Custody and Keys
Whoever controls the private key controls the asset. There is no institution positioned to reverse a transfer, restore access or adjudicate a dispute.
MadStockAlerts Research · Updated August 29, 2026
What to take away
- A private key authorises transfers; possession of it is effectively ownership.
- Self-custody means no recovery mechanism if the key is lost.
- Custodial holding replaces key risk with counterparty risk.
- Transfers are final, and an address typed incorrectly is generally unrecoverable.
- The protections described elsewhere in this library largely do not apply here.
MAD Academy Training Video · 0:45
The Key Is the Asset
Ownership is possession of a private key, which makes self-custody genuinely final in both directions.
This lesson is part of a Stock Alerts + Tools plan.
The two arrangements
| Self-custody | Custodial | |
|---|---|---|
| Who holds the key | You | The platform |
| Primary risk | Losing the key, or having it stolen | The platform failing or misusing assets |
| Recovery if access is lost | None, beyond your own backup | An account recovery process |
| Reversal of an erroneous transfer | None | Occasionally possible if it stayed internal |
| Exposure in an insolvency | None to a platform | You are a creditor, and the outcome depends on the law |
The trade-off is genuine and there is no arrangement that avoids both risks. Self-custody removes counterparty exposure and places the entire operational burden on the holder; custodial holding does the reverse.
What finality means in practice
A transfer confirmed on a public chain is not reversible by anyone. There is no institution with the authority to unwind it, and no process equivalent to a chargeback or a payment recall.
- An address entered incorrectly sends the asset to that address, which may be controlled by nobody.
- A transfer sent on the wrong network can be unrecoverable even where the address looks valid.
- A transfer induced by fraud is as final as any other.
- Support at a platform can help with internal balances and cannot alter a confirmed on-chain transaction.
This is the single largest practical difference from a brokerage account, and it is the reason the fraud material in this library applies here with the recovery routes removed.
How keys are held
| Method | Characteristic |
|---|---|
| Hardware device | The key never leaves the device; transactions are signed on it |
| Software wallet | Key held on a general-purpose device, and exposed to its compromises |
| Recovery phrase on paper or metal | The key material in human-readable form; possession is control |
| Multi-signature | Several keys required to authorise, which removes any single point of failure |
| Custodial account | No key held by the user at all |
The third row is the most consequential and the most mishandled. A recovery phrase is the asset. Anyone who reads it can take everything, and any request to enter one anywhere is a request for the asset itself.
Which protections apply
- Deposit insurance does not apply. These are not bank deposits.
- Securities investor protection applies to securities held at a registered broker-dealer, which most crypto platforms are not.
- Private insurance carried by a platform is a commercial policy with its own terms and limits, and it is not a protection scheme.
- Where a platform holds assets in its own name rather than segregating them, holders may be unsecured creditors in an insolvency.
The last item has been tested. Insolvencies in the sector have turned account holders into unsecured creditors, with recoveries determined by bankruptcy proceedings years later, which is a materially different position from holding securities at a broker.
The operational failures that actually occur
Losses in self-custody are dominated by a small number of failure modes, none of which involve the cryptography being broken.
- A recovery phrase lost, destroyed, or stored where it could not be found later.
- A recovery phrase entered into a fraudulent site or application that requested it.
- A device compromised by software that had access to the key material.
- A transfer sent to a wrong or malformed address, or on the wrong network.
- A single point of failure: one phrase, one location, one person who knew where it was.
The second item is the most common current form and it is entirely social. No legitimate service, wallet or support process ever needs a recovery phrase, and any request for one is a request for the assets.
The last item is also an estate question. Assets in self-custody with no documented recovery path are unrecoverable by anyone else, which is a consideration with no equivalent in a brokerage account.