GM, COT❣️ Yuzunoko here.
If someone asked you right now where your private key or seed phrase is written down, could you answer straight away?
There are two broad ways to keep crypto assets. One is a wallet where you manage the keys yourself. The other is an account where you leave the keys with a crypto exchange or a similar provider.
Which one you use changes who you can turn to when something goes wrong, and what you need to be careful about.
Hold your own keys, or leave them with someone else?
A report from a survey that Japan's Digital Agency (the government agency in charge of digital policy) commissioned from Nomura Research Institute (a Japanese research and consulting firm), published in March 2026, splits wallets into these two types.
- Unhosted wallet: a wallet where the users manage their own private keys instead of leaving them with a provider. Also called a non-custodial wallet
- Hosted wallet: a wallet where a third party, such as a crypto exchange, manages the user's private keys. Also called a custodial wallet
If your crypto is sitting in an exchange account, you're in the second group. The same report names MetaMask as a typical example of a software wallet, the kind that runs as a browser extension or a phone app.
ethereum.org's guide to wallets touches on the same difference. On a centralized exchange, your wallet is linked to a username and password, so you can recover it the traditional way. But, it says, remember that you're trusting that exchange with custody of your funds.
For holding your own keys, it says plainly that "there's no customer support in crypto." So convenience and responsibility point in exactly opposite directions.
Side by side, the two look like this.
Private key, seed phrase, address: what's the difference?
The words sound alike and are easy to mix up, so here they are as the report's glossary defines them.
- Private key: the cryptographic key needed to send assets and sign. If it leaks or gets lost, you lose your assets, so it has to be kept under strict control
- Seed phrase: a string of 12 to 24 English words used to restore the private key. Entering it lets you recover the wallet
- Public key: public information generated from the private key. The wallet address is created from it, and it can be shared with others
- Wallet address: the string used as the destination for sending and receiving. An identifier, like a bank account number
If you remember that the address is the only thing you can tell other people, you won't get confused. Since a seed phrase can restore the private key, it deserves the same care as the private key itself (a whole row of jargon like this is enough to make me tense up).
Why you should never tell anyone your seed phrase
The Japan Virtual and Crypto assets Exchange Association (JVCEA, the self-regulatory association for crypto exchanges in Japan) lists, as a checkpoint for avoiding scams, that you should "never share" your private key, seed phrase, or two-factor authentication codes. They are the keys to your assets, and telling them to someone is "the same as handing over your whole wallet."
The same page also describes common scams. Some come up with a reason, like "to verify your identity" or "needed to restore your assets," to get you to type in your private key or recovery phrase. Others lure you with "get rewards just for connecting," have you connect your wallet, and then your assets are sent away without your say.
So even if a message claims to be from support, you can stop right there the moment it asks for your seed phrase.
ethereum.org also says that transactions can't be reversed. With a wallet where you hold your own keys, there's no desk that will cancel something once it has been sent.
What to watch out for when storing it
In the report's survey, the most common way people managed their seed phrases and private keys was "saved in a notes app or file on a PC or smartphone (including screenshots)," at 38.3%. Next came "copied onto paper and stored" at 32.1%, and "managed with a password manager" at 25.7%.
The report points out that saving these as plain text or images on an online device is considered a high security risk, yet about 40% of users do exactly that.
ethereum.org also advises not storing your seed phrase on a computer, and writing it down and keeping it somewhere safe. I get wanting to just take a screenshot, but that's exactly the riskiest part (the camera roll really is where everything ends up, though).
If you use an exchange account, there's still work for you to do. JVCEA asks users to always set up multi-factor authentication if it's offered, not to reuse passwords, to open the official site from a bookmark, and not to open links in emails or SMS.
The Financial Services Agency (FSA, Japan's financial regulator) explains that crypto asset exchange service providers must be registered with the FSA or a Local Finance Bureau, and asks users to check that a provider is registered before using it.
How the COT whitepaper handles it
The official whitepaper of COT (Cosplay Token) defines "self-custody" in its glossary as a setup where users don't leave their assets with a third-party institution or a centralized exchange, and instead manage their private keys themselves with a wallet such as MetaMask. Self-custody is presented as one option, and the final choice of how to manage your assets is described as being up to you.
Neither one is simply the right answer.
If you hold your own keys, storing them is on you. If you leave them with someone else, checking who you're leaving them with and setting up multi-factor authentication are on you.
Before you start, at least decide where your keys are going to live (start without deciding that, and I have a feeling you'll end up hunting for them later).
About this article
This article is based on a report from a survey commissioned by Japan's Digital Agency, warnings from the Japan Virtual and Crypto assets Exchange Association, the Financial Services Agency's page and warning materials for users, ethereum.org's guide to wallets, and COT's official whitepaper. Features and screens of wallets and exchanges can change, so please check each one's official explanations before using them.
In Japan, the contacts listed for help with suspicious solicitations or messages are the FSA's Counseling Office for Financial Services Users (0570-016811), the Consumer Hotline 188, and the police consultation line #9110.
For decisions about your own situation, please consult a professional. This article is meant to help you understand how things work, and it is not a recommendation to buy or sell crypto assets.
Quotes from Japanese sources are our own translations.
Translated from the Japanese original.
See you next time on COT❣️