Key takeaways
- With a custodial service, a company holds the private keys for you. With self-custody, you hold them, and the responsibility is entirely yours.
- A custodial service is simple and forgives a forgotten password, but you rely on the company's security and honesty.
- The collapse of FTX in November 2022 showed what happens when a custodian uses customer assets for its own purposes.
- MiCA requires custodians to keep client assets separate from their own, so their creditors can't claim them.
Contents
With a custodial service, a company holds the private keys to your crypto for you. With self-custody, you hold them yourself. A custodial service is simpler and forgives more mistakes, but you rely on the company. Your own wallet gives you full control, but if the keys are lost, nobody can help.
Neither approach is right for everyone. This article covers the pros and cons, what the collapse of FTX taught us, what MiCA requires of custodians and how Myntkaup holds customer assets.
What is the difference?
Think of the difference between money in the bank and cash in a safe at home. The bank keeps the books, you log in to online banking, and if you forget your password the bank helps you. Nobody can freeze the cash at home, but if it burns or is stolen, it is gone.
- Custodial service. A CustodianCustodianA company that holds crypto and the keys to it on behalf of customers, such as a licensed crypto exchange., such as a crypto exchangeCrypto exchangeA company or platform where you buy, sell and swap crypto, for example with krónur., holds the private keysPrivate keyA secret number that proves you own the crypto in your wallet. Whoever holds the private key controls the crypto.. Your balance is an entry in the company's books, and you use a custodial walletCustodial walletA crypto wallet where a company holds the private keys for you, so you don't have to look after keys or a seed phrase. that the company controls.
- Self-custodySelf-custodyHolding the private keys to your crypto in your own wallet, so nobody else controls it but all the responsibility for the keys is yours.. You use your own crypto walletCrypto walletAn app or device that holds the keys to your crypto and lets you receive, store and send it. and keep the recovery phraseSeed phraseA list of 12 or 24 words that backs up every key in your wallet, so whoever has the words can restore the wallet and take the crypto.. Your crypto sits at an address that only you control.
| Custodial service | Your own wallet | |
|---|---|---|
| Who holds the keys? | The company | You |
| Forgotten password | The company helps you get back in | Your recovery phrase is the only way |
| Selling for krónur | Quick, all in one place | You first need to send the crypto to an exchange |
| Main risk | A hack, fraud or bankruptcy at the company | Lost words, scams and your own mistakes |
| Who can freeze it? | The company, for example because the law requires it | Nobody |
"Not your keys, not your coins"
The saying "not your keys, not your coins"Not your keys, not your coinsA crypto saying meaning that if you don't hold the private keys to your crypto, you don't fully control it. is popular among crypto owners. It means that if you don't hold the keys, you don't really own the crypto. What you have is a claim on the company holding it.
Usually that works out fine. But the claim is never better than the company behind it. As Bitcoin.org points out, when a third party controls your keys, you rely entirely on its security and honesty.
FTX: when a custodian failed
FTX was a large international crypto exchange that marketed itself as the safest and easiest way to buy and sell crypto. In November 2022 it collapsed and went into bankruptcy, and customers suddenly couldn't get to their assets.
According to the US regulator CFTC, customers were told their assets were held in custody by FTX and kept separate from the company's own assets. In reality, Alameda Research, a trading firm the founder controlled, routinely took in customer assets and mixed them with its own funds. The assets were used for, among other things, property purchases, political donations and risky investments. According to the CFTC, customers lost more than 8 billion US dollars.
The founder, Sam Bankman-Fried, was sentenced to 25 years in prison for fraud in 2024.
The lesson is that a custodian's promise is not enough. What matters is whether the law requires client assets to be kept separate, and whether a regulator checks that it is done.
What does MiCA require of custodians?
