keys; crypto inheritance planning covers wills, letters of instruction and access.

One risk appears in both columns. Crypto prices are volatile, and a coin can lose most or all of its value whichever wallet holds it; storage decides who can reach the coins, not what they are worth.

Can you use custody and self-custody together?

Yes: a common split keeps an exchange account for buying, selling and converting to dollars, and moves coins meant for long holding into a wallet you control.

The handoff between the two is where mistakes happen. Withdraw to an address generated by your own wallet, on a network that wallet supports, and send a small test amount before the rest. Note each withdrawal's date, amount and fee, since your records are what tie a coin's purchase price to the wallet that now holds it. How to store crypto safely sets out a layered plan for deciding how much sits where, and hot vs cold wallets compares the kinds of self-custody wallet. Before moving or selling, the crypto profit calculator shows the gain or loss on a position at today's price.

Frequently asked questions

Is a non-custodial wallet safer than an exchange account?+

It removes the risk of a company freezing, losing or misusing your coins, but adds the risk of your own mistakes. Self-custody is safer only with an offline backup, careful address checks and resistance to phishing; without those habits, an exchange account can carry less risk.

What happens if the company behind a non-custodial wallet app shuts down?+

Your coins stay on the blockchain. Because most wallets follow the BIP-39 standard, typing the same recovery phrase into another compatible wallet restores access, which is why the phrase, not the app, is the thing to protect.

Can an exchange freeze a custodial account?+

Yes. A custodian can hold withdrawals from one account during identity or fraud reviews, obey a court order, or halt the whole platform in a crisis, as Celsius did in June 2022 and FTX did on November 8, 2022.

Is a custodial wallet the same thing as an exchange account?+

Usually, but not only. Brokerage and payment apps, crypto lenders and trust companies can also hold keys for customers. A quick test: if the company can reset your password and still move your coins, the arrangement is custodial.

How do heirs get into a non-custodial wallet?+

Only through the recovery phrase, any passphrase and the instructions the owner left. There is no account for an executor to close or claim, so the location of the backup and who may use it need planning in advance.

Sources

  1. Crypto Asset Custody Basics for Retail Investors: Investor Bulletin, SEC Office of Investor Education and Advocacy (Investor.gov)
  2. Storing Crypto Assets, FINRA
  3. 14 Digital Asset Risks to Remember, Commodity Futures Trading Commission
  4. In re Celsius Network LLC, No. 22-10964 (MG): memorandum opinion on ownership of Earn account assets, US Bankruptcy Court, Southern District of New York
  5. Announcement regarding application for commencement of a procedure of civil rehabilitation, Mt. Gox Co., Ltd.
  6. Announcement regarding the bitcoins held by MtGox, Mt. Gox Co., Ltd.
  7. Announcement regarding commencement of civil rehabilitation proceedings, Mt. Gox rehabilitation trustee
  8. Announcement regarding repayments in bitcoin and bitcoin cash, Mt. Gox rehabilitation trustee
  9. Announcement regarding change of the deadlines for repayments, Mt. Gox rehabilitation trustee
  10. The Mt. Gox bankruptcy: special report, Reuters
  11. SEC v. Samuel Bankman-Fried, complaint, US Securities and Exchange Commission
  12. Samuel Bankman-Fried Sentenced To 25 Years In Prison, US Attorney's Office, Southern District of New York
  13. FTX Trading Ltd. case information and plan documents, Kroll Restructuring Administration
  14. North Korea Responsible for $1.5 Billion Virtual Asset Theft (PSA I-022625-PSA), FBI Internet Crime Complaint Center
  15. What SIPC Protects, Securities Investor Protection Corporation
  16. Fact Sheet: What the Public Needs to Know About FDIC Deposit Insurance and Crypto Companies, FDIC
  17. BIP 39: Mnemonic code for generating deterministic keys, Bitcoin Improvement Proposals (GitHub)
  18. FTX Announces Fifth Distribution of Approximately $900 Million to Creditors on July 31, 2026, FTX Recovery Trust (PR Newswire)
  19. Notice of Fourth Distribution (Celsius Network LLC, Case No. 22-10964), US Bankruptcy Court, SDNY (via Stretto)

Related guides