Not your keys, not your coins

The phrase spread through Andreas Antonopoulos's talks and became the standard one-line answer to a beginner's first question. It is a statement about legal and technical ownership, not about which company you trust: a platform can be honest, licensed, profitable, and still leave you as an unsecured creditor. The useful version of the rule is a threshold, not a slogan.

How it works

A bitcoin balance is not a file that can be moved into an account. It is an unspent output on the public ledger, and the only thing that can move it is a valid signature from the corresponding private key.

When a custodian holds that key, three things follow that no interface can change. The custodian can sign without asking you, which is what makes instant internal transfers and account freezes possible. You cannot sign at all, so you can only ask. And the number on your screen is an entry in the company's database, updated when you buy, which usually corresponds to no on-chain transaction whatsoever.

Whether that entry survives a company failure is decided by contract law rather than by cryptography. Two documents settle it: the terms you accepted at signup and the bankruptcy code of the jurisdiction the company files in. Neither is written in your favor by default, and courts have now tested the question enough times that the answer is no longer speculative.

The phrase also has a boundary that gets ignored. Holding your own keys does not mean holding your own risk-free bitcoin. It transfers the failure mode from a corporate balance sheet to your own operational competence: a seed phrase nobody else can produce, a device that can be replaced, a backup that survives a house fire, and a plan for what happens if you die. The people who lose coins in self-custody usually lose them to a missing backup or a fake wallet app, not to a broken signature scheme.

Why this matters when you buy bitcoin

Almost every purchase starts at a custodian, so the practical question is never whether to use one but how long your coins stay there.

Start with a threshold rather than a rule. Money you intend to trade this month can sit on a platform with two-factor authentication turned on. Anything you are buying because you expect to still own it in five years belongs on a device you control, and the review section on this site covers the hardware worth the money. Between those, pick a number in your own currency that would genuinely hurt to lose, and treat crossing it as the trigger to withdraw rather than a reason to think about withdrawing.

Then learn the withdrawal path while it is cheap. Send a small amount to your own wallet, confirm it arrives, and check the address on the signing device's own screen rather than in the browser. Doing this once, early, converts an emergency procedure into a routine one.

Understand the friction you will hit, because in several jurisdictions it is now legally mandated. Under the European Union's transfer of funds regulation, which has applied since December 30, 2024, a licensed provider must collect and verify information about the owner of a self-hosted wallet for transfers above 1,000 euros. That is not a reason to leave coins on the platform. It is a reason to do the paperwork once, on your own timetable, rather than during a crisis when the queue is long. The country guides note where these rules apply.

What FTX's repayment actually paid

The FTX bankruptcy is the clearest illustration of the phrase, because customers were eventually repaid and the repayment still proved the point.

FTX filed for Chapter 11 protection on November 11, 2022. Its reorganization plan was confirmed on October 7, 2024, and it paid creditors in dollars, valued as of the petition date, which is the standard treatment for a claim in a US bankruptcy. Bitcoin traded near 17,000 dollars in the week of that filing.

So a customer who had one bitcoin on FTX did not get a bitcoin back. They got a claim worth roughly the November 2022 dollar price, plus interest, settled years later. Bitcoin passed 100,000 dollars for the first time in December 2024, before most distributions were made. The recovery percentage was high by bankruptcy standards and the depositor still ended up with a fraction of what they thought they owned, because what they owned was a dollar-denominated claim in a courtroom, not a coin.

Nothing about that outcome required fraud. Petition-date valuation is ordinary insolvency law, and it applies to a well-run custodian's failure exactly as it applied to a badly run one.

Not your keys vs custodial wallet

Custodial wallet names the arrangement; not your keys is the warning about it. A custodial wallet is a neutral description of an account where a company signs on your behalf, and there are good reasons to use one: fiat rails, recovery when you forget a password, and in many countries the only legal way to convert local currency at all. The slogan is what you say about the amount you leave there afterwards. Confusing the two produces the two common errors, refusing to use an exchange at all, and treating an exchange balance as savings.

Not your keys vs Proof of Keys

Not your keys is the principle; Proof of Keys is the drill. The principle tells you that a custodial balance is a promise. Proof of Keys is a specific annual exercise, held every January 3, in which holders withdraw everything to check that the promise is good and that their own backups work. You can believe the principle for years without ever testing it, which is precisely the failure the drill exists to catch, and a withdrawal you have never performed is a plan you have never verified.