Self-Custody vs Custodial Wallets: Keeping Your Stablecoins Safe

The crypto slogan says "not your keys, not your coins". It is true, and it is also the reason many people have lost money. Holding your own keys protects you from a failing exchange, but it makes you the bank, the security guard and the customer helpline all at once. For someone who just wants to receive dollars from a client abroad or keep savings in a stable currency, the right answer usually sits somewhere in between. Here is how to think about it.

The two basic models

Every wallet answers one question: who controls the private key that authorises spending?

• Custodial. A company holds the keys and shows you a balance, like a bank. Exchanges and most payment apps work this way. If you forget your password, you reset it. If the company fails or freezes your account, you may be stuck.
• Self-custody. You hold the key, traditionally backed up as a 12- or 24-word seed phrase. Nobody can freeze or lose your funds except you. Nobody can rescue you either.

Why custodial risk is real

The case for self-custody was written in late 2022. FTX, valued at up to $32 billion earlier that year, collapsed after it emerged that customer money had been funnelled to its trading affiliate. Its founder was later convicted of defrauding customers of at least $8 billion, as Reuters reported. Customers who thought they owned coins on the platform were in fact unsecured creditors.

Exchanges are also targets. In February 2025 attackers linked to North Korea stole about $1.5 billion from the exchange Bybit by tampering with the web interface of the multi-signature wallet software its staff used, so that signers approved a transaction that looked routine, according to The Hacker News. The method is a warning for anyone who approves transactions on a screen.

Why self-custody risk is real too

Chainalysis counted 158,000 compromises of personal wallets in 2025, affecting at least 80,000 people and costing them about $713 million, according to The Block. Most were not clever hacks. They were phishing links, fake support agents, malicious browser extensions and seed phrases typed into the wrong website. A delivery rider in Sharjah who keeps his seed phrase in a photo on his phone is one cloud-account breach away from losing everything.

Most people do not lose crypto to hackers. They lose it to a convincing message and a moment of hurry.

The middle ground: MPC and smart wallets

The good news is that wallet design has moved on from "one secret phrase or nothing". Two technologies now give regular people self-custody with safety nets.

MPC wallets

Multi-party computation splits the key into several shares held on different devices or servers. As Fireblocks explains, the full key is never assembled in one place; signing a payment requires several shares to cooperate, so stealing one share is useless. Consumer MPC wallets typically keep one share on your phone and another with the provider or in your cloud backup, letting you recover access without a seed phrase while the provider still cannot move funds alone.

Smart wallets

Smart contract wallets turn the account itself into a small program with rules. Coinbase launched one in June 2024 that uses passkeys, the same fingerprint or face login your phone uses for websites, instead of a seed phrase. Since Ethereum's Pectra upgrade in May 2025, ordinary accounts can also borrow smart-wallet features. These wallets can add spending limits, trusted contacts who help you recover, and sponsored fees so you do not need to hold a separate token for gas.

There is a caution here. When the Pectra feature went live, security researchers flagged that a large share of early delegations were linked to phishing contracts. New powers create new tricks.

Which is right for you?

Many people sensibly use two: a regulated custodial app for day-to-day sending and cashing out, and a self-custody wallet for savings. If you are holding stablecoins, check what your custodian does with them and whether it is licensed where you live; stablecoin laws now set rules for reserves and redemption, covered in our GENIUS and MiCA guide.

Security habits that actually work

1. Never type a seed phrase into a website or share it with anyone. No real support agent will ask for it.
2. Store backups offline. Paper or metal in a safe place, not a screenshot, email or notes app.
3. Turn on app-based two-factor authentication for any custodial account, and avoid SMS codes where you can.
4. Check addresses and amounts on the device screen before approving, especially for large transfers. The Bybit theft worked because signers trusted what a compromised interface showed them.
5. Send a small test first to any new address.
6. Revoke old approvals you have given to apps and do not sign messages you do not understand.
7. Be suspicious of urgency. Fake investment platforms and "recovery services" are among the most common scams; see our money transfer scams guide.

The direction of travel is encouraging. Passkeys, MPC and recovery contacts are making self-custody feel more like a normal app, while regulation is making custodians more accountable. The goal for most people is not maximum control. It is a setup where one mistake does not cost you everything. If you are new to stablecoins, start with what a stablecoin is.

This guide is general information, not a recommendation of any wallet or provider.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →