Who Holds Your Crypto? Custodial vs Self-Custody vs MPC

TL;DR

Crypto is held by controlling the private key that signs transactions, so in practice whoever can produce that signature controls any balance, which is a separate thing from who legally owns it. Everything else in this article follows from that one fact.
The service holds the keys and runs the security; you hold an account, a login and a claim, which means convenience and recoverability in exchange for depending on the company's honesty, solvency and defences. It is banking's model applied to crypto, with banking's strengths and fewer of its safety nets.
You hold the one key yourself, via a wallet backed up by a seed phrase, gaining full control and taking on full responsibility, and the design concentrates everything into a single secret whose loss or theft is total. The freedom is real; so is the fragility.
In well-designed arrangements it keeps self-custody while removing the single secret: the key is held as shares split across your devices and independent parties, so that no one share, device or company can move the funds alone. Whether a specific product delivers that depends on its signer combinations and recovery design, which is exactly what to check.

In one block

A custody model is the arrangement that decides who controls the key able to move your crypto. Custodial services hold keys on your behalf, so you rely on the company. Single-key self-custody puts one key, and its seed phrase backup, entirely in your hands.

What does it actually mean to hold crypto?

Quick answer

Crypto is held by controlling the private key that signs transactions, so in practice whoever can produce that signature controls any balance, which is a separate thing from who legally owns it. Everything else in this article follows from that one fact.

A quick foundation, built out fully in this academy's beginner guides. Your coins are entries on a public ledger. The ledger changes only when a valid transaction arrives, and a transaction is valid only when signed by the right private key. The network checks signatures, never passports: it cannot know or care who you are, only what you can sign.

So the question "where is my crypto" always resolves to "where is the key". If a company keeps the key, you hold crypto the way you hold money at a bank: as a claim on an institution. If you keep the key, you hold it the way you hold cash: directly, with nobody between you and it. And if the key exists as split shares, a newer arrangement this article covers third, holding becomes something subtler: authority that only exists when the right pieces cooperate.

None of these is automatically right. Banks exist because holding all your cash personally is a real burden; cash exists because relying entirely on institutions has its own history of bad days. Crypto compresses that old trade-off into a sharper form, because a crypto key is more powerful than either: whoever has it can normally move everything, quickly and, once a base-layer transfer confirms, without an easy reversal, from anywhere, though issuers, platforms and courts retain narrow exceptions. That power is what each custody model manages, and each manages it by placing it somewhere different.

How does a custodial account actually work?

Quick answer

The service holds the keys and runs the security; you hold an account, a login and a claim, which means convenience and recoverability in exchange for depending on the company's honesty, solvency and defences. It is banking's model applied to crypto, with banking's strengths and fewer of its safety nets.

When you buy crypto on a typical exchange and leave it there, no key is handed to you. The platform controls the wallets; its internal ledger records that some of what it holds is yours. Day to day this feels excellent. A forgotten password is a reset flow, buying and selling is instant, and there is a support desk with a human on it. For a beginner's first purchase, as this academy's buying guide explains, this is where nearly everyone sensibly starts.

The structure has a cost, and it should be stated plainly rather than sneered at. Your assets are only as available as the company is honest, solvent and secure. Exchange collapses have repeatedly converted customer balances into queues of creditors, most famously in 2022, when the failure of FTX stranded millions of customers; hacks and withdrawal freezes have done the same in smaller doses across the industry's whole history. Regulation is improving matters in many places, segregation of client assets, audits, capital rules, and no rule removes the basic geometry: with a custodian, someone else's failure can become your loss, without any mistake on your part.

Custodial accounts also concentrate a second risk that is yours to manage: the account itself. Anyone who takes over your login controls your claim, which is why this academy's article on two-factor authentication and SIM swaps treats exchange account security as a discipline of its own.

The fair summary: custody by a good company is a real service with a real price. It suits balances you are actively trading, amounts whose loss you could absorb, and the earliest stage of learning. The industry's honest phrase for the trade is counterparty risk, and the industry's scar tissue says take it seriously.

