Who actually holds your crypto, and what happens if they fail

The single most consequential choice in crypto is not which asset to hold. It is who holds it. Almost everything else — security practice, platform comparison, risk assessment — follows from that answer, and most people have never explicitly made it.

Two genuinely different things

In a custodial arrangement — the default on essentially every exchange — the platform holds the private keys. Your balance is an entry in that company’s database and a contractual claim against it. You are a creditor.

In a non-custodial wallet, you hold the keys. There is no claim and no counterparty, because there is nobody in between. You have possession in the only sense the network recognises.

These are not two grades of the same thing. They are different legal and technical positions that happen to display an identical number on a screen, and the number is why the distinction is so easy to miss.

What an insolvency actually looks like

When a custodian fails, the question is whether customer assets were segregated from the company’s own and how the applicable law treats them. If customer holdings are treated as the company’s property, customers become unsecured creditors — behind secured lenders, sharing whatever remains.

Three details matter more than people expect. Proceedings take years, not weeks. Claims are frequently valued in fiat at the date of the failure, so a subsequent price rise benefits the estate rather than you. And the jurisdiction governing the platform, which almost nobody checks before depositing, determines all of it.

The sector has repeatedly demonstrated that a platform can look solvent, well-capitalised and heavily used right up until it is none of those things. That is not an argument against ever using a custodian — it is an argument for knowing that you are one of its creditors while you do.

Suspended withdrawals are the early signal

Before an insolvency there is usually a withdrawal freeze, announced as a technical issue, a maintenance window or an upgrade. Sometimes that is exactly what it is. Sometimes it is the last moment at which anything could have been moved.

The distinction is not reliably visible from outside, which is precisely the problem: by the time it is unambiguous, the option has closed. Terms of service almost always reserve the right to suspend withdrawals, and reading that clause before depositing is more useful than trying to interpret an announcement afterwards.

What proof of reserves does and does not prove

Proof of reserves is the sector’s main answer to the solvency question, and it is routinely over-read.

A reserves attestation demonstrates control of assets at a moment in time, often using a cryptographic structure that lets an individual verify their own balance was included in the total. That is genuinely useful and better than nothing.

What it does not show is liabilities. A platform can hold assets matching customer balances and still be deeply insolvent if it owes more elsewhere. Without an attested liability side, a reserves proof answers half the question. It also cannot distinguish owned assets from borrowed ones moved in for the snapshot, and it says nothing about the days either side of it.

A reserves proof without a matching liabilities proof, performed by an independent party, is a marketing artefact. With both, and repeated regularly, it is a meaningful signal. Treat it as one weak positive rather than as assurance, and note that we cannot currently verify any platform’s attestation ourselves — which is why our Methodology lists reserve verification among the things we explicitly do not test.

What self-custody moves rather than removes

Holding your own keys eliminates counterparty risk completely. It does not eliminate risk; it converts it into operational risk, which people consistently underestimate because it feels controllable.

Lose the recovery phrase and the funds are unrecoverable — no support line, no reset, no exception. Sign a malicious approval and a contract can drain the wallet later, hardware wallet or not. Send to a wrong address and it is irreversible. And there is a failure mode nobody plans for: keys held solely by one person, with no documented recovery path, become permanently inaccessible if that person is incapacitated.

The honest framing is that custodial holding trusts a company’s solvency and conduct, while self-custody trusts your own processes over decades. Neither is universally correct. What is incorrect is not knowing which one you have chosen.

The middle ground most people ignore

The choice is usually presented as binary, and it is not. Splitting holdings by purpose removes most of the force of the decision: a working balance on a platform for trading or converting, and long-term holdings in self-custody that never touch an unfamiliar contract. That way an exchange failure costs you the working balance rather than everything, and a mistake in self-custody happens on the portion you were deliberate about.

For larger amounts held personally, multi-signature arrangements requiring more than one key to move funds remove the single point of failure in both directions — a stolen key is not sufficient to steal, and a lost key is not sufficient to lose. They are more complex to set up and to recover, which is a real cost, but the complexity is front-loaded and the alternative failure is permanent.

What does not work is holding a large balance on a platform indefinitely because moving it feels like effort. That is a decision by default, and it is the one that has cost people the most.

What to establish before depositing

Where the platform is incorporated and which law governs your relationship with it. Whether customer assets are segregated and whether that is stated contractually or merely in marketing. What the terms say about suspending withdrawals. Whether reserves are attested alongside liabilities, by whom, and how often. And what happens to your balance if your account is closed or restricted.

These are the fields we intend to publish for every platform we cover, sourced from the operator’s own documentation and dated, with anything unpublished marked “Not disclosed” rather than estimated. Until that data meets the standard, we publish the reasoning instead of a table — the position set out on our comparison hub.