Many long-term Bitcoin and Ethereum holders share one belief: “If I hold my own keys, I’m safe.” It’s a good instinct. It’s also only half the picture once your coins enter a DeFi protocol.
Custody risk in DeFi is the chance of losing access to, or control over, your crypto because a private key is lost, stolen or mismanaged, or because a smart contract, an admin key or a bridge fails while holding your assets. You can shrink that risk a lot, but only if you know where control actually sits at each step.
This guide walks through who controls what, the main ways custody goes wrong, and a practical set of habits. If you’re a professional or a parent with a decent pile of BTC or ETH and you’re curious about earning from it without selling, this is the groundwork to do first.
TL;DR
- Custody means control of the keys that authorize transactions. In DeFi, you can keep the key while a smart contract holds the deposited assets under its code.
- The big custody risks are lost or stolen keys, smart contract bugs, powerful admin keys, and bridges.
- A lost key can make assets permanently inaccessible, and there’s usually no support desk to call.
- Hardware wallets, careful transaction checks, backups in more than one place and small position sizes do most of the work.
- We teach this as education. Members keep control of their own assets, and nothing here is a guarantee of returns.
Table of Contents
- What custody means in DeFi
- Holding the key is not the same as holding the coins
- The main custody risks, in plain English
- How custody risk shows up when you borrow or provide liquidity
- Safeguards that actually reduce custody risk
- A quick pre-deposit custody check
- How we help you work through this
- FAQ
- Sources
What custody means in DeFi
Custody is control over the private keys that authorize transactions. This follows the Enterprise Ethereum Alliance’s DeFi risk guidelines, which tie custody to control of private keys, describe custodial risk as loss or theft when a private key is lost or stolen, and name private-key mismanagement as a risk.
There are three common setups:
- Self-custody: you control the keys.
- Third-party custody: a provider controls the keys, and therefore the assets.
- Hybrid or multisignature: control is split across several parties or devices.
Wells Fargo Investment Institute describes the same three models in its April 2026 digital asset custody report: the investor manages keys in self-custody, control is distributed in hybrid custody, and a professional provider manages keys in third-party custody.
Here’s an everyday way to think about it. Your key is like the key to a safe deposit box. Whoever holds it can open the box. Lose it, and the bank can’t just make you a new one, because in crypto there is no bank.
Holding the key is not the same as holding the coins
This is the part that surprises people. In DeFi, you can control your wallet key while a smart contract controls the deposited assets according to its code.
So when you supply ETH to a lending pool, you still sign with your own wallet. But the ETH itself now sits under the rules of that contract. You get a position or a receipt back, and you can get your assets out only as far as the code allows.
That’s still non-custodial in the sense that no company holds your funds. But “non-custodial” doesn’t mean “no risk.” It means the risk moves. Instead of trusting a company not to run off with your coins, you’re trusting code, the people who can change that code, and your own habits.
That’s not a reason to avoid DeFi. It’s a reason to know exactly what you’re agreeing to before you click approve.
The main custody risks, in plain English
Lost or stolen keys
Greg Hopper’s slide presentation to the Office of Financial Research’s advisory committee (paper on DeFi risks) notes that if a private key is lost, the matching crypto is lost for good.
Self-custody also moves responsibility onto you. CoinGecko’s security guide says it reduces dependence on exchanges but puts the burden on the user, including the risk of revealing a seed phrase or sending funds to the wrong address.
In plain terms: no one is going to reverse a mistake. Simple mistakes, such as sending to the wrong address or typing a seed phrase into a fake website, are among the common ways ordinary holders lose funds, and none of them need a sophisticated exploit.
Smart contract risk
Once your assets are inside a protocol, the contract’s code decides what happens. A bug, a design flaw or an unusual market condition can freeze withdrawals or trigger liquidations. Even a perfectly written contract can only follow its own rules, and those rules might include fees, delays or lockup periods you didn’t read.
Admin keys and upgrade power
Some protocols and tokens have privileged functions. A custody-risk framework from a major exchange’s research team, published on Coinbase’s blog, lists examples such as blacklisting, confiscation, arbitrary upgrades, unauthorized transfers, minting and pausing. It also explains that an upgrade authority can change the logic that governs deposited assets, which could alter interest rates, collateral requirements or basic functionality without each depositor signing anything.
