iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Before sending money or crypto, identify who can actually authorize an outgoing transfer and what happens if that person, company, or key fails. A wallet normally stores private keys or other credentials; the cryptoasset remains recorded on its blockchain. Your dashboard balance, a wallet label, or a “proof of reserves” badge does not by itself show who can move the asset, whether all customer claims are covered, or what legal rights you have.
Control depends on the exact wallet design, provider, contract, jurisdiction, and asset. Use the checks below to establish signing authority, withdrawal rights, recovery arrangements, segregation, and failure protections before investing.
What “control” means in practice
A blockchain records balances and transactions; a wallet is an interface for the credentials that authorize transactions. The U.S. Securities and Exchange Commission (SEC) explains that a private key authorizes a transaction, while a public key can receive assets but cannot authorize spending. Losing the private key can permanently remove access to the assets. See the SEC’s Crypto Asset Custody Basics for Retail Investors.
For verification, translate “who controls my crypto?” into four operational questions:
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
- Who can sign, approve, or assemble the credentials needed for an outgoing transfer?
- Who can restore access if a device, password, key share, or seed phrase is lost?
- Can you withdraw to an address you control, and under what delays, limits, fees, or conditions?
- What legal claim do you have if the service is hacked, freezes withdrawals, or becomes insolvent?
Control is not always a single person holding one key. A multisignature or threshold arrangement can divide key shares among several parties. The relevant question is whether a person or group can bring about a transfer, not merely whether they can view a balance or block a transaction.
Step 1: Identify the custody model
Self-custody
In self-custody, you control the private keys or the recovery method that can authorize transactions. The SEC describes this as having sole control over access to your cryptoassets’ private keys. That statement is investor education, not a binding legal rule; your rights can still depend on the asset, contract, and local law.
A software wallet, browser extension, or hardware device is only a tool. Ask who can sign a transaction and who can restore the wallet. If a provider can reset your access, co-sign a transfer, or reconstruct a threshold key, the arrangement is not equivalent to one person holding an exclusive key, even if the app calls itself “self-custody.”
Recommended Free Tools
Third-party custody
An exchange, broker, payment service, or specialist custodian may hold the keys while displaying an account balance to you. The provider, its affiliate, or a subcontractor may initiate and approve withdrawals. Your account statement is therefore evidence of a contractual claim or internal record, not proof that you possess a blockchain key.
Ask for the exact legal entity that provides custody, not just the trading brand or mobile app name. A separate company may operate the interface, hold the keys, process withdrawals, or provide insurance. Save the written answers and the version of the customer agreement that applied when you invested.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Shared or threshold custody
In a shared arrangement, key shards or signing roles are distributed. UK Financial Conduct Authority (FCA) guidance describes control for its safeguarding rules in terms of the ability, through any means, to bring about transfer of the benefit of a cryptoasset. Several parties that together meet a signing threshold may therefore control a transfer. The FCA’s definition is specific to that regulatory context; it is not a universal definition of ownership. Read FCA Handbook PERG 18.6 for the wording.
Step 2: Verify a wallet you control yourself
- Name the network and wallet. Record the blockchain network, wallet software or device, and the address format. Similar-looking addresses on different networks can be incompatible.
- Locate the recovery method. Determine whether the wallet uses a seed phrase, a private key, a passkey, or a threshold arrangement. Confirm whether any company, cloud account, recovery service, or co-signer can access it.
- Test a small transfer. Receive a small amount, then send a small amount to a second address you control. Confirm the destination network and fee before signing. A successful test demonstrates that your current credentials can authorize that transaction; it does not prove that no other party has access.
- Protect the recovery data. Store the seed phrase or key offline, separately from the device, and never disclose it to someone claiming to verify ownership. Anyone with the phrase may be able to restore the wallet.
- Plan for loss. Write down how a trusted successor could recover the wallet without exposing the phrase today. Losing the private key or recovery phrase may permanently eliminate access, as the SEC warns.
- Check signing permissions. Review connected applications, delegated permissions, multisignature members, spending limits, and social-recovery guardians. Remove permissions you do not recognize and keep a record of the current configuration.