MiCAMiCAThe EU regulation on markets in crypto-assets, in force in Iceland since 1 January 2026, which sets the same rules for crypto services across the EEA. has applied in Iceland since 1 January 2026. A company that holds crypto for clients needs a licence as a crypto-asset service providerCASP (crypto-asset service provider)A company licensed under MiCA to provide crypto-asset services, such as buying, selling, custody or transfers. and must, among other things:
- keep client assets separate from its own, including on the blockchain. The assets must be legally segregated, so the company's creditors can't claim them if it goes bankrupt.
- not use client assets for its own account.
- keep a record of each client's holdings and send a statement at least every three months.
- have a custody policy that minimises the risk of loss from fraud, cyber threats or negligence.
- be liable for losses caused by the company itself, up to the market value of the assets at the time of the loss.
- only use licensed sub-custodians under MiCA, and tell clients about them.
Segregation of assets and the ban on using them for the company's own purposes are exactly what failed at FTX. The rules reduce the risk but don't remove it. Crypto is not covered by compensation schemes such as deposit insurance, and a licensed custodian can still be hit by a cyberattack.
How Myntkaup holds customer assets
Myntkaup ehf. is licensed by the Central Bank of Iceland as a crypto-asset service provider, and the licence covers, among other things, custody and administration of crypto-assets on behalf of clients. This is how it works:
- No single key. Myntkaup uses multi-party computation (MPC)MPC (multi-party computation)A technique that splits a private key into shares on separate systems, so transactions are signed jointly without the full key existing anywhere. technology from Fireblocks. The key is split into several parts held in separate systems, so no single private key controls customer assets. An attacker would have to break into several systems at once.
- Licensed sub-custodians. A significant part of customer assets is held by Coinbase in Luxembourg and Kraken in Ireland. Both are licensed crypto-asset service providers in the EU.
- An exact record. Some assets are held in pooled (omnibus) wallets, but the system records exactly what belongs to each customer at all times.
- Segregated assets. Customer assets are legally separate from Myntkaup's own assets and protected from creditors if the company went bankrupt. They are never lent out or used for the company's own investments.
- Confirmed withdrawals. Every withdrawal is confirmed with your app PIN and by email.
If a loss is caused by an incident within Myntkaup's control, such as a cyberattack on its systems or theft by an employee, Myntkaup refunds the market value of the lost assets. More on the Security and licence page.
Which approach suits you?
There is no single right answer. The question is which risk you would rather carry.
A custodial service may suit you if:
- you are just starting and don't want to manage a recovery phrase
- you buy and sell regularly and want quick access to krónur
- you want to be able to get help if you lose access to your account
Self-custody may suit you if:
- you plan to hold your crypto for a long time and rarely move it
- you are confident you can store a recovery phrase securely
- you don't want to rely on a third party
Some people take a middle path: they keep what they trade with a licensed custodian and move their savings to a hardware walletHardware walletA small device that keeps private keys offline and signs transactions inside the device, so the keys never reach your computer or phone.. If you choose self-custody, read about private keys and recovery phrases first.
Frequently asked questions
Can I move crypto from a custodian to my own wallet?
Usually, yes. At Myntkaup, you can send every supported coin except USDC to your own wallet, on the coin's native network. Read how to send crypto to another wallet before you start.
What happens if a crypto exchange goes bankrupt?
With a company licensed under MiCA, client assets must be legally separate from the company's own, so its creditors can't claim them. With a company outside the EEA that isn't bound by similar rules, the situation can be very different. That is why it matters to check the licence.
Is MPC the same as multisig?
No, but the goal is the same: no single key should control the assets. With MultisigMultisigA wallet set-up that needs signatures from more than one key before crypto can be sent, for example two out of three., there are several separate keys, and a transaction needs signatures from a set number of them, for example two out of three. With MPC, one key is created in parts that sign together, without the key ever being put together in one place.
Closing thoughts
The real question is who should hold the keys: a company or you. A custodial service forgives a forgotten password but requires trust in the company. Self-custody requires you to look after your recovery phrase carefully.
Whichever you choose, find out how the assets are held. If you trust a company with them, make sure it is licensed.