A protocol’s admin setup is something you can look up. Who can upgrade it? Is it one person or a group? Is there a delay before changes take effect? Those are custody questions even though they don’t feel like it.
Check Point Research documented how an attacker drained roughly 50 million USDC from the Infini protocol in 2025 after obtaining a privileged key and using it to grant a redeeming role, register a destination and withdraw. The lesson they draw is least privilege: one authority shouldn’t be able to grant roles, approve destinations and enable withdrawals all at once. Their lessons include separating roles and setting withdrawal limits, alongside common safeguards such as hardware wallets, multisignature controls, timelocks and monitoring.
Bridges
If you move BTC or ETH to another chain, you often use a bridge. Greg Hopper’s presentation to the Office of Financial Research’s advisory committee points out that tokens mirrored onto another chain through a bridge are less secure than the original, and that bridge risk can be systemic, spreading beyond one chain.
So a wrapped coin on another network is a different thing from the coin you started with. We cover the checks worth doing in our bridge risk guide.
How custody risk shows up when you borrow or provide liquidity
These are the two strategies many of our members care about: borrowing against BTC or ETH instead of selling, and earning fees from liquidity pools. Both put your assets under a protocol’s rules, so custody risk is part of the package.
With borrowing, your collateral gets locked in a smart contract. You keep your keys, and the contract can only do what its encoded permissions and liquidation rules allow. That’s the appeal, and it’s also the catch: if the collateral’s value falls past the protocol’s liquidation threshold, third-party liquidators can repay part of your debt and claim your collateral at a discount, and no one calls you first. A custody check here means understanding the liquidation threshold and keeping a cushion, not just trusting that you hold your keys.
With liquidity pools, your deposit sits in the pool, and you may receive a token representing your share. The risks stack: smart contract bugs, impermanent loss (the gap between what you’d have if you’d simply held the coins and what your pool share is worth), fees, delays and withdrawal conditions. Our guides on liquidity pool risks and a 15-minute pre-deposit check and liquidity pool strategy go deeper on those. If you’re weighing options, staking versus lending is a useful side-by-side.
None of this means these strategies are off the table. It means each one deserves a position size you could live with if the worst happened. Think of it like a home renovation: you plan for the budget to overrun, and you never put the mortgage payment into it.
Safeguards that actually reduce custody risk
Security frameworks recommend a fairly consistent set of habits. Here’s how they translate for an individual holder.
Protect the key itself
- Use a hardware wallet for meaningful amounts. The Security Alliance’s multisig best practices recommend hardware wallets and verifying raw transaction data and recipient addresses.
- Never store a seed phrase digitally. The Security Alliance’s multisig operations framework says seed phrases should not live in cloud storage or photos, and that backups should be geographically distributed, avoid a single point of compromise and stay recoverable if one person is unavailable. That last point matters for families: if something happens to you, can your spouse recover the assets, and could anyone else?
- Use a dedicated device for high-value signing. The same framework calls for a secure signing environment and for confirming signer identities through a separate, authenticated channel. Unexpected “support” messages are a classic trap.
Check before you sign
Security Alliance guidance for multisig signers recommends independently verifying the transaction details before signing. You don’t need to read raw calldata yourself, but you should at least confirm the network, the address and the amount on your hardware wallet screen, not just on the website.
There’s also a newer wrinkle. Trail of Bits advised in November 2026 that signing systems should reject unnecessary EIP-7702 delegation for custody accounts, and where delegation is needed, approve the account, delegate address and code, chain and nonce separately. For an individual, the takeaway is simple: if a prompt asks you to delegate your account’s authority to a contract and you don’t know why, stop. A single delegation signature can leave that control in place until it is changed or cleared.
Limit the damage if something fails
Trail of Bits’ cold-storage guidance argues that key security alone isn’t enough. Separating configuration authority from operational authority, plus limits, delays and monitoring, can reduce losses even after a key is compromised. LayerZero’s security documentation is another example of security guidance written for protocol teams.
Most of that is aimed at teams, but the principle scales down to you:
- Keep your long-term BTC and ETH in a wallet you rarely touch.
