Crypto wallets and custody: keys, seed phrases, hot and cold storage

Owning a share of stock means a broker's records say you own it, and a web of rules stands behind those records. Owning bitcoin means controlling a private key: a secret number that lets you sign transactions moving the coins. Whoever holds the key controls the coins, and there is no registrar, bank or court that can reissue it if it is lost or stolen.

So the most important decision about any crypto holding is not which coin but who holds the keys. You can hold them yourself in a software or hardware wallet, or let an exchange or a specialist custodian hold them for you. Each choice moves risk around rather than removing it: self-custody swaps the risk of a company failing for the risk of your own mistakes.

This guide explains what a wallet actually stores, how seed phrases work, the trade-offs of hot and cold storage, what happened to customers when the FTX exchange failed in 2022, and why standard US investor protections don't reach coins. It describes options; it doesn't recommend one.

What a wallet stores

When you create a wallet, it generates a pair of keys. The private key is a random secret that signs transactions. The SEC's December 2025 custody bulletin compares it to a password and stresses that once created it can't be changed or replaced. The public key, and the addresses derived from it, are what you give others so they can send you coins, much like an email address. Knowing a public key doesn't reveal the private key.

The wallet app or device is just a tool for keeping the private key safe and using it to sign. That's why a wallet can be thrown away and rebuilt elsewhere: if you still have the secret, you still have the coins. And it's why a stolen secret is so final: bitcoin.org notes that confirmed transactions can only be refunded by whoever received the funds.

Seed phrases

Most wallets now show you a seed phrase (also called a recovery or mnemonic phrase) when you set them up: a list of ordinary words that encodes the random number from which all the wallet's keys are derived. Type the same words into a compatible wallet and it recreates the same keys.

The phrase is the master key. Practical handling follows from that:

• Write it down offline and store it where fire, flood and curious visitors can't reach it. Some holders keep two copies in separate places.
• Never type it into a website, a chat or an email, and never share it with "support." No legitimate service needs it.
• Plan for inheritance. Coins whose keys die with their owner stay dormant forever.

Hot wallets and cold wallets

A hot wallet is connected to the internet: a phone app, a desktop program or a browser extension. It's quick to use and often free, which suits small balances you spend or trade. Being online is also its weakness. Malware, fake apps and phishing pages that trick you into signing a malicious transaction all target hot wallets.

A cold wallet keeps the private key on something that isn't online, usually a small hardware device, sometimes just paper. To spend, you connect or confirm on the device, which signs without exposing the key to your computer. The SEC bulletin notes cold wallets are generally more secure from cyberthreats but less convenient, and that the devices themselves can be lost, damaged or stolen. The seed phrase is the backup for exactly that case.

Many holders use both: a cold wallet for most of the balance and a hot wallet with a small amount for day-to-day use. Some go further with multisignature setups, which need two or more separate keys to approve a transfer, so that no single lost or stolen key is fatal. That adds safety and complexity in equal measure.

Letting someone else hold the keys

With third-party custody, an exchange or a dedicated custody firm holds the keys. You log in with a password and two-factor code, and if you forget the password, the firm can reset it. For trading, that convenience is hard to beat. The trade is that your claim is now on the firm, not on the coins. The SEC bulletin lists the questions worth asking before choosing one:

1. How is it regulated, and what is its complaint history?
2. What happens if it fails? Does it carry insurance for loss or theft, and on what terms?
3. Where are the keys kept, in hot or cold storage, by the firm or a subcontractor?
4. Does it use your coins? Some custodians lend deposited assets out (rehypothecation) or pool them with other customers' (commingling). Find out whether it does and whether it needs your consent.
5. What does it charge for holding, trading, and moving coins out?

What FTX showed

FTX was a crypto trading platform based in The Bahamas. In December 2022 the SEC charged its co-founder and CEO, Samuel Bankman-Fried, alleging he had concealed the diversion of FTX customers' funds to Alameda Research, his crypto trading firm, which also had a nearly unlimited line of credit funded by customers. The CFTC's parallel complaint covered conduct through November 11, 2022, and alleged the loss of over $8 billion in customer deposits.

The lesson for custody isn't about one firm. An account balance at an exchange is a promise. If the firm lends, spends or loses the coins behind the promise, the balance on the screen stays the same until withdrawals stop, and customers become creditors in a bankruptcy.

Investor protection: what does and doesn't apply

SIPC protects customers of failed member brokerage firms against the loss of missing cash and securities, up to $500,000 including $250,000 for cash. It says plainly that it does not protect any digital or crypto asset that doesn't qualify as a security under the Securities Investor Protection Act, and that unregistered digital asset investment contracts are excluded even when held by a member firm. SIPC never covers market losses in any case.

FDIC insurance covers deposits at insured banks. Coins aren't bank deposits, so it doesn't apply to them either, whatever an app's marketing implies.

One route that does keep crypto exposure inside the familiar system is a spot bitcoin exchange-traded product, which the SEC approved for listing on January 10, 2024. The fund's custodian holds the coins; you hold fund shares at your broker. The shares are securities held in a brokerage account, with that account's protections, but you can't move the underlying coins, and the SEC said its approval was not an endorsement of bitcoin. See How ETFs work: creation, redemption, NAV and the arbitrage band.

Common mistakes

• Storing the seed phrase digitally, in notes apps, photos or email, where a single account breach exposes it.
• Trusting unsolicited help. Scammers pose as wallet or exchange support and ask for the phrase or for a "verification" transaction.
• Sending to the wrong network or address. Confirmed transfers can't be recalled; test with a small amount first.
• Signing what you can't read. Approving an unfamiliar smart contract can give it control of your tokens. See Ethereum and smart contracts: how ether, gas and staking work.
• Assuming a big platform can't fail. Size didn't protect FTX's customers.

Custody options side by side

How Finabase does it

Finabase is a market-data app: it never holds coins or keys and has no wallet or exchange features. It shows prices. The crypto list covers about 50 coins priced in US dollars as .X symbols, and each, such as BTC.X, has a quote page with a chart and news. If you use a self-custody wallet, the price in Finabase is a market reference only; what you own is whatever your keys control on the blockchain.

Frequently asked questions

What happens if I lose my hardware wallet?

If you still have the seed phrase, you can restore the same keys on a new device and the coins are untouched, because they live on the blockchain, not in the device. Without the phrase, the coins are permanently out of reach.

Is it safer to keep crypto on an exchange or in my own wallet?

Neither is safe in every case; they fail differently. An exchange can be hacked or go bankrupt, while self-custody fails when keys or phrases are lost, stolen or mishandled. The SEC bulletin frames it as choosing between control with sole responsibility and convenience with dependence on the firm.

Does SIPC protect my crypto at a brokerage?

Not the coins themselves. SIPC says it doesn't protect digital or crypto assets that don't qualify as securities under its law, even at a SIPC member. Shares of a registered spot bitcoin fund in a brokerage account are securities, which is different.

Can someone steal my crypto if they know my address?

No. An address is public by design so that others can send you coins. Moving coins out needs a signature from the private key, which the address doesn't reveal.

Summary

Crypto ownership comes down to control of private keys. Wallets store those keys, not coins, and a seed phrase of 12 or 24 words can rebuild them, which makes the phrase both the safety net and the main target. Hot wallets trade security for convenience and cold wallets the reverse, while exchange custody hands the keys to a company and replaces technical risk with the risk of that company failing, as FTX customers learned in November 2022. In the US, SIPC does not cover coins that aren't securities and FDIC insurance doesn't apply to them; a spot bitcoin fund held at a broker is the main way to keep crypto exposure inside ordinary account protections.