This is general information about how crypto storage works. It is not investment, financial, tax or legal advice, and not a recommendation to hold any asset.
With a bank account, the bank holds your money and keeps the records, and deposit insurance backs it up within limits. With cryptocurrency, the question is different and sharper: who controls the private keys? The answer decides who can move the assets, what happens if something fails and who is responsible when it does.
The private key and what it controls
A cryptocurrency balance exists on a blockchain, and spending it requires a digital signature made with a private key. Whoever holds the key can move the assets, and anyone who does not hold it cannot. A wallet is simply software or hardware that stores keys and creates signatures.
Most wallets present the key as a recovery phrase, also called a seed phrase, usually 12 or 24 words. The phrase can regenerate the keys, so it works as a master password. If you lose it and your device fails, the assets can be unrecoverable. If someone else gets it, they can empty the wallet.
Custodial storage: the company holds the keys
When you keep crypto on an exchange or with a broker, a custodian holds the keys on your behalf, and you see a balance in an account. Signing up and logging in feels like any financial app. Recovery from a lost password is usually possible through the company’s process.
The trade-off is that you rely on the custodian. If it is hacked, mismanaged, frozen by regulators or goes bankrupt, your assets can be at risk. The collapse of the FTX exchange in November 2022 left customers unable to withdraw and became a bankruptcy case, and earlier failures such as Mt. Gox in 2014 had similar consequences. Reputable custodians publish information about security, reserves and regulatory status, and in the United States some are licensed or registered under state or federal rules, though regimes vary.
Self-custody: the keys are yours
In self-custody, you hold the keys. Common forms include:
- Software or “hot” wallets, apps on a phone or computer that are connected to the internet, which are convenient but exposed to malware and phishing.
- Hardware or “cold” wallets, dedicated devices that keep keys offline and sign transactions internally, which are generally considered stronger protection.
- Multi-signature arrangements, where more than one key is required to approve a transaction.
The upside is independence: no company can freeze or lose your assets, and you are not dependent on a platform’s solvency. The downside is that all responsibility sits with you. A mistyped address, a lost phrase, a fake app or a scam can mean permanent loss, and there is no customer-service line that can reverse a blockchain transaction.
Does insurance cover it?
Generally no, and this surprises many people. The Federal Deposit Insurance Corporation insures deposits at insured banks. It has said that its coverage does not extend to crypto assets or to the failure of non-bank companies such as crypto exchanges, custodians and wallet providers. Dollars held at a partner bank on a platform’s behalf may receive pass-through coverage under certain conditions, but that applies to the cash, not the crypto.
The Securities Investor Protection Corporation protects customers of member brokerage firms if the firm fails, but only for cash and securities, and it does not cover declines in value. The Securities and Exchange Commission’s staff has explained that non-security crypto assets fall outside that protection, and many crypto platforms are not SIPC members at all. Some exchanges or insurers offer private insurance or “protection funds,” which can be useful but are not the same as federal coverage, so check what they actually cover.
The two approaches side by side
| Custodial (exchange or broker) | Self-custody | |
|---|---|---|
| Who holds the keys | The company | You |
| Recovery if you lose access | Usually possible through the company | Often impossible without the recovery phrase |
| Main risks | Hacks, insolvency, freezes, mismanagement | Loss, theft of the phrase, scams, user error |
| Insurance | Not covered by FDIC or SIPC for crypto | None |
| Ease of use | Familiar login experience | More technical |
| Records for taxes | Provided by the platform | Mostly your responsibility |
What scams should you watch for?
Fraud thrives where transactions are irreversible. Common patterns reported by regulators such as the Federal Trade Commission include:
- Requests for your recovery phrase. No legitimate support team, wallet maker or exchange will ask for it. Anyone who does is attempting theft.
- Fake wallet or exchange apps and sites, including paid search ads that imitate real ones.
- Phishing messages claiming a problem with your account.
- Impersonation and romance or investment scams that steer victims toward sending crypto.
- “Address poisoning,” in which a scammer sends a tiny transaction from an address that resembles one you use, hoping you will copy it by mistake.
Habits that reduce risk
- Secure your accounts. Use strong, unique passwords and the strongest authentication available, such as passkeys or hardware security keys, and consider withdrawal allowlists where offered.
- Protect the phrase. Write it down offline, store it in a secure place, never photograph it or type it into a website, and consider the question of who could access it in an emergency.
- Test first. Send a small amount before a large transfer, and double-check addresses.
- Do not keep more on a hot wallet or exchange than you are prepared to lose.
- Buy hardware wallets from the maker, not a reseller, and update software through official channels.
- Be ready for a breach. If an account is exposed, the steps in what to do after a data breach apply, including changing passwords and watching for follow-up scams.
Whatever the choice, it helps to understand the asset itself. How Bitcoin works explains what the keys actually unlock.
Sources: Federal Deposit Insurance Corporation; Securities Investor Protection Corporation; U.S. Securities and Exchange Commission; Federal Trade Commission; U.S. Bankruptcy Court for the District of Delaware
