“Not Your Keys, Not Your Crypto” Cuts Both Ways

"Not your keys, not your crypto" has long been one of the defining mantras of the Web3 space. Blockchain was built around decentralization, and handing keys over to a custody provider introduces counterparty risk.

If you control your own keys, then you're fully in control over the security of your Web3 accounts and the assets that they hold. However, this has its downsides.

The Dark Side of Self Custody

Self custody aligns with the self-reliant ethos of Bitcoin and the wider Web3 ecosystem. However, managing your own keys has its risks, including:

• Lost Keys: If you've securely generated and stored your private keys, then they're functionally impossible to brute force. However, this cuts both ways. If keys are lost, then they're lost forever. This is one of the main selling points of custody providers and Ethereum's Account Abstraction (which allows social recovery).
• Vulnerable Hardware Wallets: Self custody best practices require storing keys on a hardware wallet that never touches an Internet-connected device (e.g. cold storage). However, the approximately $130 million Coldcard incident of July 2026 demonstrates the risks of this. An error in random number generation on the devices resulted in weak private keys that attackers could guess and use to drain affected wallets.
• "Wrench" Attacks: Hardware wallet providers can be a supply chain risk even if they don't have vulnerable code. In 2026 alone, Ledger, Trezor, and SafePal all reported breaches of third-party vendors that exposed the home addresses of hardware wallet owners. In the first half of 2026 (before the Trezor and SafePal incidents), Chainalysis reported over $30 million in crypto stolen via physical violence.

What's the Greater Risk?

Self custody is commonly marketed as being safer than entrusting cryptocurrency to an exchange. More technical Web3 users commonly prefer it because it offers full control over their digital assets and reduces counterparty risk.

However, self custody also comes with various risks, including counterparty risks. While it doesn't involve trusting a custodian, it does involve trusting the manufacturer of the hardware wallet, their shipping partners, etc.

At the end of the day, self custody and exchange custody both carry risks, but the risks differ. However, in the event that an incident involving a custodial provider results in lost crypto, often the organization will take action to make its customers whole (if they have the resources to do so). In contrast, self custody often leaves owners on their own with no recourse if something goes wrong.

Educational content, not legal, financial, investment, or professional security advice. Terms