A hardware wallet can make key handling easier to isolate from an internet-connected device, but it does not establish legal ownership, eliminate user error, or prove that no other person controls a backup or co-signer. Security depends on the complete key-generation, backup, and signing process.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Step 3: Question a platform or custodian
Request specific, written answers before depositing funds. Vague statements such as “assets are safe in a wallet” do not identify signing authority.
Questions about people and entities
- Which exact legal entity is the custodian?
- Which entity operates the trading interface, and are custody and trading performed by different companies?
- Who holds the private keys or key shares?
- Who can initiate, approve, block, or reconstruct an outgoing transfer?
- Is key storage or transaction processing subcontracted? If so, name the role of each subcontractor.
Questions about records and legal claims
- Are customer positions recorded individually, pooled, or represented by a contractual claim?
- Are client assets legally segregated from the provider’s own assets?
- What document defines your rights to withdrawals, forks, staking rewards, airdrops, and network upgrades?
- Which country’s law governs the agreement, and where would a claim be filed?
Questions about withdrawals and failure
- Can you withdraw to a wallet that you control?
- What minimums, daily limits, review holds, network restrictions, address allowlists, and fees apply?
- What happens if the provider is hacked, loses key access, freezes withdrawals, or becomes insolvent?
- How long can a withdrawal review last, and what evidence can trigger a hold?
- What happens to assets during an insolvency proceeding, and are customers creditors, beneficiaries, or direct owners under the contract?
Questions about insurance and security
- What events and assets does any insurance cover?
- Are losses from theft, employee misconduct, key loss, market movement, or a provider failure excluded?
- What are the policy limits, deductibles, and claims procedures?
- How are keys generated, stored, backed up, and audited, and who can access production systems?
The SEC custody bulletin recommends asking how a custodian safeguards assets and private keys, who has access, whether storage is subcontracted, which wallet methods are used, what happens if the custodian fails, and what fees apply. Keep the provider’s answers, terms, fee schedule, and any later amendments together.
Step 4: Check regulation without treating it as a guarantee
“Regulated” is incomplete unless you know who regulates the activity, under which legal entity, and in which country. Search the regulator’s own register and match the legal name, registration number, permitted activity, and status. A logo or marketing statement is not verification.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
U.S. Commodity Futures Trading Commission consumer guidance recommends checking relevant registration records before paying for investment advice or sending digital assets to a firm’s or individual’s wallet. Registration can indicate that a particular activity is supervised, but it does not guarantee asset value, uninterrupted withdrawals, solvency, or recovery. See CFTC’s “Curious About Crypto? Watch Out for Red Flags.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →In the European Union, Article 75 of the Markets in Crypto-Assets Regulation (MiCA) is a reference point for covered cryptoasset-service providers offering custody. The provision requires a client agreement describing responsibilities, custody policy, security systems, fees, and applicable law; a register of client positions; and legal segregation of custody assets from the provider’s estate in the client’s interest, subject to applicable law. Read the ESMA interactive text of MiCA Article 75. MiCA does not automatically apply to every service, asset, country, or activity marketed to an EU resident.
UK safeguarding requirements and U.S. investor guidance address different activities and legal systems. Verify the rules that apply to your location and the provider’s exact service rather than importing a protection from another jurisdiction.
How to read proof-of-reserves and audit claims
A proof-of-reserves report can show that an assessor observed particular blockchain addresses or assets at a particular time. It may not measure every customer liability, off-chain obligation, borrowed asset, related-party exposure, or withdrawal restriction. The SEC warns that scope, frequency, assurance, assessor independence, and disclosure vary, and that proof of reserves does not provide protections comparable to an audit of financial statements. Its investor alert on crypto asset securities explains the limitations.
When a provider cites such a report, ask:
- What was the measurement date, and can the provider move assets before or after the snapshot?
- Which assets, wallets, subsidiaries, and customer liabilities were included?
- Did the assessor independently verify control of the addresses?
- What level of assurance was provided: an audit, an attestation, agreed-upon procedures, or another engagement?
- Were customer claims netted against assets, and were borrowed or encumbered assets disclosed?
- What qualifications, exceptions, and withdrawal restrictions appear in the full report?
