Custodial or non-custodial: who really holds your crypto

The one-question test

If the company disappeared tomorrow, could you still move your funds? If yes, the wallet is non-custodial. If you would have to ask a company for permission, it is custodial.

Ethereum.org describes the split this way: wallet providers that are non-custodial do not have custody of your funds and only give you a way to view and manage assets, while a centralised exchange account is a case where you are trusting that exchange with custody over your funds, with the warning that funds could be at risk if it gets into financial trouble (ethereum.org wallets). The page does not use the exact words custodial and non-custodial, so we are paraphrasing its description rather than quoting a definition.

Two different risk models

Think of each as trading one risk for another. Neither is free of danger.

A frequent misreading: custodial means safe from phishing. It does not. You face a different form of the same attack, such as fake login pages, fake support agents and credential theft. The loss path just goes through your account rather than a signature.

Comparison table

Rows describe the general model, not any single product. Features differ between providers, so confirm details in each provider’s own documentation before relying on them.

Why airdrops require non-custodial addresses

A protocol airdrop is a set of on-chain balances assigned to addresses. The project looks at its public records, such as who used a contract before a snapshot, and credits or lets those addresses claim. For you to claim, the eligible address must be one whose private key you control. Our airdrop basics guide covers the mechanics in more detail.

The documented Uniswap distribution shows the principle: the allocation was tied to addresses that had called its contracts, and users claimed with those addresses (Uniswap blog). Activity done from an exchange deposit address belongs, on-chain, to the exchange, not to you.

What exchange-run campaigns are

Exchanges sometimes run their own reward programs, such as promotional token credits, tied to your account. These are the exchange’s decision, governed by its terms, and typically credited inside your custodial balance rather than to a wallet you control. They are not the same product as a protocol airdrop, and eligibility rules are the exchange’s alone. Editorially, we treat them as marketing promotions: read the terms, and do not move funds around chasing one. We do not list exchange promotions as protocol airdrops.

Regulation and KYC in general terms

We deliberately avoid jurisdiction-specific legal claims here, since we did not open regulator pages for this guide. The general shape is stable enough to describe. Services that hold customer funds and convert to national currency are commonly asked to identify customers, which is what KYC means. Software that only manages keys you hold does not take custody and so does not usually hold identity data. The practical consequences:

• Selling to cash will almost always run through a service that verifies identity. Plan for it before you have a large balance.
• Using a non-custodial wallet is not a way to avoid tax or reporting duties. Our tax guide explains how to find your local rules.
• Terms and rules change. For legal questions, read your national regulator or tax authority’s own pages, or ask a qualified adviser.

Decision tree

Answer honestly. The tool runs locally in your page and stores nothing.

Failure modes we see most

• Non-custodial: one seed phrase stored as a phone screenshot; a single wallet used for farming and savings; approvals never reviewed; a claim signed on a lookalike domain.
• Custodial: a reused password across services; SMS-only two-factor; leaving a large balance on an account for months because withdrawing feels like effort; trusting a support message that arrived through a private channel.
• Hybrid: the layers drift. A burner slowly accumulates value, or the cold wallet gets connected once to a claim page for convenience. Review the boundaries every few months.

Ethereum.org also states that staff of legitimate projects do not reach out through unofficial private channels, which applies equally to exchange support and wallet support. If a message arrives unprompted, open the provider’s official site yourself and look for the same notice there.

Moving from a custodial account to your own wallet

Most people start on an exchange and later want an address they control. A cautious sequence, as editorial advice:

1. Create the wallet on a clean device and write the recovery phrase on paper. Never type it into a website.
2. Send a very small test withdrawal to the new address and confirm it arrives on the right network.
3. Only then move the remainder, in stages if the amount is large.
4. Restore the wallet from the phrase on a second device once, with only the small balance in it, to prove the backup works.
5. Keep the exchange account for the sell step, and turn on app-based two-factor there.

Addresses and networks matter: a transfer sent on the wrong network can be hard or impossible to recover, and transactions cannot be reversed, as ethereum.org notes. Copy the address from the wallet itself, compare the first and last characters after pasting, and never type it from memory.

The hybrid setup

Most serious airdrop hunters end up with three roles, each with its own wallet. This is our editorial recommendation, not a standard.

1. Burner wallet for farming and claiming

   Holds a small float for gas and activity, and nothing else. It touches unfamiliar apps, claim pages and test signatures. Expect to lose it eventually, and size it accordingly. The burner wallet guide shows the setup. Check its approvals regularly with the revoke guide.

2. Cold storage for what you intend to keep

   A hardware wallet or equivalent, used rarely, never connected to claim sites. Move claimed tokens here once you decide to hold them.

3. Custodial account only for selling

   Used as the exit: send tokens in, sell, withdraw to a bank. Keep balances near zero between uses. Our selling guide compares venues.

The value of the layers is that a mistake in one cannot spill into another. A drained burner costs you a float. A hacked exchange login costs you whatever you left there that day.

Hardware wallets and seed phrase basics

Ethereum.org presents hardware wallets as the most secure option for storing keys offline, because the private key never touches the internet and stays on the device. It names Ledger and Trezor as examples and we did not open vendor documentation, so we make no claims about specific models or features (ethereum.org security).

Never share the phrase

Ethereum.org: never for any reason. Anyone with it can drain your accounts, and no legitimate service will ask for it.

No screenshots, no cloud notes

Images and notes can sync to cloud storage, a common target for attackers.

Write it down, store it offline

Ethereum.org advises writing it down and keeping it safe rather than saving it on a computer. We would add: keep at least two copies in separate places, and test recovery with a small balance before trusting a setup.

A hardware wallet does not read for you

It protects the key, not your judgement. Approving a malicious permit on the device still hands over the assets.

With the structure in place, continue with the list of latest airdrops or the airdrop tracker, and read how to verify a campaign before you sign anything.

Written and fact-checked by the airdrop.promo Editorial Team. Method: how we verify. Spotted an error? contacts@airdrop.promo. Educational content only, not financial or tax advice.