Key takeaways
- On the Bitcoin network, spending is controlled by private keys. The phrase is a short way of saying that control of the key is control of the coins.
- When a custodian holds your keys, your holding is a claim on that firm. You depend on its security, its honesty and its solvency.
- When you hold your own keys, you remove that dependence but take on backup, theft and loss risk yourself.
- Multi-signature sits between the two, because more than one key must approve a spend. Who holds which keys is what matters.
- In the UK, crypto holdings are generally not covered by the FSCS or the Financial Ombudsman Service, whichever route you choose.
For information only. Not investment advice. This guide explains custody and makes no prediction about price. Don't invest unless you're prepared to lose all the money you invest.
The short answer
“Not your keys, not your coins” is a rule of thumb from the Bitcoin community. It reminds you that Bitcoin is not stored in an account the way pounds are. The network only recognises a spend that is signed with the right private key, so the person or firm that holds that key decides what happens to the coins.
The phrase is a warning about counterparty risk: the risk that the other party you rely on fails you. It is not a ruling that one way of holding Bitcoin is correct. This guide is part of the CoinCorner learn hub, and it assumes you know the basics covered in What is Bitcoin?
What a key actually is
A private key is a very large secret number. A matching public key, or an address derived from it, is what others use to send you Bitcoin. To spend, the holder creates a digital signature with the private key, and every node on the network can check that signature without ever seeing the key. The design is described in the Bitcoin white paper and in the Bitcoin Project's developer guide to wallets (both listed under Sources).
A wallet is the software or hardware that stores keys and builds transactions. It does not hold coins; the coins are entries on the public ledger. Many wallets create their keys from a recovery phrase (also called a seed phrase), a list of words that can rebuild every key in the wallet. Whoever has the phrase effectively has the keys.
Two facts follow, and they explain the whole slogan. First, a confirmed Bitcoin transaction cannot normally be reversed, as the guide to confirmations explains. Second, there is no network-level helpdesk that can reset a lost key.
What custodial means
With a custodial service, a firm holds the keys and records in its own books how much Bitcoin belongs to you. When you log in you see a balance, and when you withdraw the firm signs a transaction for you. This is how most exchanges work, and it is convenient: there is a password reset, a support team and nothing for you to back up.
The trade-off is that your Bitcoin is only as safe as the firm. The main risks are:
- Security failure. If the firm's systems or staff are compromised, customer Bitcoin can be stolen.
- Misconduct or insolvency. A firm that mismanages funds may be unable to return what it owes.
- Access. The firm can freeze or restrict an account, for example to meet legal or compliance duties.
- Limited protection. Registration is not the same as protection. CoinCorner Ltd is registered with the Isle of Man Financial Services Authority as a designated business for anti-money-laundering oversight only. That is not a licence. CoinCorner is not regulated by the FCA, and holdings are not covered by the Financial Ombudsman Service or the Financial Services Compensation Scheme.
None of this means a custodian is unsafe. It means you should know who it is, how it holds customer Bitcoin and what is and is not covered. CoinCorner's own position is set out on the about page, and the FAQ answers common account questions.
What self-custody means
With self-custody, you hold the keys, usually in a software wallet on a phone or computer, or a hardware wallet, which is a small dedicated device that keeps keys offline. Nobody else can move your coins, and no firm can freeze them.
The responsibility moves to you instead:
- Backup. If the device is lost or broken and you have no copy of the recovery phrase, the coins are generally gone.
- Theft. Anyone who sees the phrase can take the funds. Fake support staff and phishing sites target exactly this.
- Mistakes. A wrong address or a payment to a scammer usually cannot be undone.
- Inheritance. If you are the only person who can find the keys, your family may not be able to reach the coins.
Self-custody also does not bring back any safety net. The FCA's consumer guidance says people should be prepared to lose all the money they invest in crypto, and that applies however the coins are held.
