In a non-custodial (self-custody, or "unhosted") wallet, you hold the private keys and nobody else does. The keys authorize transactions. No company can freeze, reverse or recover your transfers, but no company can restore your access either. The SEC's December 2025 investor bulletin on crypto custody puts it this way: you have "sole responsibility for keeping track of the private keys and seed phrases for your crypto assets. If these keys or phrases are lost or stolen, you may lose access to your crypto assets."
What a wallet actually holds
A wallet does not hold coins. In the words of the SEC bulletin, crypto wallets "do not store crypto assets themselves; instead, they store the 'private keys' or passcodes for your crypto assets." The assets are recorded on the blockchain. Whoever holds the key can move them.
US regulators use the same idea when they define the term. FinCEN's December 2020 proposed rule describes people who "store the private key in a software program or written record, often referred to as an 'unhosted wallet'". It contrasts this with wallets where a financial institution conducts the transactions.
How the keys are made
Most modern wallets follow two Bitcoin standards that other chains have widely adopted:
- BIP-39 (the seed phrase). The wallet generates random entropy of 128 to 256 bits and encodes it as 12, 15, 18, 21 or 24 words drawn from a list of 2,048. An optional passphrase can be added. The words are then run through PBKDF2 with HMAC-SHA512 and 2,048 iterations to produce a 512-bit seed.
- BIP-32 (the key tree). This standard describes "a system for deriving a tree of keypairs from a single seed." One seed phrase can therefore restore every address the wallet has created.
In practice, the seed phrase is the master copy of all the keys. Anyone who has the words can rebuild the wallet on another device, and that includes a thief.
Custodial and non-custodial: the trade-off
| Custodial (third-party) | Non-custodial (self-custody) | |
|---|---|---|
| Who holds the keys | The custodian | You |
| Main way to lose access | The custodian "is hacked, shuts down, or enters bankruptcy" (SEC bulletin, as reported) | Your keys or seed phrase are lost or stolen |
| Recovery if you forget credentials | Usually possible through the provider | Only from your own seed phrase backup |
| Use of your assets by others | Some custodians lend customer assets ("rehypothecation") or pool them (SEC bulletin, as reported) | None, unless you sign a transaction or approval yourself |
Both models can use hot wallets (connected to the internet) and cold wallets (kept offline). The SEC describes a cold wallet as "typically a physical device that is not connected to the internet, such as a USB drive, external hard drive, or even a piece of paper." Cold wallets are "generally more secure from cyberthreats than hot wallets." The bulletin adds that the devices "can be lost, damaged, or stolen, which may result in a permanent loss of your crypto assets."
Could you lose access to your self-custody wallet?
Answer five questions about how you hold your keys to see which failure mode from this article applies to you.
Who holds the private keys that authorize your transactions?
- A custodian (a third party holds them for me) → Your risk sits with the custodian
- I do (self-custody, unhosted wallet) → next question
Have you written down your seed phrase offline and stored it somewhere secure?
- No, the wallet lives only on my device → One lost device away from losing everything
- Yes → next question
Have you signed token approvals or connected your wallet to sites and contracts you did not check first?
- Yes, or I am not sure → Old approvals may still be live
- No, I read what each approval allows before signing → next question
If something happened to you, could the people who come after you find the backup?
- No, only I know where it is → Your heirs cannot reach the funds
- Yes, I have planned for that → You have covered the failure modes in this article
You can usually recover forgotten credentials through the provider. You can still lose access if the custodian is hacked, shuts down or enters bankruptcy, and some custodians lend or pool customer assets (SEC bulletin, as reported).
If the device is lost or damaged and there is no seed phrase backup, no one can restore access. The SEC says to store your seed phrase in a secure place and not share it with anyone.
Anyone who has the words can rebuild the wallet on another device, including a thief. The FBI describes scam sites that ask for seed phrases and advises against answering requests for them that you did not start.
An ERC-20 approval lets the spender withdraw from your account multiple times, up to the approved amount, without asking again. IC3 describes drainer contracts that moved victims' crypto and NFTs after they connected their wallets.
Self-custody has no institution that can hand access to your heirs. Without the backup, they cannot reach the funds.
Keep checking each wallet domain and download source, and keep reading what every transaction or approval allows before you sign it.
This walks through the failure modes the article describes for US regulators and Bitcoin and Ethereum standards only; it cannot check your actual wallet, approvals or backup, and rules in other countries differ.
The latest regulatory change: FinCEN withdraws the unhosted-wallet rule
On October 5, 2026, FinCEN announced that it was withdrawing its December 2020 proposal. That proposal would have imposed "recordkeeping, verification, and reporting requirements" on certain transactions involving unhosted wallets. The withdrawal notice appeared in the Federal Register on October 6, 2026 (FR Doc. 2026-20430). The proposal never became final. It would have made banks and money services businesses report transactions above $10,000 with an unhosted wallet counterparty, and keep records and verify identity above $3,000. FinCEN withdrew a 2023 proposal on crypto mixing on the same day.
Using your own wallet was never the target. FinCEN's 2020 proposal restated its position that "a person conducting a transaction through an unhosted wallet to purchase goods or services on their own behalf is not a money transmitter." Businesses that move value for third parties remain money transmitters even if they use unhosted wallets. The withdrawal applies only in the US. Rules for transfers between service providers and self-hosted wallets differ in other jurisdictions.
How self-custody actually fails
These are the most common ways self-custody fails, according to the sources below:
- A lost or damaged backup. If the device is lost or damaged and there is no seed phrase backup, no one can restore access.
- Seed phrase phishing. A June 2025 FBI alert on fake NFT airdrops describes scam sites that ask users to "input their login and security information, including seed phrases." It advises against answering requests for "passwords, seed phrases, or one-time passwords" if you did not start the contact.
- Malicious approvals. On Ethereum-style tokens, the ERC-20
approvefunction "allows_spenderto withdraw from your account multiple times, up to the_valueamount." If you sign an approval for a hostile contract, it can move your tokens later without asking you again. An August 2023 IC3 alert describes victims who "connect their cryptocurrency wallets to a drainer smart contract," which then moved their crypto and NFTs to criminal-controlled wallets. - Fake sites and apps. The same alert tells users to check for misspelled domains and extra characters in URLs, and to make sure a site "is real and not a clone of the legitimate website." A separate August 2023 IC3 alert on fake mobile apps advises: "Restrict app permissions and uninstall apps you do not use."
Practical checklist
- Write down the seed phrase offline and store it somewhere secure. The SEC says: "Store your seed phrase in a secure place and do not share it with anyone."
- No legitimate support agent, airdrop or game needs your seed phrase. Treat any request for it as an attack.
- Read what a transaction or approval allows before you sign it. A token approval can outlast the session in which you granted it.
- Download wallet software only from the developer's verified site or official app store listing, and check the domain each time.
- Plan for the people who come after you. Self-custody has no institution that can hand access to your heirs. Without the backup, they cannot reach the funds.
Limitations: this article covers US regulators and Bitcoin and Ethereum standards. Wallet designs and rules in other countries differ.
Related reading: how a Bitcoin transaction is signed, broadcast and confirmed and what Web3 is and what happens if keys are lost.
