"Not your keys, not your coins."
The saying has circulated in crypto for more than a decade, and it resurfaces every time an exchange collapses. In May 2024, Japanese exchange DMM Bitcoin lost about 4,502 bitcoin in a hack, and the phrase hit hard once again. Many customers realized that day that the bitcoin showing in their accounts had never really been theirs.
That same year, though, an individual holder was tricked by scammers posing as support staff and lost thousands of bitcoin. Holding your own keys didn't stop the loss. So what does the saying get right, and what does it leave out?
Key takeaways
- When your coins sit on an exchange, what you own is an IOU from the exchange, not bitcoin on the blockchain.
- From Mt. Gox to FTX to DMM, exchange failures have repeatedly proven that third-party risk is real.
- Holding your own keys brings its own risks: social engineering, phishing and loss.
- The missing second half of the saying: "Your keys, your responsibility."
What the saying actually means
Who owns bitcoin isn't decided by which app shows you a balance. It's decided by who controls the private keys that can move it.
When you deposit bitcoin on an exchange, the coins move to addresses the exchange controls. The number in your account is an entry in the exchange's internal ledger, effectively a debt the exchange owes you. As long as the exchange runs normally, you can withdraw anytime. If it gets hacked, misuses funds or goes bust, that IOU may never be honored.
That's what "not your keys, not your coins" means: without the keys, all you own is a promise.
History has proven it again and again
| When | Event | Approximate loss | What customers faced |
|---|---|---|---|
| 2014 | Mt. Gox bankruptcy | About 850,000 BTC, of which about 200,000 were later found | Roughly a decade before partial repayments began |
| 2016 | Bitfinex hack | About 120,000 BTC | Losses were spread across all customers |
| 2022 | FTX collapse | A multibillion-dollar hole in customer funds | Withdrawals frozen; a long bankruptcy process |
| May 2024 | DMM Bitcoin hack | About 4,502 BTC | The exchange later announced it would shut down and transfer customer accounts |
Note: figures come from public reports and reflect how losses were counted at the time. Sources may differ slightly.
What these events share: customers did nothing wrong, yet paid for the exchange's failures. Some waited a decade, some had losses imposed on them, and some are still working through bankruptcy proceedings.
But self-custody holders get robbed too
If the story ended there, the lesson would be simple: withdraw to your own wallet and you're done. Reality is messier.
According to public disclosures by on-chain investigators, in August 2024 an individual holder was manipulated step by step by scammers impersonating a well-known tech company and a hardware wallet brand, and lost about 4,064 bitcoin. The keys really were in his hands, but the scammers talked him into giving up control.
There are many similar stories:
- Typing a seed phrase into a fake website or app.
- Storing a photo of the seed phrase in a phone gallery or cloud drive.
- Signing an approval transaction they didn't understand.
- Sharing the seed phrase with "the person they trusted most."
Holding your own keys means nobody can freeze your coins, but it also means nobody can stop a scammer for you. To learn more about these scams, read the fake support seed phrase verification trap.
The half of the saying nobody repeats
Comparing the two kinds of risk side by side makes it clearer:
| Comparison | Exchange custody | Holding your own keys |
|---|---|---|
| Exchange collapse, hack or misuse of funds | Directly affected | Not affected |
| Account freezes | Possible | Impossible |
| Phishing and social engineering | Account may be drained, but funds can sometimes be frozen or recovered | Once funds move, recovery is nearly impossible |
| Forgotten password or seed phrase | Recoverable through identity verification | A lost seed phrase is gone forever |
| Knowledge required | Less | Basic security know-how |
So the fuller version of the saying is: "Not your keys, not your coins. Your keys, your responsibility."
Finding a balance between the two risks
- Hold large long-term holdings yourself, on a hardware wallet bought from official sources, with the seed phrase stored offline.
- Keep small trading balances on an exchange if you need to. Pick a long-running platform that publishes proof of reserves regularly, and turn on two-factor authentication and withdrawal allowlists.
- Consider multisig for larger holdings. In a 2-of-3 setup, three keys are stored separately, and losing or leaking one doesn't lose your funds.
- Never give your seed phrase to anyone, including people claiming to be support, technicians or law enforcement.
- Rehearse recovery regularly with a small amount to make sure your backup actually works.
FAQ
If an exchange publishes proof of reserves, can I relax?
Proof of reserves shows, to a degree, that an exchange holds enough assets. But it's usually a snapshot in time, may not fully capture liabilities and can't prevent future hacks or misconduct. It's a plus, not insurance.
If my coins sit in the exchange's cold wallet, are they "my keys"?
No. The exchange controls its cold wallets and holds the keys. Cold storage lowers the risk of the exchange getting hacked, but in terms of ownership you're still just a creditor of the exchange.
What's the most common way self-custody holders lose coins?
Most often, a seed phrase leak: typing it into a phishing site, storing a photo in the cloud or letting someone see it. Next come malicious approvals and lost seed phrases. Losses from a device actually being cracked are rare.
Should beginners start with self-custody right away?
Practice with a small amount first: create a wallet, back up the seed phrase, send funds in and out, and restore the wallet from your backup. Once you're comfortable with the whole process, gradually move long-term holdings into your own wallet.
Summary
"Not your keys, not your coins" stings because exchange failures keep proving it right. The self-custody thefts fill in what it leaves unsaid: taking back your keys means taking back all the responsibility. The sensible approach isn't choosing one side but spreading risk according to the size of your holdings and your own skills.
To decide whether a cold wallet is worth it, read is a cold wallet a waste of money? For the wider exchange vs self-custody argument, read why the debate over which is safer keeps growing. This article is for education only and isn't investment advice.
Covers Bitcoin: the protocol, mining, the halving cycle and network development, writing from the white paper and verifiable on-chain data.
Our editorial principles →
David Mitchell
Michael Carter