Where Is Your Crypto Actually Stored?
Open a crypto app and the answer seems obvious. The number is on the screen, so the crypto must be “in” the app.
That shortcut is useful until something breaks. A phone stops working. A withdrawal is paused. A provider closes. A transaction appears on a block explorer, but not in the account you expected. Suddenly, “where is it?” is not one question.
The better mental model has four parts: the blockchain record, the wallet or key system, the provider’s internal accounting, and the legal relationship described in the provider’s terms. Those parts often work together, but they are not interchangeable.
This guide explains how to separate them without turning the subject into a slogan contest.
Key takeaways
A blockchain records network transactions and asset state under its own rules.
A wallet generally manages keys and addresses used to authorize activity; it does not contain the asset like a physical wallet contains cash.
A custodial exchange may control the keys while showing you a balance in its own customer-account system.
An internal exchange trade and an on-chain withdrawal can affect different records.
The fastest reality check is to ask who controls the keys, what the blockchain shows, and what the provider’s current terms allow.
1. Treat the app like a dashboard, not an X-ray
An app screen tells you what the software is displaying. That sounds obvious, but it is an important boundary.
When a custodial exchange shows a balance, the screen may reflect the provider’s internal records for your customer account. It does not automatically prove that there is a blockchain address labeled with your name and holding exactly that amount. The provider may use pooled addresses, separate addresses, hot wallets, cold wallets, or a combination.
This does not make an app balance fake. Internal bookkeeping is normal in many financial and custodial systems. It does mean the interface answers a narrower question than many beginners assume: “What does this service currently credit to my account?”
It may not answer who can sign a transaction, where the provider holds the assets, which network route is available for withdrawal, or what happens if the provider becomes unable to honor the balance.
The app is a dashboard. It is not an X-ray of the whole arrangement.
2. The blockchain records network activity
The National Institute of Standards and Technology describes blockchains as shared digital ledgers that record transactions under network rules. Different networks use different designs, but the general idea is that participants maintain and verify a history of network activity.
For a typical public cryptocurrency, that record may show that an address received or sent a quantity of an asset. It may also show a transaction identifier, status, fee, and confirmation information.
What it usually does not show is a simple line saying, “This belongs to this specific customer at this exchange.” A public address can sometimes be connected to a person or organization through exchange records, merchants, public posts, investigations, or other information. Public does not automatically mean obvious, and pseudonymous does not mean invisible.
The FTC’s consumer guidance also warns that cryptocurrency transactions are often recorded on a public ledger. That record can help answer whether a particular on-chain transaction occurred. It cannot, by itself, explain every private obligation inside a custodial provider.
3. A wallet manages the power to authorize
A wallet’s name creates the wrong picture. It sounds like a container full of little digital coins. Technically, a crypto wallet is closer to a key-management and transaction-signing system.
Wallets generally manage private keys, public keys, and addresses. A private key is used to authorize activity. Recovery material—often a seed phrase—may allow someone to recreate access through compatible wallet software.
That is why losing a phone does not always mean losing the assets. If you still control valid recovery material, you may be able to restore access. It is also why sharing a private key or seed phrase is so dangerous. Someone who obtains that information may be able to recreate the same control elsewhere.
Investor.gov’s custody guide for retail investors distinguishes self-custody from third-party custody by focusing on who controls the cryptographic keys and who bears the related security responsibilities.
The practical question is not simply, “Which wallet app do I use?” It is, “Who can authorize a transaction, and how is that authority recovered or protected?”
4. An exchange balance adds a provider relationship
With a custodial exchange, the provider may control the private keys while maintaining a customer balance in its own system. That arrangement can reduce the user’s technical burden, but it adds dependence on the provider’s cybersecurity, operations, withdrawal policies, financial condition, and contracts.
Suppose you trade Asset A for Asset B inside the exchange. The provider can update its internal customer ledger without sending Asset B to a blockchain address controlled by you for every tap. This is a general model; platforms, tokens, and settlement systems vary.
A withdrawal is different. The provider may authorize an on-chain transaction from an address it controls to the destination address you supplied. The blockchain records that movement, and the exchange reduces your internal account balance.
One action can touch two ledgers.
The legal relationship also matters. If a provider fails, the treatment of customer assets can depend on the account agreement, how assets were held, applicable law, and a court’s conclusions. The U.S. Government Accountability Office has described situations in which customers could be treated as unsecured creditors if assets are determined to belong to a bankruptcy estate rather than directly to customers. That is a conditional risk—not a statement that every exchange customer is automatically a creditor.
5. Use the three-question test
When an app makes the arrangement feel simple, use three questions to restore the missing context.
Who controls the keys?
If you control them, identify the wallet, backup method, and recovery process. If a provider controls them, identify the provider and the conditions under which it processes withdrawals.
What does the blockchain show?
When an on-chain transfer exists, look for the correct network, destination address, and transaction record. Do not expect a public blockchain to display every update inside a provider’s customer-account system.
What do the provider’s current terms allow?
Check whether assets may be pooled, lent, restricted, or delayed. Ask what withdrawals require, what protections actually apply, and what happens during a failure. Do not assume that a clean interface answers those questions.
These questions do not declare self-custody or third-party custody the universal winner. Self-custody increases direct control but also increases responsibility for recovery material and transaction accuracy. Third-party custody can reduce that operational burden but introduces provider dependency.
The goal is not to repeat a custody slogan. It is to understand which risks you are managing yourself and which risks you are delegating.
Watch the full lesson
The full video uses a visual three-layer map to show how the blockchain, wallet, and exchange records connect:
Watch the full lesson on YouTube
Keep the checks nearby
Download the free Crypto Safety Checklist for a printable reminder of the core safety checks.
For a more structured next step, explore the Crypto Safety Starter Kit (paid).
Never share a private key or seed phrase with someone offering help. Do not post account details, recovery information, or private financial information in public comments.
Sources and further reading
NISTIR 8301 — Blockchain Networks: Token Design and Management Overview
Investor.gov — Crypto Asset Custody Basics for Retail Investors
Disclosure and education boundary
Evan is a fictional AI presenter. AI tools assisted with narration and visual production. The Crypto Passage reviews and approves the research, claims, scripts, and final content before publication.
This article is for general education only. It is not financial, investment, legal, tax, or security advice. Provider terms, laws, technical designs, and available protections can change; verify current information directly with the relevant provider and qualified professionals when appropriate.
