A wallet does not hold coins. Coins are entries on a ledger. A wallet holds the private key that authorises changes to those entries. Whoever has the key controls the assets, and the ledger has no concept of ownership beyond that.
| Approach | You accept | You avoid |
|---|---|---|
| Self-custody | Total responsibility — losing the key loses the assets permanently | Counterparty failure |
| Exchange custody | Counterparty risk — the platform can fail, freeze or be hacked | Key management burden |
| Qualified custodian | Counterparty risk with regulatory oversight and typically insurance | Key management, with some protections |
There is no risk-free option here, only a choice about which risk you prefer and can actually manage. Self-custody has cost people everything through lost keys; exchange custody has cost people everything through platform failure. The right answer depends on amount, technical confidence and how the assets are used.
Token approvals are the most underestimated risk. Interacting with a contract often grants it permission to move tokens from your wallet — sometimes without limit and indefinitely. That approval persists after you finish using the application, and a contract that is later compromised can act on approvals granted long before.
Common belief
"My assets are safe because my wallet was not hacked."
What is actually true
Most losses do not involve a compromised wallet. They involve a signature you provided voluntarily — approving a malicious contract, signing a transaction whose effect you did not read, or entering a seed phrase on a convincing fake site. The wallet did exactly what it was told.