Middle routes: multi-signature
The choice is not only all-or-nothing. A multi-signature arrangement requires more than one key to approve a spend, for example two of three. That can remove a single point of failure: one stolen or lost key is not enough to move the funds on its own. What is a multi-signature wallet? explains the M-of-N idea in detail.
What matters is who holds which keys. If you hold every key, multi-signature is a self-custody setup. If a provider holds all of them, it is still custodial. CoinCorner's Vault is a custodial service that uses multi-signature. How a multi-sig Vault protects your keys describes what that does and does not protect against, and the security page covers the insurance terms.
The routes compared
The table summarises the trade-offs qualitatively. It makes no claim about how likely any one event is.
| Route | Who holds the keys | Main risk | Your main task |
|---|---|---|---|
| Custodial account | The firm | Failure, misconduct or restriction by the firm | Check the firm and what its registration covers |
| Self-custody wallet | You | Loss, theft or error | Back up and protect the recovery phrase |
| Shared multi-signature | You and a provider, or several parties | Depends on the set-up and who can act alone | Understand the signing rules and recovery plan |
| Provider-held multi-signature | The provider | Provider-level risk, reduced single-key exposure | Check how keys are split and what insurance covers |
Choosing a route
There is no single answer, and the questions below are a better guide than the slogan:
- How much do you hold, and how often do you move it? Small amounts you spend often suit a different set-up from a long-term holding.
- Can you manage a backup safely? If you cannot store a recovery phrase securely and reliably, self-custody may add more risk than it removes.
- Who else needs access? Think about what happens to the Bitcoin if you are unavailable.
- What do you need from a firm? Read its published terms and costs, such as the fees page, and understand what its registration does not cover.
Many people use a mix, keeping a small amount with a firm for convenience and the rest under their own control, or the other way round. Whichever you pick, test with a small transfer first. If you are just starting out, the step-by-step buying guide shows what happens after a purchase.
Frequently asked questions
What does “not your keys, not your coins” mean?
It means that whoever controls the private keys controls the Bitcoin. If a firm holds the keys for you, you rely on that firm to honour your balance. If you hold the keys yourself, nobody else can move the coins, but nobody can recover them for you either.
Is it unsafe to leave Bitcoin on an exchange?
It is a different risk, not automatically an unsafe one. You rely on the firm's security, solvency and honesty, and in the UK crypto holdings are generally not covered by the FSCS or the Financial Ombudsman Service. Check who the firm is, how it holds customer Bitcoin and what its registration does not cover.
Does self-custody remove all risk?
No. It removes reliance on a third party but adds your own responsibility. A lost key with no backup usually means the coins are lost for good, and a stolen key or recovery phrase lets a thief take the funds. Transfers cannot normally be reversed.
Is multi-signature the same as self-custody?
Not necessarily. Multi-signature means more than one key must approve a spend. You can hold all the keys yourself, or share them with a provider. Who holds which keys decides who can act alone, so ask exactly how a service sets it up.
What is a recovery phrase?
A recovery phrase, also called a seed phrase, is a list of words from which a wallet can rebuild its keys. Anyone who has it can take the funds, and losing every copy can mean losing access. Never type it into a website or share it with anyone claiming to offer support.
Does CoinCorner let me hold my own keys?
CoinCorner's Vault holds customer Bitcoin using multi-signature, which is a custodial arrangement. You can send Bitcoin to a wallet you control yourself. The custody and security pages set out how holdings are kept and what the insurance does and does not cover.
Sources
The statements about keys and wallets come from the documents below. Their links are given so that you can check each point against the original. This guide was written on 23 October 2026; the registration and protection statements reflect the CoinCorner site at that date, so check the register entry for the current position.
- Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008): https://bitcoin.org/bitcoin.pdf
- Bitcoin Project, Developer Guide: Wallets: https://developer.bitcoin.org/devguide/wallets.html
- Financial Conduct Authority, Crypto: The basics: https://www.fca.org.uk/investsmart/crypto-basics
- Isle of Man Financial Services Authority, Designated Businesses register entry for CoinCorner Ltd: https://www.iomfsa.im/registers/designated-business/?Id=67