Ledgers Academy Letter
Custody Without Slogans
A practical comparison of custodial accounts, self-custody, keys, recovery plans, and the failure modes that matter.
“Not your keys, not your coins” captures a genuine risk, but it does not complete the analysis. Custody is the problem of keeping signing authority available to the right people, unavailable to everyone else, and recoverable after predictable failures. Every custody model makes trade-offs among control, convenience, recovery, privacy, and responsibility.
What a wallet actually controls
A wallet manages the keys used to authorise transactions. Assets remain recorded by the network. Whoever can produce a valid signature can normally move them, which is why device security, backups, recovery procedures, and transaction verification matter more than the appearance of the wallet application.
A seed phrase is usually a human-readable backup from which keys can be derived. A photograph, cloud note, copied message, or exposed printout can give an attacker the same authority as the owner. A backup that nobody can find, however, is not a recovery plan.
Custodial accounts
An exchange or custodian can reset passwords, screen withdrawals, maintain institutional controls, and help an estate or organisation recover access. The customer accepts counterparty risk in return. The balance may represent a contractual claim on the operator rather than a separately identifiable on-chain asset.
The useful questions are operational: Are customer assets segregated? Who controls withdrawals? Are approvals distributed? What insurance exists, and what does it exclude? What happens during insolvency? Which jurisdiction and terms govern the claim?
Self-custody
Self-custody removes the custodian’s discretionary control but transfers the entire operating burden to the holder. Hardware wallets can isolate keys from everyday computers, yet users can still approve malicious transactions, reveal a seed phrase, lose recovery material, or rely on compromised interfaces.
For meaningful balances, the plan should cover theft, fire, device failure, incapacity, death, coercion, and software change. Multisignature arrangements can distribute authority, but poor documentation can make them harder to recover than a single key.
A custody checklist
- Define who may authorise a transfer and under which conditions.
- Separate everyday spending from long-term storage.
- Test recovery with a small amount before depending on it.
- Keep instructions and secrets separate; heirs need a process, not necessarily immediate access to keys.
- Verify destination, amount, network, and transaction details on a trusted display.
- Review the plan after changes to people, devices, providers, or software.
The best custody model is not the one with the strongest slogan. It is the one whose failure modes you understand and can realistically manage.