- Use a separate wallet for DeFi activity, holding only what you’re willing to put at work.
- Size positions so one failure doesn’t change your family’s plans. Our position sizing guide covers this.
- Track what you’ve deposited and where. A portfolio tracking approach makes it harder to forget an old approval or a forgotten position.
Our seven DeFi wallet security checks and the 30-day risk checklist turn these into steps you can tick off.
If you ever use a third-party custodian
Some holders keep part of their crypto with a provider. The EEA guidelines suggest documenting key-management procedures and expect third-party key custodians to conform to the CryptoCurrency Security Standard (CCSS). ISO 27001 certification and SOC 2 Type 2 reports are also common terms in security due diligence on providers. Even if you never read an audit report line by line, knowing those terms tells you what a serious provider should be able to show.
A quick pre-deposit custody check
Before moving BTC or ETH into any protocol, run through these questions. They don’t take long, and they’re worth doing every time.
- Where will the assets sit? In my wallet, in a contract, or on another chain through a bridge?
- Who can change the rules? Is there an upgrade key, and is it protected by a multisignature and a delay?
- What can leave my wallet? Is the approval limited to the amount I intend, or unlimited?
- What’s the exit? Are there lockups, withdrawal queues or unbonding periods?
- What happens in a bad market? At what price would liquidation occur if I’m borrowing?
- Can my family recover this? Is there a documented, secure way to find the keys if I can’t?
- How much am I okay losing? If the answer makes your stomach drop, shrink the position.
Skipping a deposit is better than rushing one. There’s no prize for being first into a pool.
How we help you work through this
OverseasDeFi is education, tools and coaching. We don’t take custody of customer funds or manage investments for you. Members keep control of their assets and make their own decisions, and we focus on explaining the mechanics and what can go wrong before you put a strategy into practice.
Community and Accelerator offer different levels of support, from structured learning and tools to live human guidance. Because we teach wallet security before any income strategy, custody and wallet setup are where we start. If that’s the part that makes you hesitate, it’s a good reason to get live help rather than guess. You can see both options on our main page.
If you’d like to start on your own first, our guide on earning yield without selling your Bitcoin or Ethereum and our broader crypto risk management guide are good next reads. No pressure either way.
FAQ
Is DeFi really self-custody if my crypto is locked in a smart contract?
Yes and no. You still control the wallet key that signs transactions, but the deposited assets are governed by the contract’s code. No company holds them, though you can only withdraw under the contract’s rules. That’s why reading the terms and understanding who can change the contract matters.
What happens if I lose my private key?
A presentation to the Office of Financial Research’s advisory committee notes that a lost key can leave the associated assets permanently inaccessible. There’s generally no password reset. That’s why geographically separate, offline backups, and a plan your family can follow, are so important.
Is a hardware wallet enough to protect me in DeFi?
It’s a strong foundation, and security guidance recommends it, but it doesn’t remove protocol risk. A hardware wallet protects your key. It can’t stop a contract bug or a malicious approval you confirm yourself. Verify what you sign on the device screen and keep DeFi positions sized sensibly.
Are bridges riskier than staying on one chain?
They add another layer to trust. A presentation to the Office of Financial Research’s advisory committee describes bridged tokens as less secure than the originals and bridge risk as systemic. If you don’t need to bridge, you avoid that layer. If you do, check the bridge carefully first.
Does OverseasDeFi hold my crypto?
No. We provide education, tools and coaching. You keep control of your assets and make your own decisions, and we don’t manage investments on your behalf.
Sources
- EEA DeFi Risk Assessment Guidelines, Version 1
- Custody of digital assets, Wells Fargo Investment Institute
- DeFi: New Risks Require New Approaches, Office of Financial Research
- Master Guide To Crypto Security, CoinGecko
- Token Custody Risks: Defining Security in the Crypto World
- How an Attacker Drained $50M from a DeFi Protocol, Check Point Research
- Secure Multisig Best Practices, Security Alliance
- SFC: Multisig Operations, Security Alliance
- Safer cold storage on Ethereum, Trail of Bits
- After Binance, check what your signing systems can approve, Trail of Bits
- Security and Compliance, LayerZero documentation