What is classic self-custody, and what is its famous weakness?

Quick answer

You hold the one key yourself, via a wallet backed up by a seed phrase, gaining full control and taking on full responsibility, and the design concentrates everything into a single secret whose loss or theft is total. The freedom is real; so is the fragility.

Self-custody means no company between you and the chain. A wallet on your phone, or a hardware device, holds your private key; you sign your own transactions; no one can freeze, lose or misuse your funds on your behalf. This is the arrangement crypto was invented for, and its benefits are exactly as advertised: censorship resistance, direct control, no counterparty to fail.

The classic implementation gives that control a specific shape: one key, restored by one seed phrase of twelve or twenty-four words. The seed phrase article in this cluster covers the mechanism in depth; the essential point here is what it concentrates. That one sentence restores the entire wallet, for anyone, anywhere, forever. Lose every copy and the assets are gone beyond all appeal; let one copy leak, through a photograph, a burglary, a phishing site or a coerced evening, and they are gone the other way. River's 2025 custody analysis estimates roughly 1.57 million bitcoin as likely permanently lost, while cautioning that dormancy cannot prove loss or its causes; failures of exactly this kind are the documented mechanism, case by case.

It is worth being fair in both directions. Millions of people run single-key self-custody successfully, with hardware wallets, careful backups and good habits, and the model rewards care. The critique is structural rather than moral: the design makes your worst single day, one fire, one thief, one lapse, a total event, and demands a lifetime of flawless secret-keeping from ordinary humans. The rest of this cluster, from the multisig article to the physical security piece, is largely about engineering that single point of failure out. Which is exactly where the third model comes in.

What does MPC self-custody change?

Quick answer

In well-designed arrangements it keeps self-custody while removing the single secret: the key is held as shares split across your devices and independent parties, so that no one share, device or company can move the funds alone. Whether a specific product delivers that depends on its signer combinations and recovery design, which is exactly what to check.

MPC stands for multi-party computation, and this academy has a full article building it from first principles. The practical shape, in consumer wallets, is easy to picture. The practical shape depends on two separate design choices worth keeping apart. Signing: threshold designs produce a signature without reconstructing a whole key, so no complete key is assembled at the moment of use. Setup: with distributed key generation the shares are created independently and no complete key ever exists, whereas a trusted-dealer setup generates the key and then splits it, so "no whole key ever existed" is a property of the specific ceremony to verify rather than assume. In the common consumer shape, mathematically linked shares are held in separate places, commonly a two-of-three arrangement: one share on your device, one held by the wallet provider's infrastructure, one with an independent third party or backup. Signing is then a cooperation: your device participates with one other share holder, and the mathematics produces one ordinary signature without reassembling a whole key to steal.

Walk the failure days through it. Phone destroyed? In a sound design, that share alone is useless to a thief, and you recover using the remaining shares, typically with helpers, sometimes called guardians, whose designed power is limited to confirming you are you; the shares are then refreshed so the lost one is dead. Provider disappears? A well-built arrangement gives you a recovery or export path that works without the provider, and a badly built one does not, which makes this the single most important question to ask before trusting one: exactly which combinations of parties can sign, and which can lock you out. Burglar demands the seed phrase? There is none to give, a property whose value the physical security article prices in blunt terms. In an arrangement with genuinely independent shares and a working provider-independent recovery path, no single event, company or sentence is fatal in either direction, loss or theft, which is precisely the double improvement the single-key model could not offer.

Honesty requires the other column too. MPC is an implementation you trust rather than a paper object you can look at, so the quality, audits and track record of the specific wallet matter, the same way they matter for any security software. Recovery is a designed process to understand in advance, rather than a word list to hide. And the arrangement's strength depends on its shares being genuinely independent, different devices, different parties, which good products engineer deliberately.

Classification is a facts-and-circumstances question rather than a label. The practical test is whether anyone can move your funds, or block your access, without you; a design that passes it functions as self-custody. The legal answer can differ by jurisdiction: under the EU's MiCA framework, for instance, custody turns on safekeeping or control of assets or of the means of access to them, so a provider's precise role in signing and recovery determines how it is classified, whatever the marketing says. Ask both questions of any product: the cryptographic one and the regulatory one.

