How do custody and security work in digital wallets?

Digital wallets are where people actually hold and move stablecoins and other crypto, so custody and security sit at the center of how this entire ecosystem works. Their setup determines who has control, who can act, and what keeps those actions safe.

Every onchain action (sending a stablecoin, approving a smart contract interaction, moving assets between networks) depends on a private key signing a valid transaction. The wallet’s primary job is to store that key securely and produce correct signatures without exposing the key itself.

Custody starts with a simple question: who controls the private keys? A digital wallet doesn’t store coins the way a physical wallet stores cash. It stores private keys: the cryptographic credentials that the network checks to confirm who can move which assets. If you hold the keys, you control the funds. If a service holds them for you, you’re trusting that service with access to your money. 

Security covers everything that protects those keys from theft, loss, or misuse. Together, custody and security define who has the authority to move funds, and how that authority is protected and exercised.

What determines whether a wallet is custodial or non-custodial?

The core difference between wallet models comes down to who controls the private keys. That single question carries legal, regulatory, and operational weight.

Non-custodial wallets

In a non-custodial wallet, the private keys sit with the user. The software or hardware helps manage the keys, but the wallet has no ability to move funds on the user's behalf. That control delivers real independence: the user initiates every action, and the network recognizes their key as the final source of truth.

Because no third party holds assets or exercises discretionary control, non-custodial wallets generally fall outside the regulatory perimeter that applies to custodians — no money transmission licenses, no know-your-customer obligations imposed on the wallet provider, no reserve or capital requirements. That regulatory lightness cuts both ways. Users get direct control and avoid counterparty risk, but they also carry the full burden of key management. A lost recovery phrase has no remedy. Device hygiene matters acutely: malware, phishing, and key exposure can each result in permanent loss of funds, with no custodian to absorb or remediate the damage.

Custodial wallets

Custodial wallets take the opposite approach: a provider generates, stores, and uses the keys on the user's behalf. The user authenticates with familiar methods — passwords, passkeys, biometrics — while the custodian handles the security work underneath.

This model triggers a different legal and regulatory profile. Depending on jurisdiction, custodians holding crypto assets on behalf of users can be subject to money transmission regulations, virtual asset service provider (VASP) licensing, anti-money laundering (AML) and KYC requirements, and — for certain asset types or structures — securities or banking regulation. Operationally, that means the custodian must maintain compliance programs, manage regulatory relationships, and carry the liability exposure that comes with holding client assets. A custodian's insolvency or misconduct can put user funds at risk in ways that don't exist in non-custodial setups.

The security trade-off runs in the opposite direction. Recovery flows lean on identity verification rather than seed phrases, which makes the experience more forgiving for mainstream users. A well-run custodian deploys infrastructure most individuals would never build themselves: offline cold storage, trusted execution environments (TEEs), and multi-person approval flows that prevent unilateral access. The question isn't whether custodial infrastructure can be strong. It's whether you trust the custodian's security posture, staff practices, and long-term operational stability.

Many teams don't have to choose one model outright. Infrastructure providers such as Privy support custodial, non-custodial, and hybrid configurations, so the custody model can match the user base and use case rather than forcing a single architecture on every user

How are private keys protected and accessed across wallet models?

Private keys sit at the center of every digital wallet design, but the way they’re generated, stored, and used varies widely. The goal is consistent: keep the key out of the wrong hands and make sure only intended transactions get signed. 

Here is how various wallet models protect and deploy private keys.

Hardware wallets

Hardware wallets keep private keys in a dedicated device that never exposes the key to the internet. Signing happens inside the device’s secure chip, and users confirm each transaction on its physical screen. This setup reduces the attack surface dramatically. Even if a computer is compromised, malware can’t extract the key. The user still needs to secure the device itself and the recovery phrase that backs it up, but the combination of offline storage and physical confirmation gives hardware wallets one of the strongest security profiles available to end users.

Software wallets 

Mobile, desktop, and browser-based wallets store keys locally, usually encrypted behind a password, PIN, or biometric lock. Keys often sit in secure hardware components. When users sign a transaction, the wallet briefly accesses the key to generate a signature. These wallets are easy to adopt, which is why they’re so common. Strong passwords, clean devices, and careful signing habits matter here.

Custodial versions of these wallets extend the same principles with institutional-grade setups. Keys often live inside TEEs or hardware security modules (HSMs), isolated from the internet. Custodial environments often rely on additional controls (e.g., multi-person approvals, role separation, and restricted physical access) so no single employee can move funds alone. 

Distributed authority

Some wallets distribute control across multiple keys or devices. A 2-of-3 multisignature setup, for example, might require a phone and a hardware wallet to jointly approve a transaction. Smart contract wallets can encode policies such as daily transfer limits or time delays directly onchain.

What security measures help safeguard authentication and transaction signing?

A wallet also has to make sure the right person is using the key, and that each transaction being signed is actually the one the user intends to approve. Authentication and signing protections create a second perimeter around the private key, focused on identity, intent, and context.

Here’s how they work.

Layered authentication

Many strong wallet systems combine multiple signals before allowing access:

• Something the user knows (a password or PIN)

• Something the user has (a second device or hardware token)

• Something the user is (a biometric check)

Combining these factors makes remote theft much harder. Even if someone captures a seed phrase or login credential, they still lack the physical device or biometric needed to complete a transaction. Some advanced wallets even require approvals on two separate user devices.

Hardware-based confirmation

Hardware wallets add another layer: they display the transaction details on the device’s screen, and the user physically approves them. Because the signing happens inside the hardware itself, malware can’t sign something different in the background. This is one of the strongest defenses against subtle transaction tampering.

Secure environments 

Many custodial wallets rely on secure hardware elements or TEEs. These enclaves run sensitive operations in isolation from the rest of the system, enforcing policies such as rate limits and requiring explicit authorization before signing.

Transaction previews and phishing defenses

Good wallet design prevents users from sleepwalking into bad approvals. Structured transaction previews (made possible by standards such as EIP-712) help people see exactly what they’re signing. Some wallets also detect known malicious addresses or contracts and issue alerts before a user connects or signs.