Who owns your crypto? Private keys and custody explained
Crypto Essentials Series 2 of 6
Find out what you own when you buy crypto, which products let you withdraw it and how private keys give you control of your own wallet.
Read the infographic as text
Who can move your crypto?
Check what the buy button gives you and who can move it.
- Check what you bought
- An app can show crypto held for you or an investment linked to its price.
- Check the way out
- Some services offer a wallet withdrawal. Others let you sell for cash.
- Find who holds the keys
- A custodian handles transfers. With self-custody, you can authorise them.
- Read the terms
- The terms tell you what rights you have under the product.
Key takeaway: Check what you own, what you can withdraw and who holds the keys.
Keep private keys and recovery words secret.
An exchange can show cryptocurrency in your account and still be the only party able to move it. If the exchange freezes withdrawals or closes, the balance may remain visible while you have no way to access it.
That raises two separate questions: do you legally own the cryptocurrency, and who has the power to move it? They are not always answered by the same person or company.
What does it mean to own cryptocurrency?
Bitcoin and other cryptocurrencies are recorded on a blockchain, a shared record of transactions. A wallet lets someone receive cryptocurrency and authorise payments using secret information called a private key.
If you control the keys to your own wallet, you can normally authorise transactions without asking a company to act for you. If an exchange holds the keys, you have to ask it to process withdrawals. You may still legally own the cryptocurrency, depending on the arrangement, but you do not independently control its movement.
This is why people say “Not your keys, not your coins.” It is a warning about control and the risk of relying on a third party, not a complete statement of property law.
What happens when an exchange holds your cryptocurrency?
A custodial exchange may hold assets for many customers and record their individual entitlements in its own accounts. The balance you see when you log in tells you what the exchange records for you. It does not give you the private keys to the cryptocurrency.
If you request a withdrawal to your own wallet, the exchange has to send the transaction. It may carry out security checks, impose withdrawal limits or temporarily suspend transfers.
That dependence matters when something goes wrong. Mt. Gox collapsed in 2014. FTX collapsed in 2022 and customers lost access to withdrawals, although substantial creditor recoveries followed through its bankruptcy. Smaller exchanges can also suffer serious failures. XeggeX's disruption in 2025 showed how uncertain access and recovery can become when a platform stops functioning.
Some customers recover money or assets after insolvency proceedings. Others face significant losses. A displayed balance does not guarantee that you can withdraw the cryptocurrency or recover its value.
What changes when you control your own wallet?
With a self-custody wallet, you control the private keys used to authorise transactions. Once cryptocurrency has been transferred from an exchange into that wallet, the exchange no longer needs to approve your future payments from it.
Many wallets give you 12 or 24 recovery words when you set them up. These words are a backup that can recreate your wallet's keys on a compatible device. If you lose your phone, the words may let you regain access. If a criminal obtains them, they may be able to take the cryptocurrency.
Never share recovery words with anybody, including people claiming to offer customer support. A self-custody wallet removes dependence on an exchange for future transfers, but makes you responsible for safeguarding the keys and recovery method. Our wallet guide explains the process in detail.
What if your investment follows Bitcoin's price?
There is another important distinction. Some financial products give you exposure to cryptocurrency prices without giving you cryptocurrency you can transfer.
For example, a Bitcoin-linked exchange-traded note, or ETN, is a security bought through an investment account. Its value is linked to Bitcoin, but you own the security rather than Bitcoin in your own wallet. You would normally sell the security through your investment platform.
Other services give customers rights to cryptocurrency held by a provider, but do not permit transfers to external wallets. Those arrangements differ from price-tracking securities, and the customer's legal rights depend on the terms.
For example, Coinbase's UK agreement describes customer ownership of supported assets held in custody. Revolut's UK crypto terms describe custody and available transfers. PayPal UK's terms describe rights held through its custody arrangements and restrictions on external withdrawals.
Before buying, establish whether you will hold cryptocurrency through a custodian, be able to transfer it to your own wallet, or own a separate investment product linked to its price. Our guide to buying and cashing out crypto explains what to check.
Who legally owns the crypto?
For crypto held with a provider, start with the terms for the account you actually use. For example, section 5.19 of Coinbase’s UK user agreement says customers retain legal ownership of supported assets held in its custodial wallet. An account whose terms allow a firm to lend or otherwise use your assets can give you different rights.
The network checks whether the right keys approved a transfer. A thief with a stolen key can pass that check while the original holder still has a legal claim. In England, Wales and Northern Ireland, the Property (Digital Assets etc) Act 2025 confirms that digital assets can qualify as personal property. Who owns particular assets and what customers can recover if a provider fails depend on the facts, the terms and the applicable law.
Check how your provider holds customer assets, when it can suspend withdrawals and what its terms say happens if it fails. A published wallet balance can show assets at an address. To assess what a customer might recover, you also need to know what the firm owes and who has a claim on those assets.
What should you check before relying on a provider?
A forgotten exchange password and a lost set of wallet keys can look like the same problem on a screen. In the first case, the firm may restore access after checking your identity. In the second, a support agent cannot replace the key to an ordinary self-custody address. The backup may be the only way back in.
If you intend to hold the asset yourself, work out what happens on an ordinary bad day. A phone breaks, an app is discontinued or the person who set up the wallet is unavailable. The wallet guide explains which parts of that problem a hardware wallet, a phone app or a provider can solve. Choose the recovery arrangement before depending on it.
Sources
Related reading
Guides ·
Crypto wallets explained: what they are, how they work and which type you need
A beginner's guide to crypto wallets, recovery phrases, private keys, hot and cold wallets, and what happens when you keep crypto on an exchange.
Guides ·
How to buy and cash out crypto safely
How to use crypto on-ramps and off-ramps, compare fees, check which services operate where you live and plan a safe withdrawal.
Guides ·
What do you actually own when you buy a tokenised share?
A token can represent a company share, a claim through an intermediary or a product tracking the price. The legal rights matter more than the ticker or blockchain.
Commentary ·
Crypto's self-custody model has a physical security problem
Hardware wallet customer data breaches and physical attacks expose a costly weakness in self-custody, shifting competition towards privacy, protection and custody services.