Custody of crypto assets is a choice between two different risk profiles rather than between a safe and an unsafe option. Each removes a category of risk and introduces another.
Control follows the private key
Ownership on a blockchain is the ability to produce a valid signature with a private key. Whoever holds the key can move the asset.
An exchange balance is a claim against the exchange, which holds the keys and records what it owes each customer in its own ledger.
That distinction is invisible during normal operation and becomes decisive the moment the intermediary fails, freezes withdrawals or is compelled to act.
Custodial risk is counterparty risk
An exchange can be hacked, can misappropriate assets, or can become insolvent, and customers then rank as creditors rather than owners.
Accounts can also be restricted for compliance reasons, which is a legitimate function of a regulated intermediary but still removes access temporarily.
Deposit insurance does not apply to crypto holdings, so the protections depositors expect from a bank are simply absent.
Self custody removes the intermediary and the safety net
Holding keys directly means no third party can freeze, lend or lose the assets, and no permission is required to transact.
It also means there is no password reset, no support line and no mechanism to reverse a transaction sent to the wrong address.
A lost seed phrase is an irrecoverable loss, and a compromised one drains the wallet immediately with no possibility of a chargeback.
Hardware wallets isolate the signing step
A hardware wallet keeps the private key on a dedicated device and signs transactions internally, so the key never reaches an internet-connected computer.
The connected machine can still display a misleading destination, which is why confirming details on the device's own screen is the point of the design.
The seed phrase generated at setup remains the ultimate backup, and its physical security becomes the security of the entire holding.
Multi-signature and social recovery sit between the extremes
Multi-signature arrangements require several keys to authorise a transaction, so losing or compromising one key does not lose the funds.
Recovery designs allow a set of designated parties to restore access collectively, which reintroduces a safety net without a single custodian.
Both add operational complexity, and that complexity is itself a risk, which is why the appropriate choice depends heavily on the amount being secured.