A non-custodial wallet is a crypto wallet where only you hold the private keys, and in ten samples of Ethereum blocks from mid-September to mid-October 2026, about one in ten USDT and USDC approvals set the maximum possible allowance. Self-custody hands you the keys and the recovery. It also leaves you alone with every approval you sign.
Those approvals are where self-custody's protection stops. The ERC-20 token standard lets an approved address withdraw from your account "multiple times" up to the amount you set, with no expiry date. One maximum USDT approval set in mid-August 2026 was spent in the same transaction and still stood at the full maximum two months later.
Non-custodial wallet | At a glance |
What it is | A wallet where only you hold the private keys |
Who moves funds | Your key's signature, or a contract you approved |
Recovery | Your seed phrase, with no password reset |
Your job | Every token approval you sign, until set to zero |
Example | A browser, mobile or hardware wallet you set up |
Main risk | A lost backup or a signature you didn't read |
On Phemex | A custodial account, with withdrawal whitelisting |
What Is a Non-Custodial Wallet?
A non-custodial wallet, also called a self-custody wallet, is an app or a device that keeps your private keys under your control alone. SEC staff describe the arrangement in a December 2025 investor bulletin, where self-custody means "you have sole control over the access to your crypto assets' private keys". The same bulletin names the price, "sole responsibility for the security" of those keys.
Every self-custody cryptocurrency wallet works on that principle. A browser extension, a phone app and a hardware device can each be one, since the label describes who holds the keys and says nothing about the device they live on.
That makes the real test for a non-custodial crypto wallet a question of who can move the coins without you. A token approval you signed months ago fails that test, because the contract you approved can still pull that token up to the amount you allowed.
How Does a Non-Custodial Wallet Work?
Your wallet holds a private key that signs and a public address that receives, the pairing explained in Bitcoin public vs private keys. Coins leave the wallet when your key signs a transfer, and the network checks that signature against your address before it accepts the move.
No company stands behind the wallet, so there's no password reset. The seed phrase it shows you at setup is your backup, and it rebuilds the same keys on a new device if the old one breaks or goes missing.
Tokens on Ethereum add a second kind of permission, set out in the ERC-20 token standard of November 2015. An approval gives another address a spending allowance on one of your tokens, and a new approval for the same address overwrites the old one. The standard gives an approval no end date. Taking it back means sending a new approval of zero, an on-chain transaction with its own fee.
Wallets also sign messages that never reach the chain by themselves. ERC-2612 is a token extension from April 2020 that lets a token accept an approval as one of those signed messages, known as a permit.
Is a Non-Custodial Wallet Safe?
A non-custodial wallet is safe from a custodian's failures, because no third party holds your keys to lose or lend. Its safety then rests on two things you control, the backup and the signatures you give out.
What Does Self-Custody Not Protect You From?
Self-custody doesn't protect you from your own approvals. Ten 50-block samples on Ethereum, taken every three days from mid-September to mid-October 2026, held 6,909 approvals recorded by the USDT and USDC contracts. Of those, 706 set the maximum possible amount, so about one in ten (10.22%) handed out the largest allowance a token can record.
Each total share below divides by the approvals of the token or tokens in its row across all ten windows, and each end of a range by that token's approvals in a single window.
Token | Set to the maximum | Range across windows |
USDT | 253 of 2,156 (11.73%) | 6.94% to 21.80% |
USDC | 453 of 4,753 (9.53%) | 4.42% to 17.28% |
Both | 706 of 6,909 (10.22%) |
The share moved a lot from one window to the next, so it describes these samples and makes no claim about every approval on Ethereum.
Method: the samples are ten windows of 50 Ethereum blocks, spaced 21,600 blocks apart (about three days). A public node returned every Approval event the USDT and USDC contracts emitted in them. An approval counts as maximum when its amount equals 2^256 - 1, a 78-digit number.
A maximum approval can also survive being used. OpenZeppelin's reference ERC-20 code leaves a maximum allowance "not updated" when the spender pulls tokens, and calls that "semantically equivalent to an infinite approval". USDT's contract on Ethereum skips the deduction at the maximum in the same way. That's how the mid-August approval kept its full maximum after about 10,000 USDT passed through it.
Permit signatures carry the same exposure off the chain. Under ERC-2612, whoever holds a signed permit can submit it and set the allowance. In the standard's own words, "The caller of the permit function can be any address."
The deadline in a permit limits when the signature can be used, and the allowance it creates has no end date. USDC's Ethereum contract accepts permits, and USDT's has no permit function.
