Self-custody, explained

Self-custody means the private keys that control your crypto are in your hands, in a wallet only you can sign from, rather than held by an exchange on your behalf. The SEC’s December 2025 investor bulletin on crypto custody frames it as a choice between sole control with sole responsibility, and a professional custodian that manages the keys for you.

What is a non-custodial wallet?

In a non-custodial wallet you control the private keys yourself, rather than entrusting them to a custodian. “Self-custody wallet” means the same thing. It can be a phone app or browser extension (hot) or a hardware device (cold); the SEC notes that hot and cold options exist for both self-custody and third-party custody. The difference between those two is in cold wallet vs hot wallet.

A custodial wallet is really an account. An exchange or custody provider controls the keys and shows you a balance; you log in with a password, and if you forget it, the provider may restore access, subject to its account-recovery checks.

Some non-custodial products add optional recovery services that bring third parties back into the picture. Ledger Recover is a paid, optional subscription: the device’s secure element encrypts and splits a copy of the seed into three fragments held by Coincover, Ledger and EscrowTech, and restoring requires an ID check and two of the three fragments. Your keys are still yours, but your backup now also depends on those companies. Tangem goes the other way: its seedless setup, Tangem says, leaves no copies outside its cards, so the backup is a second or third card.

Custodial vs non-custodial: what changes?

	Custodial (exchange or custodian)	Non-custodial (self-custody)
Who holds the keys	The custodian	You
Forgotten password or lost phone	The provider may restore access, subject to its checks	You restore from your own backup
If the company is hacked, shuts down or goes bankrupt	You may lose access, per the SEC	Recovery depends on your backup format, any passphrase and compatible recovery tools; a seedless card backup depends on the maker’s supported devices
Use of your coins	Some custodians lend them out or commingle them, per the SEC	You authorize transactions, but a leaked key or a permission you granted can still put funds at risk
Fees	Account, transaction and transfer fees vary	Network fees, plus any device, app or optional service you pay for

Custodian failure is a documented risk. In December 2022 the SEC charged FTX’s former CEO, alleging the undisclosed diversion of FTX customers’ funds to Alameda Research, his crypto hedge fund.

Self-custody does not make you anonymous, though. Buying a hardware wallet creates an order record, and those records leak: Ledger customer contact and order data was accessed in 2020, and on 5 January 2026 Global-e, which handled some Ledger.com orders, notified affected customers that names, contact details and order details had been accessed in its systems. Ledger’s FAQ on the Global-e incident warns that scammers draw on many data sources for phishing campaigns targeting Ledger.

What are you responsible for with self-custody?

You manage key security and recovery yourself. A wallet maker’s support can explain procedures, but it cannot replace a missing recovery secret unless you use a recovery service that covers it.

1. Starting from a genuine device. In 2021 Kraken rebuilt a reported attack in which an unsolicited, modified Ledger Nano X carried a fake app built to trick victims into entering their seed phrase. Buy from the maker or an authorized reseller and run its genuineness check, such as Trezor’s device authentication.
2. Following the maker’s advisories. In July 2026 Coinkite warned of weakened seed generation in affected COLDCARD firmware, including the COLDCARD Q. A firmware update does not repair an existing seed; Coinkite tells affected owners to move funds to a new one.
3. Keeping the backup. Bitcoin.org’s security page suggests copies in more than one physical place on durable media, and warns that any backup stored online is highly vulnerable to theft. If you add a BIP39 passphrase, the standard says every passphrase produces a valid wallet but only the correct one opens yours, so a forgotten passphrase is as final as a lost phrase. Details in our seed phrase guide.
4. Checking what you sign. Confirm addresses on the device screen, not the computer’s. Trezor’s trusted display guide also sets the limit: the device cannot tell you whether an address someone gave you is the right one.
5. Refusing every request for the phrase. Trezor says no one legitimate will ever ask for your backup. Its own support channels were abused for phishing in January 2024 and June 2025, as listed on the Trezor Safe 3 datasheet.
6. Planning for someone else to take over. See the next section.

