The Wonderful World of Wallets
The first wallet I remember owning was green, plastic, and had a picture of the Incredible Hulk on it. Since I was a child at the time, I didn’t really have anything to put in it. I had no bank cards, no identification and not much money as it was usually spent on candy and comics. But I did put things into it, because I felt I had to keep things in my wallet since they serve such an important function.
It is slightly misleading that the term wallet is used to describe the balances held by someone on a blockchain network. It makes it sound like there is some sort of object that controls the tokens and is able to spend or release them. But it’s the keys that control the balances, the wallet is a piece of software that stores the keys and prepares transactions for signing.
If you recall, holding a balance requires the use of a key pair, the private key and its public key. The public key is the address used when someone wants to send tokens to you. All token balances are typically linked to public keys. The private key is used to sign a transaction when you spend your tokens. Only you know your private key and it is extremely difficult to determine the private key from a public key.
This of course assumes that you are managing your own wallet and keys. Perhaps you have an app on your phone that holds the keys and you’ve written the passphrase to recover it on a piece of paper somewhere. If you are an experienced crypto trader, you may even have one or more wallets installed as components of your web browser. You could even own a hardware wallet like Ledger. These are all examples of “non-custodial” wallets. They are called non-custodial because the keys are managed by the user and not by a company acting as a custodian.
With custodial wallets, your balance and keys are managed by a third party, like an exchange or a bank. You log into their application or webpage using your login and password. Within their application, they may be tabs or buttons that allow you to send or receive tokens as well as possibly buy and sell them. You do not have legal control of these assets, but you do have beneficial control which means you are entitled to any payments resulting from holding the token balance.
Most crypto is unregulated which means that there is limited recourse if the company holding your tokens goes into administration. With the banks, your deposited cash is protected up to a given amount (which varies in different countries) and if the bank fails, the government intervenes to guarantee the recovery of your deposited balance, but no more than the legislated maximum. Regulated financial companies are required to keep client money separated from other funds so that the money can be more easily recovered in the event of company failure.
With crypto, there is no requirement to keep client balances segregated from company balances. There is very little regulation in place to protect client assets. This is likely to change, especially with larger adoption of the technology. In Europe, both the MiCA and DORA legislations have been passed to define some rules around crypto. In the US, the GENIUS act has recently been passed and the CLARITY act is making its way through congress. Crypto is slowly becoming regulated.
Get Paul Bark’s stories in your inbox
Join Medium for free to get updates from this writer.
So when you use a custodial wallet, you are putting your trust into the company offering the services; so ensure you do your research. How strong is the company’s cybersecurity? How often are their technologies and controls audited? Who in the company has access to the keys? Are your assets going to be held in a unique wallet for yourself or pooled with other users’ balances.
When these custodial companies grow, they become targets for criminals and thieves. Why would anyone go after a wallet with a small balance when there are companies with large token balances held in their wallets that make a nice fat target. The methods of getting at the balances are no different that the methods scammers use to get access to your bank details: phishing, finding someone on the inside, or relying on lazy cybersecurity such as a password left in its default value.
So when you hold a balance with a custodial wallet provider, you are trusting that the company is a legitimate company with strong controls in place. Just as you trust a bank to hold your deposited money.
With a non-custodial wallet, you are free to send your tokens wherever you want. With custodial solutions, the client is usually limited to withdrawing tokens to another wallet held by them. A few years ago, the “travel rule” was introduced to address money laundering. The travel rule requires the custodial service to provide details of the sender and receiver to the manager of the receiving wallet when a transfer happens. The receiving wallet then does their due diligence and provides a response to the sender on whether they will accept the payment. This is only when both wallets are custodial; the manager of the sending wallet may require their client to prove ownership of a non-custodial wallet before sending anything to it.
So for a custodial service to make payments on your behalf, they need to gather details of the payment beneficiary and then do some checks on them. This is a lot of effort for a transaction that may only earn them a few dollars, so it’s easier to tell their clients that they can only withdraw to their own wallets.
While it may be easier using a custodial service, you have no control over what you can do with your tokens such as where you send them and you have little recourse if the custodial service failed as a company.
But the alternative can be just as concerning. You can have a hardware wallet, but if you lose it, then you lose the balance held on that wallet. You can have a software wallet, but you’ll need to record your recovery phrase somewhere safe. You could store that phrase as a text file or even take a picture of the passphrase, but if anyone gets access to your device then they could find the passphrase and take your tokens.
Both custodial wallets and non-custodial wallets have their risks and benefits when it comes to managing balances. There is another option called “account abstraction” but that’s a subject I’ll leave for a future post. Before I get to that subject, however, I’m going to pivot away from blockchain and start describing cryptography instead. Cryptography is the ability to mask information and is the cornerstone of the internet.