The issuer keeps its own controls as well. USDT's contract gives its owner functions to blacklist an address, destroy a blacklisted balance and pause transfers. Tether's terms, last updated in February 2026, say the company may "freeze any Tether Tokens held by you". Holding USDT under your own keys leaves those powers in place.
Can a Non-Custodial Wallet Be Hacked?
Yes, and the usual way in is a signature you approve, because a properly generated private key can't be guessed in practice.
Blind signing is the common opening. The EIP-712 standard from September 2017 set out to fix it. Its authors described signed messages as "an opaque hex string displayed to the user with little context about the items that make up the message".
A wallet that shows a permit's spender and amount in plain fields gives you something to check. A hex string gives you nothing to go on. Sign a USDC permit on a phishing site, and the attacker can submit it and pay the fee. Your tokens then leave without another click from you. A permit request deserves the care you'd give a transaction.
The other route skips signatures entirely, since anyone who gets your seed phrase can rebuild the wallet. Keeping that phrase offline is the subject of how to back up a crypto wallet's seed phrase.
What Is the Difference Between a Custodial and a Non-Custodial Wallet?
The difference is who holds the private keys. A custodial wallet is an account at a third party. The SEC bulletin says such custodians "include crypto exchanges and dedicated crypto asset custody providers" and "manage and control access" to your keys.
Custodial wallet | Non-custodial wallet | |
Who holds the keys | The exchange or custodian | You alone |
Who signs a withdrawal | The custodian, at your request | Your own key |
Lost login or keys | Recovery runs through the provider | Only your seed phrase helps |
Token approvals | None signed by you | Yours to track and revoke |
Hot and cold is a separate question. The bulletin notes that "hot and cold crypto wallet options exist for both self and third-party custody", so a device kept offline can still be custodial. Offline crypto storage in a cold wallet works under either model.
Custody also decides what happens to coins while they wait. The SEC bulletin says some custodians use deposited assets as collateral for lending, a practice "sometimes called 'rehypothecation'". It tells investors to find out if theirs does it and if it asks for their consent.
What Are the Risks of a Non-Custodial Wallet?
The risks of a self-custody wallet are specific, and each one lands on you alone.
Losing the seed phrase leaves no one to call. The SEC bulletin warns that with a lost or stolen wallet "you may permanently lose access to your crypto assets".
Old approvals keep a contract's access open after you stop using it, so a contract exploited a year later can still reach the tokens you approved.
A message you didn't read can grant an allowance without any transaction from you, and whoever holds it picks the moment, up to its deadline.
An issuer freeze reaches USDT wherever it's held, since the token's own contract carries the controls.
How Do You Use a Non-Custodial Wallet With Phemex?
Phemex accounts are custodial, so moving coins into a non-custodial wallet means a withdrawal to an address you control. These five steps keep that handoff tight.
Create the wallet yourself, in a browser or mobile wallet app or on a hardware device that only you use.
Write the seed phrase down offline before the wallet holds a single coin, and keep it away from cameras and cloud notes.
Add the wallet's address to your Phemex withdrawal whitelist. The post on how Phemex implements advanced account protection says that once whitelisting is on, "funds can only be sent to these addresses". Every withdrawal also needs a code from your authenticator app.
Send a small test withdrawal and confirm it arrives in the wallet before you move the rest.
Set approvals you no longer use back to zero, one token and one spender at a time, each for its own network fee.
Futures trading on Phemex happens inside the custodial account, so only the coins you withdraw come under your own keys. Futures use leverage, and a leveraged position is closed automatically if losses reach its margin.
Frequently Asked Questions
Can a non-custodial wallet be traced?
Yes, because every transfer it signs and every approval it grants lands on a public blockchain under its address. Self-custody takes the keys away from a company, and the record of what those keys did stays open to anyone.
What is the difference between a self-custody wallet and an exchange?
An exchange holds the private keys behind your account and signs withdrawals when you ask. A self-custody wallet signs only with keys you hold, so the backup and every approval you give are yours to manage.
Is a hardware wallet a non-custodial wallet?
Yes, when you set it up and keep its seed phrase yourself. Custody turns on who holds the keys, and the SEC bulletin says hot and cold wallets exist under self-custody and third-party custody alike.
How do I revoke a token approval?
Send a new approval of zero for the same token and spender, since under ERC-20 a new approval overwrites the old one. Each costs its own network fee. USDT's contract won't change one non-zero allowance into another until it's set to zero.
Bottom Line
Self-custody is a promise about keys, and token approvals are its fine print. A non-custodial wallet lets no one else sign for your coins. Every contract you've approved already holds a signature from you, though, and it keeps working until it's spent or you set it back to zero.
Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency trading involves substantial risk. Always do your own research before making investment decisions.
