Skip to the page
NO KYC CASINO
field note / crypto gambling

Self Custody Crypto: Keys, Seed Phrases and Who Can Freeze

Who holds the private key, how a seed phrase derives it, what a custodian can freeze or report, and why recovery becomes the holder's job alone.

logged
by
No KYC Casino Dispatch
read
7 min
hash
5525b09
A hand holds a brass padlock with a steel shackle against a dark blurred background.
Photo: Nathanthomas on Pexels

Self custody crypto means you, not a company, hold the private keys that move your coins. Whoever holds the key can sign a transfer; whoever only has the address can receive and watch. A self custody wallet removes the business that could freeze, report or lose those keys, and hands you the whole job of keeping them recoverable.

That last trade is the part vendor pages tend to skip. This dispatch works through it at the level of the standards: how a recovery phrase becomes keys, what a passphrase does, what a US custodian must do with blocked funds, and where recovery risk lands once nobody else holds a copy.

What self custody crypto means at the key level

A wallet is two things: addresses that receive and private keys that send. The US Treasury's sanctions office uses exactly that split in its definition of a digital currency wallet: addresses let the user receive, private keys let the user transfer.

The same FAQ defines a hosted wallet provider as a business that creates and stores a wallet on a customer's behalf. That is custody in the plain sense. Self custody is the opposite arrangement: the wallet software runs on your device, the keys are generated there, and no business stores them for you.

Control follows the key. Bitcoin.org's wallet security guidance is blunt about the alternative: when a third party controls your keys, you rely entirely on its security and honesty, and exchanges and online wallets have been hacked, have failed, or have frozen access to funds.

Self-custodial vs non-custodial wallets: is there a difference?

No meaningful one. Both labels describe a wallet where you hold the private keys and no hosted wallet provider stores them. "Non-custodial" names what the provider does not do; "self-custodial" names what you do. The line that matters runs between those wallets and hosted ones.

Hosted (custodial) walletSelf custody wallet
Who stores the private keysThe provider, on your behalfYou, on your device and in your backup
Who can sign a transferThe providerWhoever holds the key
Who can freeze the coinsThe providerNo intermediary is positioned to
Who reports blocked funds to OFACThe US provider holding themNo intermediary exists to file
What happens if you lose accessThe provider's own account processVery limited recovery, from your backup only

How a seed phrase derives your private keys

A recovery phrase is a readable encoding of random data, and every key in the wallet is computed from it. The BIP 39 mnemonic standard allows 128 to 256 bits of starting entropy, then turns the words into a seed by running PBKDF2 with HMAC-SHA512 for 2048 iterations. The output is a 512-bit seed, which is 64 bytes.

That seed feeds the structure set out in BIP 32 hierarchical deterministic wallets: many chains of keypairs derived from a single root. The practical result is what Bitcoin.org describes for most modern wallets. They are deterministic, so a single backup of the recovery phrase restores all past and future addresses.

Read that from the other side. Anyone who copies the phrase can compute every key the wallet will ever use. There is no account behind it to lock and no server to revoke. The phrase is the wallet.

The passphrase: an extra word that never fails

BIP 39 lets a wallet mix an optional passphrase into the derivation. The standard is specific about the consequence: every passphrase generates a valid seed and a working wallet, and only the correct one makes the intended wallet available.

So a passphrase never answers "wrong password". Enter it with a typo and the wallet loads cleanly, shows an empty balance and offers fresh addresses. For privacy that is useful, since the phrase alone opens a different wallet from the one the passphrase protects. For recovery it is a trap, because nothing tells you the passphrase you remember is not the one you set.

Watch-only setups: addresses without spending keys

Self custody does not require every device to hold the private keys. BIP 32 was written partly so a public-key-only server could issue fresh receiving addresses. Its example is a webshop whose webserver generates an address for each order or customer without access to the matching private keys.

The same split lets a holder keep spending keys offline while a phone or laptop only watches balances and produces deposit addresses. A compromised watch-only device exposes what you hold, not the ability to move it.

What a custodian can freeze or report that your wallet cannot

A custodian is a point of control that others, regulators included, can act through. Under OFAC's guidance on how to block digital currency, blocked virtual currency must be reported within 10 business days and annually after that while it stays blocked (as of October 2026). It is released only under an OFAC authorization or when the legal prohibition behind the block stops applying.

A self custody wallet has no counterpart to that process: there is no holder besides you to freeze the coins and file the report. Be precise about what that means. It describes who is able to act on the coins, not which laws apply to the person holding them. Removing the intermediary removes a lever; it does not rewrite the rules.

The recovery risk that moves to you

Holding the key means holding the failure modes too. Bitcoin.org notes that, unlike your bank, Bitcoin has very limited password recovery options. Nobody sits behind a support desk who can reset access to a key only you held.

The phrase also guards against mistakes less than it appears to. BIP 39 calls its mnemonic checksum short: it gives modest odds of catching random errors, with 1-in-256 errors missed, and it cannot correct any. A miscopied word can pass that check and restore a valid wallet that is not yours, the same silent failure a mistyped passphrase produces.

The practical reading of the standards:

  • Copy the phrase exactly and check it word by word, because the checksum will not catch every slip.
  • If you set a passphrase, back it up as carefully as the phrase, because no error message will tell you it is wrong.
  • Confirm a restore shows your existing addresses before you rely on the backup.

Privacy questions

Is a self-custodial wallet the same as a non-custodial wallet?

Yes. Both terms mean you hold the private keys and no hosted wallet provider creates and stores the wallet for you. The meaningful line runs between those wallets and hosted ones.

Can a custodian freeze my crypto?

Yes. A third party that controls your keys can freeze access to funds, and a US custodian holding blocked virtual currency must report it to OFAC within 10 business days.

Can I recover a self custody wallet without the seed phrase?

Only in very limited ways. Bitcoin has nothing like a bank's password reset, so your own backup of the recovery phrase is the recovery path.

Does one recovery phrase back up every address?

For most modern wallets, yes. They are deterministic, so a single backup of the recovery phrase restores all past and future addresses.

What happens if I enter the wrong passphrase?

The wallet opens anyway. Under BIP 39 every passphrase yields a valid wallet, and only the correct one makes the intended wallet, and its funds, available.

Primary sources

keywords

More on this rail