How do you plan inheritance for self-custodied crypto?

Heirs need to know the assets exist, find the backup, and know how to use it. Anything that makes this easy for heirs can make it easy for a thief, so plans balance the two. Common building blocks:

• Written instructions, kept apart from the phrase. Name the device, the app and the coins, and say where the backup is. Keep the phrase itself out of a will: in New York, once a will is admitted to probate it becomes a public document that anyone can see. Rules differ by state and country, so ask an estate lawyer where you live.
• Split backups. SLIP-39 splits a secret into shares, and a minimum number of them rebuilds it. Trezor’s Multi-share Backup on the Safe 3, Safe 5 and Safe 7 allows up to 16 shares per backup with a threshold such as 3 of 5; one share alone cannot reach the funds. Trezor says firmware older than 2.7.2 does not support Multi-share Backup, so check firmware and backup compatibility before a recovery. The Keystone 3 Pro and OneKey Pro also support SLIP-39. Heirs then need a SLIP-39 compatible wallet, since the standard says SLIP-39 and BIP39 are for the most part not compatible.
• Multisig. Several keys, on different devices or with different people, must sign together. Ledger supports Bitcoin multisig through compatible coordinator software; Trezor supports it through third-party software, not directly in Trezor Suite; Coinkite, Keystone and BitBox list multisig for the COLDCARD Q, Keystone 3 Pro and BitBox02 Nova Multi. OneKey names Ethereum Safe, Solana Squads and Bitcoin Sparrow Wallet as multisig options for the OneKey Pro, and Blockstream names Sparrow, Specter and Nunchuk for Jade Plus multisig; we have not tested these integrations. Trezor notes that SLIP-39 shares are not multisig.
• Backup cards or services. Tangem sells two-card and three-card sets, so one card can be stored elsewhere. Ledger Recover ties restoration to the subscriber’s identity verification.
• The passphrase, if you use one. It is a second secret heirs will also need.

Whatever you choose, rehearse the recovery on a spare device with a small amount so you know the instructions work.

Is self-custody safer than keeping crypto on an exchange?

It swaps one set of risks for another. You remove the custodian’s risks: a hack of the platform, a shutdown, a bankruptcy, your coins being lent out. You take on your own: a lost backup, a phishing message that works, an address you did not check. The SEC bulletin warns that with self-custody, lost, stolen, damaged or hacked wallets may mean permanent loss, and asks whether you are comfortable with the technical setup. Which set of risks you prefer is your call.

Is there a best non-custodial wallet?

No single wallet suits everyone, but you can compare them on criteria:

• Backup format. BIP39 phrases restore widely; SLIP-39 shares need SLIP-39 support; Tangem’s seedless mode has no phrase at all unless you choose one.
• Code openness. Trezor states its firmware is open source; Ledger says 95% of its code is open source and/or available; Tangem’s firmware is closed.
• Recovery options. Shamir shares, multisig, backup cards or a service like Ledger Recover.
• Coins. Coinkite sells the COLDCARD Q as Bitcoin-only. Blockstream describes the Jade Plus as Bitcoin-only with Liquid Network support; we have not verified its Liquid asset handling.
• The maker’s record. Our datasheets list the dated incidents we found and what was fixed.

Start with the wallet database, then Ledger vs Trezor, Tangem vs Ledger, COLDCARD vs Trezor and choosing a hardware wallet.

How do you move from an exchange to self-custody?

Set up the wallet from a genuine device following the maker’s current firmware instructions, write the backup offline, request a receive address and confirm it on the device screen (or by the maker’s documented check if there is none), send a small test amount, then the rest. Ask the exchange about withdrawal fees first; the SEC lists asset transfer fees among the costs custodians charge. The step-by-step version is in what is a cold wallet?

What we could not verify

• The pages we checked do not state multisig support for the Tangem Wallet.
• We did not record Ledger Recover’s current subscription price, or whether heirs can use it after the subscriber’s death.
• Tangem’s FAQ gives conflicting answers on whether its app generates 12-word or 24-word phrases.