What does "not your keys, not your crypto" mean?
It is the core self-custody principle of crypto: whoever controls the private keys controls the coins. If your crypto sits on an exchange, you own a claim on a company; you do not own the asset in the way the blockchain records ownership. The phrase is a warning and, read carefully, a tradeoff.
The mechanics in one minute
Crypto ownership is recorded on the blockchain, not in a bank's database. To move coins, you need the private key that matches the address holding them. Keep that key yourself (in a wallet you control: hardware wallet, software wallet, or an offline seed phrase) and you are self-custodied. Leave your coins on an exchange and the exchange holds the keys; what you have is an IOU, an entry in their ledger that says they owe you coins.
What the phrase protects you from
- Exchange failure: if the platform goes insolvent, gets hacked, or freezes withdrawals, holders of IOUs line up as unsecured creditors. History has repeats.
- Custodial freezing: an exchange can block withdrawals, freeze accounts, or comply with orders against your holdings. A self-custodied wallet cannot be frozen by a third party.
- Counterparty dependency: with self-custody, your access depends on your key and the network, not on a company's solvency, policies, or uptime.
The tradeoff the slogan leaves out
Self-custody moves the risk from the counterparty to you. Lose your seed phrase and your coins are gone with no support desk. Get phished, sign a malicious transaction, or store your key carelessly, and the loss is instant and irreversible. Custodial platforms, whatever their risks, handle key management, offer recovery paths, and are easier for beginners. Honest framing: the phrase is about who bears the risk, not about there being no risk.
Practical middle ground
- Long-term holdings: self-custody, ideally a hardware wallet, seed phrase backed up offline in more than one physical place.
- Active trading: keeping a working balance on an exchange is a conscious risk decision; size it so a platform failure is an annoyance, not a catastrophe.
- Never: share your seed phrase, type it into a website, or store it in a cloud note or screenshot. No legitimate service will ever ask for it.
- Test recovery: a backup you have never restored is a hope, not a backup.
The bottom line
"Not your keys, not your crypto" is true as stated: custody is control. Use it as a question, not just a slogan: for each holding, do you know who holds the keys, and can you afford their failure mode? Then size your custody accordingly.