How Self-Custody Crypto Wallets Actually Work
"Not your keys, not your coins" gets repeated a lot in crypto. Here's what it actually means, backed by some numbers instead of just the slogan. We looked at a few recent industry reports while writing this. Chainalysis
"Not your keys, not your coins" gets repeated a lot in crypto. Here's what it actually means, backed by some numbers instead of just the slogan.
We looked at a few recent industry reports while writing this. Chainalysis found that private key compromises accounted for the largest share of stolen crypto in 2024, at 43.8%. A mid-2025 update from the same firm found that attacks on individual wallets now make up roughly 23% of all stolen-fund activity, nearly double what it was two years prior. A separate 2025 survey of thousands of crypto users found 56.58% now prefer self-custody wallets, while 26.97% still trust exchanges to manage their assets. None of that proves self-custody is risk-free. It just shows where the risk has moved.
Your wallet doesn't hold your coins
Your balance lives on the blockchain, a public ledger every node has a copy of. Not on your phone.
What your wallet holds is a private key: a number that proves you can move funds tied to an address. The app is just a signer and a viewer.
Where the key comes from
Most wallets generate your key from a seed phrase, usually 12 or 24 words (the BIP-39 standard). That phrase can regenerate all your keys on any device.
Lose your phone but keep your phrase, and you can restore everything on a new one. The phrase is the wallet. The app is disposable.
Custodial vs. non-custodial
- Custodial (most exchanges): they hold the keys. You hold an IOU. They can freeze it, get hacked, or go under.
- Non-custodial: the key is generated and stored only on your device. The provider never has a copy and can't touch your funds even if they wanted to.
Non-custodial means more personal responsibility, but it's the only setup where you actually own the asset.
Sending a transaction, briefly
- You choose an action: send X to address Y.
- The wallet builds an unsigned transaction from public ledger data.
- The wallet signs it locally with your private key. Only the signature leaves your device, never the key.
- The signed transaction gets broadcast and verified by the network.
How to check a wallet's claims
"We never see your keys" is a checkable claim, not just marketing. Look for:
- Open source signing and key generation code
- Key generation that works fully offline
- No account, email, or KYC required to hold funds
The tradeoff
No counterparty risk, but no safety net either. Lose your seed phrase and your device, and the funds are gone for good. That's the deal self-custody makes.
Where popular wallets land on this spectrum
Not every wallet app fits neatly into custodial or non-custodial. Quick reference:
- MetaMask: non-custodial. Keys are generated and encrypted locally in the browser or app, never sent to ConsenSys.
- Exodus: non-custodial. Similar model, private keys stored locally, with a built-in exchange feature layered on top.
- Coinbase: mostly custodial by default (the main app), but Coinbase also ships a separate non-custodial product, Coinbase Wallet, which is a distinct app with its own keys.
- Shore Wallet: non-custodial, same category as MetaMask and Exodus, keys generated and stored only on-device.
The split isn't "good app vs. bad app." It's whether the product model requires holding your keys at all. Custodial platforms have real advantages, like account recovery if you lose access, which no non-custodial wallet can offer by design.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.