Self-custody wallets: what they are and how they compare with an exchange

"Not your keys, not your coins" is one of the oldest lines in crypto. It describes a real difference in who controls your money. When you buy USDC on an exchange and leave it there, you own a balance on the exchange's books. When you hold USDC in a self-custody wallet, the tokens sit at a blockchain address that only your keys can move. This guide explains what that means in practice, what you gain, what you take on, and how newer wallets with email login fit into the picture.

What does self-custody mean?

Every blockchain account is a pair of keys. The public key produces the wallet address you can share. The private key signs transactions and must stay secret. A wallet is the software that uses those keys to show your balance and send transactions. As ethereum.org puts it, wallet providers in this model do not have custody of your funds; they give you a window and tools to manage them.

Self-custody means the private key, or the ability to use it, is under your control. See the self-custody glossary entry.

Custody by a provider means the company controls the keys. Your account shows a balance, but on the blockchain the coins often sit in addresses in the company's name, mixed with other clients' assets and tracked in an internal ledger. Under MiCA, providing "custody and administration of crypto-assets on behalf of clients" is a licensed service, with rules on keeping client assets separate from the provider's own.

How does an exchange account compare with self-custody?

Neither column is "right". Exchanges are convenient for trading. Self-custody makes sense for money you hold for longer, move between services or do not want tied to one company's fate.

What are the advantages of self-custody?

1. No counterparty risk on the balance. If a platform goes bankrupt or stops serving your country, your tokens are not part of that problem. Ethereum.org notes the same point: with an exchange you trust it with custody, and if it has financial trouble, your funds are at risk.
2. Freedom to move. You can send to any service or person on the same network at any hour.
3. Portability. A standard wallet account is not tied to one app. The same keys can often be used in another wallet application.
4. Regulatory transitions matter less. When Bulgaria's MiCA transition ended on 1 July 2026, the FSC expected unlicensed firms to help clients leave and move their assets to a licensed provider or to their own wallet. Clients already in self-custody had nothing to move.

Does MiCA protect crypto held by an exchange?

It helps, but it is not a guarantee. Under MiCA, a licensed provider that holds crypto-assets for clients must keep a register of each client's positions, keep client assets legally and operationally separate from its own, and is liable for the loss of client crypto-assets caused by incidents attributable to it, up to their market value at the time of the loss. That is a real improvement on unregulated platforms.

What MiCA does not do is turn a crypto balance into a guaranteed deposit. If the provider's safeguards fail, you depend on its insolvency process and on how quickly assets can be returned. That is why many people keep only trading balances on an exchange and hold the rest in self-custody.

What are your responsibilities?

Self-custody hands you jobs a bank or exchange would normally do:

1. Keep access safe. With a classic wallet you write down a seed phrase. Ethereum.org stresses that it is often the only way to recover the wallet and that you should not store it on a computer.
2. Check every address and network. A blockchain transfer cannot be reversed by anyone. Use the crypto address checker to catch format errors before you send.
3. Recognise phishing. Nobody legitimate will ask for your seed phrase or one-time codes. Bookmark the real website of your wallet.
4. Pay network fees. Each on-chain transfer pays a gas fee. On Solana, for example, fees are charged per transaction in the network's own token, SOL.
5. Keep records. For tax, you need the history of each wallet you own.

How do embedded wallets with email login work?

Classic wallets make you manage a seed phrase from day one, which puts many people off. Embedded wallets try to keep the security model of self-custody while letting you sign in with an email address, a social account or a passkey.

Privy, a provider of embedded wallet infrastructure, describes its design in its security documentation, in general terms:

1. Keys are created inside secure hardware. A wallet is generated inside a trusted execution environment (TEE), an isolated compute environment with no persistent storage and no interactive access.
2. The key is split into encrypted shares. One share is secured by the TEE itself; another, the auth share, is encrypted and can be used only with valid authentication from the wallet owner. Neither share alone gives any access to the wallet.
3. Shares combine only for a moment. When you authorise a transaction, the shares are combined inside the TEE to sign it, and at all other times the key exists only as separate encrypted shares.
4. Key export is possible in supported setups. Privy's documentation says users can export the private key of their embedded wallet to use the same address in another wallet such as MetaMask or Phantom, depending on how the wallet was created and how the app configures it.

xChange.bg uses this kind of self-custody embedded wallet from Privy, on Solana, Ethereum, Base, Arbitrum, Polygon and Optimism, and the customer holds the keys. Incoming money to a customer's EUR or USD account arrives there as USDC; the accounts and conversions are provided by regulated partner Bridge (a Stripe company).

The practical difference for you: login and recovery work more like an app account, while the wallet is designed so that signing requires your authentication. Protect your email account and add a second factor, because your login now guards your wallet.

How do you start with self-custody safely?

1. Choose a wallet type: a hardware wallet for long-term savings, a mobile or embedded wallet for everyday transfers.
2. Set up recovery first: write down the seed phrase offline, or enable the recovery and multi-factor options of an embedded wallet.
3. Send a small test amount from your exchange, on the network your wallet supports.
4. Check that the amount arrived, then send the rest.
5. Record the addresses you own and export your exchange history for your tax file.
6. Before paying anyone, read sending money abroad with stablecoins for network and address checks.