How do the three models compare, and how do you choose?

Quick answer

Score each model on its worst day, and match it to what the balance means to you; each position on the spectrum suits someone, each carries its own implementation risks, and mixing models deliberately beats loyalty to any one. This guide compares structures and recommends no product.

The comparison in one view:

Question	Custodial account	Single-key self-custody	MPC self-custody
Who can move the funds?	The company (on your instruction)	Whoever has the key or seed phrase	The designed signer combinations; in sound designs, none excludes you
What restores lost access?	Password reset, support desk	The seed phrase, or nothing	Remaining shares plus recovery process
Worst single event	Company failure, freeze or hack	One secret lost or stolen	In a sound design, no single event; a weak recovery, provider or update path can still create one
Who must you trust?	The company's solvency and security	Yourself, completely and forever	The implementation, plus yourself for less
Commonly used for	On-ramps, active trading, small balances	Holders with strong operational discipline	Holders wanting self-custody without a single master secret, subject to implementation quality

Then the choosing logic, which is about honesty rather than technology. Ask of each balance: if this vanished tomorrow, what would it mean? Balances that would merely annoy can live where convenience wants them. Balances that would hurt deserve self-custody, and then the follow-up question this whole cluster keeps asking: is the arrangement's worst single day one you can survive? A single-key setup answers that with your own discipline, and the wallet comparison article shows how to strengthen it with hardware and distribution. An MPC setup answers it structurally, which is why the design has moved in a few years from institutional desks, as the key management article records, into ordinary consumer wallets.

And a closing point the industry's slogans tend to flatten. "Not your keys, not your coins" captures a real truth about custodial risk, and it was coined when the only alternative was the single key with its single sentence. The custody conversation in 2026 is better than that binary: the real spectrum runs from trusting a company, through trusting one secret, to trusting a structure where nothing is single. Knowing where each of your balances sits on that spectrum, and why, is what this article was for.

Figure from Who Holds Your Crypto? Custodial vs Self-Custody vs MPC — Figure 2. Each model's worst day: what fails, and what it costs.

Frequently asked questions

Is leaving crypto on an exchange always a mistake?

No. For active trading, small balances and first purchases it is often the practical choice, and good platforms invest heavily in security. The mistake is doing it by default rather than decision: leaving life-changing amounts exposed to a company's bad day, unexamined. Secure the account properly, know the platform's regulatory standing, and move what you are keeping long term into custody you control.

If a wallet provider holds one MPC share, is that really self-custody?

It can be, and the test is concrete rather than automatic: no combination of parties excluding you should be able to sign, the provider's share alone should be mathematically useless, and a recovery or export path should exist that does not depend on the provider's goodwill or survival. An arrangement meeting all three functions as self-custody in practice; regulatory classification can still vary by jurisdiction, since frameworks like MiCA look at control of assets or means of access rather than at labels. Ask any provider to answer all three questions in writing.

What happens to my MPC wallet if the provider shuts down?

A well-designed arrangement anticipates this: your shares and recovery path let you restore access and move funds without the provider, often through export mechanisms or guardian-based recovery. A badly designed one leaves you dependent on infrastructure that no longer exists. This is the decisive pre-purchase question for any specific product, and the answer should be concrete, documented and testable rather than reassuring.

Is a hardware wallet a fourth custody model?

No, it is equipment within self-custody: the key, still singular, lives in a dedicated offline device instead of your phone, which strengthens it against malware while leaving the seed phrase backup as the single point of failure. The wallet comparison article in this cluster covers where hardware genuinely helps and what it cannot change.

Can I combine the models?

Many holders do exactly that: a custodial account as an on-ramp and trading float, and, for those who self-custody, a distributed arrangement, MPC or multisig, for larger balances. The tiering rule from this cluster's other articles applies across models: hold in each tier only what its worst day would justify, and rehearse the recovery story of whichever model guards the most.