Use the report as one limited input. It cannot substitute for understanding who can sign a transaction, what your contract grants you, and how an insolvency would be handled.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Compare self-custody and third-party custody on the decisions that matter
| Decision | Self-custody | Third-party custody |
|---|---|---|
| Transfer authority | You or the defined signing group controls the private key or threshold needed to sign. | The provider, its personnel, or designated key-share holders may initiate and approve transfers under the custody design. |
| Recovery | Recovery depends on your seed phrase, private key, passkey, or configured guardians; loss can be permanent. | Recovery may involve account procedures, provider-held backups, key reconstruction, or a court or insolvency process. |
| Withdrawals | You choose destinations and pay network fees, subject to the wallet and network’s technical limits. | Withdrawals may require reviews, limits, allowlists, delays, network support, and provider fees. |
| Records and segregation | The blockchain records transactions from your address; your personal records must identify keys and backups. | The provider’s ledger and contract determine how your position is recorded and whether assets are segregated. |
| Failure and insolvency | Provider insolvency is less central to access, but key loss, theft, malware, and signing mistakes remain your risks. | Access and recovery depend on the provider, contract, applicable law, and any segregation or insolvency protections. |
| Operational security | You manage device security, backups, permissions, and transaction checks. | The custodian manages key infrastructure, but you must evaluate its controls, subcontractors, incident response, and insurance. |
| Cost and convenience | You may avoid custody charges but bear setup, backup, transaction, and security responsibilities. | You may pay custody, transfer, closure, or other service fees in exchange for operational convenience. |
How to interpret common claims
“Your assets are held in a wallet”
Ask whose wallet, which legal entity controls it, and who can sign. Determine whether one party can transfer the assets, whether several parties must meet a threshold, and whether the provider can act without your approval. “Held in a wallet” describes a storage arrangement, not your legal ownership or exclusive control.
“We are regulated”
Request the regulator, jurisdiction, legal entity, registration number, and covered activity. Check the official register yourself. Confirm whether the registration covers custody, brokerage, exchange, payments, or only another activity. Do not infer guaranteed recovery or asset protection from registration alone.
“We have proof of reserves”
Read the full report’s date, scope, liabilities, assurance level, assessor, and exceptions. A reserve snapshot can coexist with liabilities, encumbrances, operational freezes, or legal claims that the report does not address.
“We need your wallet information to verify ownership”
Sharing a public address can reveal transaction history, but no legitimate verification should require your private key or seed phrase. Ask why the information is needed, how it will be stored, and whether a signed message or small test transaction is sufficient. Never send credentials or approve an unfamiliar transaction to “prove” control.
A documented pre-investment workflow
- Capture the identity. Save the provider’s legal name, registered address, regulator, registration record, and the exact service terms.
- Map the keys. Draw who generates, stores, backs up, and can use each key or key share. Mark every employee, affiliate, contractor, guardian, or recovery service with a signing role.
- Map the exit. Record the supported network, destination rules, fees, limits, review triggers, and expected processing path for a withdrawal.
- Map failure. Locate the clauses covering hacking, lost keys, frozen withdrawals, termination, insolvency, forks, and disputed transactions.
- Verify with a small amount. Deposit and withdraw a test amount only after confirming the destination network and fees. Keep transaction IDs and screenshots of the terms in force.
- Set a stop condition. Do not invest if the provider will not identify the custodian, explain signing authority, provide applicable terms, or permit a reasonable withdrawal route.
One data point—and what it does not prove
The FCA reported that 72% of cryptoasset users said they stored their cryptoasset with the exchange they bought it from, based on a 2024 YouGov survey cited in FCA consultation paper CP25/14. This is a UK survey result from 2024, not a global estimate or a current share of all crypto users. It indicates why custody questions matter for exchange customers; it does not establish that any particular provider is safe or solvent.
When to stop and seek specialist advice
Pause before investing if the asset is subject to a complex token contract, the provider operates across several jurisdictions, the terms allow rehypothecation or lending, withdrawals are discretionary, or the legal entity and registration cannot be matched. An attorney familiar with your jurisdiction can interpret ownership, trust, segregation, and insolvency clauses; a qualified security professional can review a self-custody setup. This article is educational, not individualized investment or legal advice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
