What does “Not your keys, not your coins” mean?
In short
“Not your keys, not your coins” means that if you don’t control the private keys to your crypto, you depend on whoever holds them to access and move it.
You see crypto in your account, but who can actually move it?
Think of a locker where you keep your belongings, but someone else holds the only key. To take something out, you have to ask them. Holding crypto on a centralized exchange works in a similar way: the platform usually manages the private keys, i.e. the secret data used to sign transactions. You log in to your account and submit a withdrawal request.
With a self-custody wallet, by contrast, you control the keys and can sign transactions without a custodian’s approval. The crypto isn’t inside the app or the device; the relevant records are on the blockchain.
Why it matters
If a platform suspends withdrawals, gets hacked or goes bankrupt, the balance on your screen doesn’t ensure you can move it at that moment. Your login password is not a private key, and two-factor authentication (2FA) doesn’t give you control of the platform’s keys either.
The phrase is mainly about practical control, not an absolute statement about legal ownership. You may have rights against the provider without being able to move the crypto yourself. We find this distinction more useful than treating the slogan as a rule that every exchange is unsafe.
What to watch out for
Self-custody also shifts the responsibility to you. If the necessary keys and recovery backups are lost, access can be lost for good. If a third party gets hold of them, they can move your crypto without your permission.
In many wallets, the seed phrase (recovery phrase) lets you restore the keys. Never share it with anyone, not even with supposed tech support. And holding the keys doesn’t eliminate other risks: a deceptive signature request or a malicious approval in an app can also lead to losses.