Whose permission moves the money?

When a company holds the keys.

On a typical custodial exchange, the company controls the on-chain wallets. Its own database keeps track of what customers are entitled to receive. Customers request transfers; the company signs them.

That company is a custodian. It may offer useful services: account recovery, trading, customer support and a familiar interface. It also adds another party whose systems and conduct you rely on.

If withdrawals stop, knowing your account password does not let you sign for the company’s coins. Your legal rights depend on the agreement and applicable law. A displayed balance alone does not tell you whether assets are segregated, lent out or available when requested.

When you control the spending authority.

With self-custody, you hold the authority needed to spend without asking a custodian to sign for you. That removes dependence on that custodian’s withdrawal desk. It does not remove every dependency or risk.

You still rely on working software, secure devices, a usable network and whatever recovery arrangement you chose. Malware, coercion, loss and a payment you regret remain possible. The market value can fall while your keys stay perfectly safe.

A simple way to compare the options is to ask where recovery comes from. A company may reset a login, but it may also fail. Your own backup may restore a lost device, but nobody can recreate a missing secret by checking your ID.

The phrase “not your keys, not your coins” highlights this difference in control. It is a useful reminder, not a complete legal analysis or proof that one setup is right for every person.

A failure has a location.

Mt. Gox stopped withdrawals in 2014. Celsius froze withdrawals in 2022. FTX collapsed later that year after customer funds had been misused. These events were failures of particular services and arrangements; they did not require Bitcoin’s signature rules to break.

That distinction matters because the fix depends on the failure. A software update cannot instantly make an insolvent exchange repay customers. Nor does a company’s collapse prove that every on-chain record vanished.

Recoveries and legal proceedings differ. Some Mt. Gox repayments came many years later. Saying every customer claim became permanently worthless would hide that reality, just as saying everyone with their own wallet “lost nothing” would hide falling prices and other risks.

Choose the arrangement before the gadget.

A hot wallet can sign on an internet-connected device. That is convenient but exposes the signing environment to online threats. Cold storage keeps signing secrets offline. A hardware wallet is one way to isolate those secrets in a dedicated signer.

Hardware reduces particular risks. It cannot protect you from every instruction you willingly approve. Read the trusted device’s display and protect its recovery material.

A multisignature arrangement can require, for example, two of three keys. One stolen key then need not be enough. But the backup plan must cover the required keys and the wallet’s configuration; complexity creates its own failure modes.

Keep experiments separate from savings where that fits your plan. Connecting a wallet to a website is not automatically permission to spend everything; the dangerous step may be a signature, transaction or token approval. Understand the specific permission before granting it.

Before choosing a setup, practice its recovery with a small test arrangement and no meaningful funds at stake. Custody is a responsibility to design, not a badge to collect.

The idea to keep

Ask who can sign, what can stop a withdrawal, and how access is recovered. Then compare the company risk with the responsibilities you would take on yourself.