No 64

Correct custody of crypto-assets

Investments

Which kind of wallet should you choose for your crypto-assets, and who controls your private key?

What is a wallet?

A wallet acts as your digital wallet. Instead of storing the actual crypto-assets, it stores the access key you use to access your crypto-assets.

Such keys are essential: whoever has the key controls the crypto-assets. If keys get lost or fall into the wrong hands, you usually permanently lose access to your wallet.

Hot and Cold Wallets

Wallet types primarily differ in terms of whether or not they are connected to the Internet.

Hot wallets are permanently connected to the Internet – i.e. online as smartphone apps or within a web browser. They are easy to use and are very suitable if you execute transactions regularly. However, they are more vulnerable to cyber attacks.

Cold wallets are not continually connected to the Internet, and function offline, e.g. as hardware devices. As a result, they provide greater security. However, they are less convenient in everyday use, and need to be looked after particularly carefully.

Self-custody or custody by a CASP?

The issue with crypto-assets is always about who has control over the key.

Self-custody ensures you retain full control over your crypto-assets. However, you also bear the full responsibility. If you lose your access credentials, forget them, or fail to adequately secure them, recovering access to your crypto-assets is generally not possible.

Alternatively, you can use a service provider who takes care of custody for you. Doing so may simplify use and reduce the risk of operating errors. It is important to only choose regulated providers authorised by a supervisory authority.

What happens if you lose a wallet?

If you lose your access credentials or recovery phrase, it is usually not possible to restore access. Thers is no central body that can replace or reset lost keys.

Damaged devices or a lack of backups may lead to your crypto-assets no longer being accessible. It is therefore essential that you handle your access data with particular care.

Regulated service providers ensure protection

If a regulated CASP handles custody of your crypto-assets, they remain your property. Crypto-assets are required to be stored separately to the firm’s assets.

Providers are obliged to observe high security standards, monitor risks on an ongoing basis, and to determine clear processes for protecting your crypto-assets.

The provider may be liable if something goes wrong at the provider e.g. due to inadequate security measures or organisational issues. In this case, they must replace the value of the crypto-assets at the time of loss.


Tips for safe custody

  • Choose the type of wallet that suits you usage behaviour.
  • Always store the recovery phrase securely offline.
  • Only use regulated providers, if you decide against self-custody of your crypto-assets.
  • Always have at least one backup, and check regularly that the backup is a full one.


Private Key:

“key” – your private access. Whoever has the key has control and proof of ownership of crypto-assets.

Public Key:

a type of technical “account number” from which crypto address is derived for receiving crypto-assets.

CASP – Crypto Asset Service Provider:

a regulated European service provider that is allowed to provide crypto-asset services like custody and management.