Your Money, Your Rules.

What Custody Actually Means

In traditional finance, custody is invisible. You open a bank account, money goes in, and you assume it is yours. Legally and practically, it is more complicated: you are an unsecured creditor of the bank. If the bank fails, you rely on deposit insurance up to a limit. If the bank freezes your account due to suspected fraud, regulatory pressure, or simple error, your access is suspended until they decide otherwise.

In DeFi, custody is explicit. You either hold your own private key, or someone else holds it for you. There is no middle ground. If you buy crypto on Coinbase and leave it there, Coinbase holds your private key. You have a claim on the asset, but you do not hold the asset. If Coinbase is hacked, goes bankrupt, or freezes withdrawals, your funds are at risk.

This is what the phrase "not your keys, not your coins" means. It is not a slogan. It is a description of how the technology actually works.

Private Keys, Public Keys, and Seed Phrases

Every wallet in DeFi is built on asymmetric cryptography. The system generates two related numbers: a private key and a public key. The public key (or its shorter form, the wallet address) can be shared with anyone. It is how others send you assets. The private key must never be shared. It is the proof of ownership, and whoever holds it controls everything in that wallet.

The private key itself is a very large number, typically 256 bits. It is computationally impossible to derive the private key from the public key. This is the mathematical guarantee that makes self-custody possible.

Because a 256-bit number is impractical to write down or remember, modern wallets use a seed phrase: a sequence of 12 or 24 ordinary words that encodes the private key in human-readable form. The seed phrase is everything. It can regenerate your wallet on any compatible application. It can restore access after your device is lost or broken. And if someone else gets it, they have full and irrevocable access to your funds.

Wallet Types: A Practical Breakdown

Not all wallets are equal. The right choice depends on how actively you use DeFi and how much you have at stake.

Reading Smart Contracts Without Being a Developer

One of the most underrated skills in DeFi is the ability to verify what a protocol actually does, without writing a single line of code. Most DeFi participants connect their wallets to protocols they have not examined at all, trusting branding and community reputation instead.

On Solana, Solscan shows whether a program is upgradeable or has its authority revoked. On Ethereum, Etherscan shows whether a contract is verified (source code matches bytecode), whether an owner or admin key exists, and whether the contract uses a proxy pattern that allows the logic to be replaced. These are not developer-level checks. They take minutes and require no technical knowledge beyond knowing where to look.

The key questions before connecting to any protocol: Is the contract verified on-chain? Has it been audited, and by whom? Does an admin key or upgrade authority exist? Who holds it? This is not advanced analysis. It is due diligence, and the information is publicly available for every legitimate protocol.

Stablecoins: The Bridge That Can Break

Stablecoins are the most used asset in DeFi. They allow participants to hold value, earn yield, and transact without exposure to the volatility of ETH or SOL. But "stable" describes the target, not the guarantee. Different stablecoin designs carry fundamentally different risk profiles.

The practical takeaway: fiat-backed stablecoins (USDC, USDT) are the most stable in practice, but they reintroduce counterparty risk. The issuer can freeze specific addresses, and regulators can apply pressure. Crypto-backed stablecoins are more decentralized but less reliable in acute stress. Algorithmic stablecoins have a demonstrably poor track record at scale and should be approached with significant caution.

What This Means in Practice

Self-custody is not complicated, but it is unforgiving. A traditional bank account can recover from a forgotten password, a stolen card, or a compromised login. A self-custodied wallet cannot. The private key is the final word, and no support team exists to appeal to.

This is not an argument against self-custody. It is an argument for taking it seriously. The participants who have lost funds in DeFi have overwhelmingly done so through one of three vectors: poor seed phrase security, connecting to malicious contracts, or using platforms that held custody on their behalf and then failed.

The next article in this series examines how DeFi actually generates yield: exchanges, lending, and liquidity provision. Understanding that layer requires the foundation covered here.