
Non-Custodial Wallet vs Custodial Wallet: Keys and Recovery
Every crypto wallet answers one question before any other: who holds the private key? With a non custodial wallet, you do, and nobody else can move the funds or restore access for you. With a custodial wallet, a provider holds the keys and gives you an account, a login and a support desk.
Neither model is safer across the board. Each moves risk to a different place, and knowing where it sits decides what you protect, back up and check.
Who holds the keys
What is a non custodial wallet? It is software or a device that generates and stores your private keys, usually backed up as a 12- or 24-word recovery phrase. Private key ownership is complete: you sign every transaction yourself, and no company can freeze, reverse or recover it. A non custodial crypto wallet can be a phone app, a browser extension or a hardware device.
What is a custodial wallet? It is an account with a service that holds the keys on your behalf, the way an exchange or a crypto service inside a payment app does. You see a balance and request transfers; the provider signs them.
Who controls private keys in a custodial wallet? The provider. Your claim is on the provider, set out in its terms, rather than direct control on the blockchain. A custodial crypto wallet feels like an app account because it is one.
A self-custody wallet is like a safe with a combination only you know: no locksmith can open it if you forget the numbers. A custodial wallet is closer to a deposit box at a secure storage company: you show identification to get in, staff can help when you lose the key card, and if the company closes its doors for a review, you wait outside.
Recovery: phrase or process
Custodial wallet recovery works like any online account. You reset a password, verify your identity and, if needed, go through support. Losing your phone is an inconvenience, not a loss.
Non custodial wallet recovery depends on one thing: the recovery phrase. Can a non custodial wallet be recovered? Yes, if you still have the phrase, which restores the keys in any compatible wallet app. Without it, no. Ethereum.org puts it plainly: without the seed phrase or private keys, funds cannot be recovered, and nobody can reset access to a self-custody wallet.
Two hypothetical cases show the gap. Mateusz in Gdańsk has his phone stolen. His 24-word phrase is stamped on a steel plate at home, so that evening he installs a wallet app on a new phone, enters the words and sees his balance. Sofia in Bologna resets her phone to fix a software bug. Her phrase was saved as a screenshot on that same phone. The coins remain visible on the blockchain and permanently out of reach.
One rule protects both models: nobody legitimate ever asks for your recovery phrase. "Recovery services" that request it are the most common way self-custody wallets get emptied.
Custody is not hot or cold storage
Is non custodial the same as cold storage? No. Custody is about who holds the keys; hot and cold describe whether those keys sit on an internet-connected device. A phone wallet is non-custodial and hot. A large exchange keeps most client funds in cold storage and is still custodial. Our separate guide to hot and cold wallets covers the connectivity side.
The difference showed in February 2025, when attackers took roughly €1.4 billion in ether from a major exchange's cold wallet. According to Spain's national cybersecurity institute INCIBE, it was the largest crypto theft on record; the FBI attributed it to North Korean hackers, who manipulated the interface staff used to approve a routine transfer. The keys were offline. The weak point was the process of signing with them, and the exchange's customers depended on the company absorbing the loss.
Provider and operational risks
Wallet custody models fail in different ways, so compare the right risks:
| Custodial wallet | Non-custodial wallet | |
|---|---|---|
| Who holds the keys | The provider | You |
| Recovery | Account reset and identity checks | Recovery phrase only |
| Main risk | Provider hack, insolvency, frozen account | Lost phrase, phishing, wrong address |
| Identity checks | Required by regulated providers | None for the wallet itself |
| Who can stop a transfer | The provider | Nobody once signed |
Custody models compared by key control, recovery and the risk each places on the user.
Source: Ethereum.org, 2026; EUR-Lex summary of Regulation (EU) 2023/1113, 2024
What happens if a custodial provider blocks access? You cannot move the assets until the block is lifted. Providers restrict accounts during identity reviews, sanctions screening, suspected fraud or technical incidents, and the timeline follows their terms and any legal process.
Do custodial wallets require KYC? With regulated providers in the EU, yes. They must identify customers under anti-money-laundering rules, and under Regulation (EU) 2023/1113 they collect sender and recipient details for crypto transfers. For transfers above €1,000 to or from a self-hosted wallet, the provider must check that the address belongs to its customer.
Using both models
Can I use both custody models? Yes, and many people do. A hypothetical freelance developer in Porto receives client payments in USDC to a self-custody wallet she controls. When she needs euros, she sends part of it to a custodial service that converts crypto. Because the transfer is above €1,000, the service asks her to prove she owns the sending address, by signing a message or making a small test transfer, and to confirm whose wallet it is. Her savings stay in self-custody; only what she converts passes through a provider.
The same custodial vs non custodial wallet split appears in payment apps that offer crypto through an integrated service. In that setup, a partner provides the custodial crypto wallets. Your euros sit in an e-money account; your crypto sits in the partner's custodial wallets. To spend crypto, you first sell it for euros in the integrated service, the euros land in your payment account, and you pay or send SEPA transfers from there. An app like this is not a self-custody wallet and does not hold a recovery phrase for you, because there is none to hold.
Key takeaways
- Custody is about who holds the keys; hot and cold describe connectivity.
- Self-custody recovery depends entirely on the recovery phrase.
- Custodial access depends on the provider's systems, terms and reviews.
- EU transfers above €1,000 involving a self-hosted wallet trigger ownership checks.
- Both models can sit side by side in one setup.
FAQ
Who controls the keys in each custody model?
In a custodial wallet, the provider. In a non-custodial wallet, you do.
How does account recovery differ from seed-based wallet recovery?
Custodial recovery is an account process with identity checks. Self-custody recovery uses only the recovery phrase; without it, access is lost.
Why is custody a different question from hot versus cold storage?
Custody is about who holds the keys, while hot and cold describe whether the keys are online. Both custodial and self-custody setups can be hot or cold.
Which provider and operational risks should you compare?
For providers: hacks, insolvency and account restrictions. For self-custody: lost phrases, phishing and transfers to wrong addresses.
What happens if you lose recovery material for a self-custody wallet?
If the device still works, move the funds to a new wallet with a new backup at once. If both are gone, the funds cannot be recovered.
How can both custody models fit into one crypto setup?
Keep long-term holdings in self-custody and use a custodial service for conversion, expecting ownership checks above €1,000.
How are a payment app's euro account and partner-provided custodial crypto service separated?
In such apps, euros are held in an e-money account, while crypto is held in custodial wallets provided by a partner. Crypto must be sold for euros before it can be spent with the app's card.
Is non custodial the same as cold storage?
No. A non-custodial wallet can run on an internet-connected phone, and custodial providers often use cold storage.