Skip to content

Security Notice: Xcoins communicates only through our official website, verified email addresses, and our official social media channels. Our team will never contact you privately via WhatsApp, Messenger, or Telegram direct messages.

Custodial vs non-custodial wallets

By Xcoins Updated 28 Aug 2026 6 min read Reviewed against MFSA guidance

The difference is who holds the keys. A custodial wallet means a platform manages the private keys for you; a non-custodial wallet means you hold them yourself, backed by a recovery phrase. Neither is simply better. This guide covers what each one protects, what each one risks, and how to decide.

The difference, in one sentence

Every crypto wallet holds keys, and the custody question is just: whose hands are they in? If a platform manages the keys and you reach your crypto by logging in, that’s custodial. If you generated the keys yourself and back them up with a recovery phrase, that’s non-custodial.

Everything else people say about the two models, all the safety arguments and the slogans, unpacks from that one fact. Where the keys live decides what can go wrong, who can fix it, and what you have to be good at. So let’s take each one on its own terms.

What is a custodial wallet?

A custodial wallet is one where a platform holds and manages the private keys on your behalf. You access your crypto by logging into your account, the way you access money at a bank, and the platform handles the key management behind the scenes. The Xcoins Wallet works this way, with keys managed through regulated custody.

The practical consequences follow directly. There’s no recovery phrase to write down, because the keys aren’t your job. If you forget your password, account recovery exists, because your identity, verified once at KYC, is what ties you to your crypto rather than a string of secret words. The cost of that convenience is equally direct: you’re trusting the platform to hold the keys properly. Which platform you trust, and whether it answers to a regulator, stops being a detail and becomes the whole question.

What you’re trusting, exactly

With a custodial wallet you’re trusting three things: that the platform holds customer assets the way it says it does, that its security is good, and that it will still be there tomorrow. A licence doesn’t make those questions disappear, but it does mean a regulator is asking them too, with rules about how customer assets must be handled and consequences for getting it wrong.

That’s the honest case for regulated custody: not that trust is eliminated, but that it’s placed somewhere accountable. The equally honest caveat: unregulated custody offers none of that, and most of the industry’s famous disasters were exactly that kind. If you take one thing from this section, take the distinction between custody with a regulator behind it and custody with a logo behind it.

What is a non-custodial wallet?

A non-custodial wallet is one where you hold the private keys yourself, usually backed up as a recovery phrase of 12 or 24 words. No platform sits between you and your crypto: nobody can freeze it, lose it, or mishandle it, because nobody else has it.

The mirror-image consequence: nobody can recover it either. There is no password reset, no support desk, no account recovery. The recovery phrase is the wallet, and the wallet setup guide covers what that means in practice. Lose the phrase and the device, and the crypto is gone; leak the phrase, and it’s gone in a different way. Self-custody removes platform risk by handing the entire security job to you.

Self-custody, in plain terms

Self-custody is the same idea by another name: being your own key-holder. The word makes it sound like a philosophy, and for some people it is, but at ground level it’s a job description. You are the security team, the backup system, and the recovery process.

Some people genuinely want that job and are good at it. Some people want it and aren’t, which is where most self-custody losses come from: not attacks, but lost phrases and phishing. The question self-custody actually asks isn’t “do you believe in holding your own keys” but “will you reliably do the boring parts, forever”. Answer that one honestly and the custody decision mostly makes itself.

“Not your keys, not your coins”

The saying means: if a platform holds the keys, the crypto is a claim on that platform rather than something you control directly. It’s the oldest advice in crypto, and it earned its place. When platforms have failed, the people relying on them found out exactly what that claim was worth.

What the slogan is right about: custody concentrates risk at the platform, and history’s worst losses happened at platforms that held customer assets without anyone checking how. What it leaves out: the keys come with the job of keeping them, and self-custody’s losses, phrase by lost phrase, are just as gone; they simply don’t make headlines, because they happen one person at a time. It also flattens a distinction that matters: custody at a licensed platform, operating under rules about how customer assets are held, is not the same arrangement as custody at an unregulated one. The slogan predates that distinction. Your decision shouldn’t.

Side by side

Custodial Non-custodial
Who holds the keys The platform, on your behalf You, backed by a recovery phrase
If you forget your password Account recovery through the platform No reset. The phrase is the only way back
What you must keep safe Login details and 2FA The recovery phrase, offline, forever
Main risk The platform you chose Your own key management
Convenience Log in and go You run the process end to end
Suits Everyday use, first wallets, recoverability Full control, larger long-term holdings

Read the last row loosely. These are tendencies, not rules, and the protection guide‘s habits matter more than the model you pick.

How to choose

Three questions do most of the deciding. Will you reliably keep a recovery phrase safe for years? Does the amount you hold justify running your own security? And when something goes wrong at 2am, do you want a recovery process to exist? There are no wrong answers, only honest and dishonest ones.

And it isn’t a marriage. Plenty of people run both: a custodial wallet for everyday amounts precisely because recovery exists, and a non-custodial wallet for long-term holdings precisely because nobody else touches it. Moving between them is a normal transaction, not a defection. Start where your honest answers point, and change your mind later with your habits intact.

On Xcoins: both routes work

Xcoins doesn’t need you to pick a side. Buy in the app and hold in the Xcoins Wallet, with keys managed through regulated custody, or buy and have the crypto sent straight to a non-custodial wallet you run yourself. Withdrawing from the Xcoins Wallet to your own wallet works whenever you choose.

The wallet setup guide gets a first wallet working from zero, on either route. The comparison you just read is the decision; everything after it is prompts.

Questions

Questions people actually ask

Who holds the keys. Custodial means a platform manages the private keys and you access crypto through your account; non-custodial means you hold the keys yourself, backed by a recovery phrase. Each protects against what the other risks.
Custodial. The keys are managed for you through regulated custody, there's no recovery phrase to keep, and account recovery exists. You can withdraw to a non-custodial wallet of your own whenever you choose.
It's safe from platform risk, because no platform holds your crypto. It's exposed to self-management risk: lost recovery phrases and phishing cause most self-custody losses. The habits in the protection guide matter more than the wallet model.
Less than the reputation suggests. Wallet activity is public on the blockchain forever, and buying crypto through licensed platforms involves identity verification. A non-custodial wallet gives you control of your keys, not invisibility.
It depends on how customer assets were held and the rules the platform operated under, which is why the licensed-versus-unregulated distinction matters more than any slogan. It's a fair question to ask any platform before trusting it, ours included.
For a non-custodial wallet, if you also lose the device, the crypto is gone; there's no reset and nobody can regenerate it. Custodial wallets have no phrase to lose, which is a real part of their case.
Yes, in either direction, any time. Withdraw from a custodial wallet to your own wallet, or deposit from your own wallet back. It's a normal transaction, not a commitment ceremony.
That's your call, and we don't make it for you. Many people start custodial because account recovery exists while they're still learning, and add self-custody later as amounts grow. The honest version of the question is: which set of risks are you better at managing today?

Licensed by the MFSA. Operating since 2016, used in 100+ countries.

Xcoins is authorised by the Malta Financial Services Authority as a Crypto-Asset Service Provider (CASP) under MiCA. Rates are for information only and are not an offer or investment advice. Crypto prices are volatile, and the value of what you hold can go down as well as up.

Crypto, condensed. The bits that matter.

Market notes, product updates, and the occasional take. One email a week. No hype, no spam.

By subscribing you agree to our Privacy Policy. Unsubscribe anytime.