"Not your keys, not your coins" — true, and not the whole trade

You will meet this phrase within about a week of taking any interest in cryptocurrency, usually delivered with the confidence of something self-evident. It is worth unpacking, because the technical claim inside it is correct and the advice people build on top of it frequently is not.

What the phrase is technically claiming

Ownership of a crypto asset is control of a private key. Whoever can produce a valid signature can move the asset; the network has no concept of a rightful owner beyond that.

When you hold a balance on an exchange, you do not have a key. The exchange has keys, and it maintains a database entry saying you are owed a certain amount. What you own is a claim on the exchange — legally a debt, functionally an IOU — not the asset itself.

That is precisely correct, and it stops being an abstraction the moment a platform enters bankruptcy. Customers of failed platforms discovered they were unsecured creditors in a queue, receiving cash valued at the filing date rather than the coins they thought they owned. The slogan predicted that outcome accurately.

When the slogan is clearly right

Three situations where it is straightforwardly good advice:

• Amounts that would hurt to lose. If losing the balance would materially change your life, concentrating it in a single company's database is a real exposure. Every case in the platform failure file is an argument for this.
• Long holding periods. Platform risk accumulates with time. A balance sitting for three years is exposed to three years of whatever that company does.
• Where you cannot assess the platform. A small or opaque venue with no register entry and no public disclosures is a counterparty you cannot evaluate at all.

The failure mode that is never on the slogan

Here is the part the phrase leaves out: self-custody moves the risk, it does not delete it. And the new risk has produced an enormous amount of permanent loss.

The ways it happens are mundane:

• The recovery phrase was photographed and the phone was replaced, sold, or died.
• The phrase was written down and stored somewhere that flooded, burned, or was thrown away by someone tidying.
• The phrase was typed into a website that offered to "validate" or "migrate" the wallet. That website was collecting phrases.
• A transaction approval was signed without reading it, granting a contract permission to move tokens later.
• The person died and nobody else knew the phrase existed, let alone where it was.

There is no recovery from any of these. No support line, no password reset, no identity verification, no appeal. The property that makes self-custody strong — nobody can take it from you — is the same property that makes it unforgiving: nobody can give it back either.

What a reasonable middle looks like

Most people who have thought about this for a while end up somewhere in between, along these lines:

1. Nothing on a platform that is not being used. Not because platforms are bad, but because an idle balance carries risk for no benefit. This one habit does more than the rest combined.
2. Small working balance on a platform, larger holding self-custodied — if and when the amount justifies the extra care.
3. The recovery phrase written on paper or metal, stored physically, in two locations. Never photographed, never typed into anything except the wallet itself during a genuine recovery.
4. A hardware wallet once the amount is meaningful. It keeps the key off a general-purpose computer, which removes the most common attack.
5. A test recovery before it matters. Restore the wallet from the phrase onto a different device once, deliberately, to prove the phrase actually works. Almost nobody does this, and the ones who skip it sometimes discover years later that they wrote a word down wrong.
6. Somebody else knows it exists. Not the phrase — that it exists and roughly how to find it. Assets have been lost permanently because nobody knew there was anything to look for.

The failure mode people never plan for

One more, separated out because it is the least discussed and the most permanent: nobody else knows the assets exist.

Custodial accounts have a path here. An estate can contact a platform, produce documents, and go through a process. It is slow and it works.

Self-custody has no such path by design. If the only person who knew about a wallet is no longer able to tell anyone, the assets remain visible on a public ledger forever and unreachable forever. This is not hypothetical — a meaningful portion of the supply is believed to be permanently inaccessible for exactly this kind of reason.

Solving it does not require lawyers. It requires that one trusted person knows two things: that something exists, and roughly where the instructions are. Not the phrase itself, and not by email. A sealed note with a solicitor, or a sentence in a place your family would actually look, covers most of it.

The version of the phrase that is actually useful

"Not your keys, not your coins" is accurate and it is used as a conclusion when it is really a premise. The full sentence would be something like: a balance on an exchange is a claim on a company, and a key you hold is an asset you are personally responsible for — pick the failure mode you are better equipped to survive.

Less catchy. More useful. And notice that neither branch is insured — that is not what the difference is about, which is its own subject.