Self-custody Without a Key: Does the Wallet Really Belong to You?

Just a few years ago, “self-custody” meant something quite simple: a user had a seed phrase or private key, which meant they could manage their assets independently of any specific application. If MetaMask stopped working, the seed could be imported into another compatible wallet, and the user could continue to access their funds.

It was around this model that the phrase “Not your keys, not your coins” originated. But modern wallets work differently now. Instead of seed phrases, passkeys, Face ID, MPC, smart accounts, and social recovery are increasingly being used. Technically, these solutions are also referred to as “self-custody,” although the level of user independence they offer can vary significantly.

What is self-custody?

In the classic model, the user controls the address using a private key. In Ethereum, a standard user account is called an Externally Owned Account (EOA). If the owner has the private key, they can sign transactions. If the key is lost, the blockchain itself cannot restore access.

That is why traditional self-custody has been built around a seed phrase. The main advantage of this model is that it is independent of any specific wallet. The app serves only as an interface, while the account itself exists separately from it.

Such a system also has an obvious drawback: the loss or theft of a seed phrase can result in the permanent loss of assets. This was one of the main reasons behind the emergence of new wallet architectures.

Why the Industry Is Moving Away from Seed Phrases

A seed phrase effectively solves a cryptographic problem, but it isn't well-suited for the average user. You have to write down 12 or 24 words, store them separately, and understand that losing this record could result in the loss of your money.

At the same time, seed phrases have become one of the main targets of phishing. All it takes is to convince a user to enter the words on a fake website—and the attacker gains full control over the wallet.

As a result, the industry began looking for models where users wouldn't have to constantly interact with their private keys directly. This led to the emergence of passkeys, MPC, smart accounts, and account abstraction. The wallet is gradually evolving from a simple interface to a private key into a full-fledged access management system.

Passkey and Face ID

Passkey allows you to authenticate a login or action using Face ID, Touch ID, a PIN, or another device-based mechanism. However, biometrics alone do not serve as a wallet key; they merely authorize the device to use the stored cryptographic credential.

For the user, the process is very simple. They open the app, confirm the action using Face ID, and gain access to their wallet. This is much more convenient than a seed phrase and provides better protection against common phishing attempts.

But along with convenience comes a new dependency. It’s important to understand exactly where the passkey is stored and how it can be recovered. It may be synced via iCloud Keychain, Google Password Manager, or another password manager, or it may remain tied to a specific device. What happens if you lose it or switch devices depends directly on this.

Base: Self-custody with restrictions

A real-life scenario prompted me to explore this topic in greater depth. I used the Base self-custody wallet, which was secured with a passkey and Face ID.

The problem arose when it became necessary to fully manage assets from a computer. The familiar scenario—where a dApp is open on the desktop and a mobile wallet connects to it to confirm transactions on a smartphone—was no longer possible.

Coinbase explicitly states that connecting to the app on another device via the Base app is no longer supported. Instead, it recommends using a smart wallet and a passkey or working through the Base app’s built-in interface. However, smart wallets are not compatible with all apps and networks.

In my case, the practical solution was to transfer my assets to MetaMask. My funds remained under my control the entire time, but this example itself illustrates an important distinction: self-custody and the freedom to use a wallet are not the same thing.

It is possible to control the resources while still being dependent on the architecture of a specific product.

The recovery phrase may now work differently

In a classic wallet, the recovery phrase is linked to the account's private keys. You can import it into a compatible wallet to regain access.

The smart wallet Base uses a different mechanism. The wallet is protected by a passkey. If a cloud-based passkey is used via iCloud Keychain or Google Password Manager, access can be restored through that system. For a device-bound passkey, losing the device is a much more serious issue.

Base allows you to create a recovery phrase in advance, but it doesn't work the same way as a classic EOA seed. It creates a separate signer on-chain, who can later add a new passkey and restore access to the smart wallet.

In other words, the classic seed → private key → account model is gradually being replaced by a different architecture: passkey → signer → smart contract account. From the user’s perspective, both mechanisms can be referred to as “wallet recovery,” even though technically they are entirely different models.

Smart Account

Account abstraction allows you to transfer wallet management rules to a smart contract account. ERC-4337 enables the use of programmable logic for transaction validation and the creation of wallets with multiple authentication methods, recovery options, signer changes, spending limits, transaction batching, and gas payment on the user’s behalf.

The advantage is clear: the wallet becomes significantly more convenient and flexible. You can set up multiple recovery methods, use different devices, limit large transfers, or distribute authority among multiple users.

But at the same time, the very concept of ownership is changing. Now it’s not just a matter of who holds the private key, but also what rules are configured in the account, who can change the signer, and what conditions must be met to sign a transaction.

MPC

Multi-Party Computation allows the signing process to be distributed among multiple participants. The full private key does not necessarily have to be stored in a single location; instead, multiple key shares are used, which together form the signature.

This model reduces the risk of a single point of compromise. If one part of the system is compromised, that alone may not be enough to withdraw funds.

But this raises another question: who controls the remaining shares? If a specific company’s infrastructure is required for signing or recovery, the user’s level of independence is already different from that of a typical seed wallet.

Therefore, MPC alone does not determine whether a wallet is custodial or self-custodial. It all depends on the implementation: who controls the key parts, what quorum is required for signing, whether access can be restored without the provider, and whether there is an independent mechanism for exiting the system.

The main problem is portability

Portability is now becoming one of the key criteria for self-custody.

Here's a very simple test: what would happen if the wallet's developer disappeared tomorrow?

For a classic EOA, the solution is usually straightforward. If you have the seed or private key, you simply set up a new wallet and continue using it.

For passkeys, smart accounts, or MPC, the answer depends on the specific implementation. You need to determine whether the account can be used through a different interface, whether the credentials can be exported, whether the user controls a sufficient number of signers, whether an independent recovery option exists, and whether the provider’s infrastructure is required.

The blockchain itself can continue to function perfectly normally, and the assets can remain in place. But accessing them may become significantly more difficult.

This leads to a fairly accurate formula:

The money may be yours, but the path to it is not.

Self-custody is becoming a spectrum

Today, this single term encompasses a variety of models. A classic EOA offers a high degree of independence and portability, but requires the user to take full responsibility for the seed or private key. A passkey wallet significantly simplifies the login process and provides protection against some phishing attacks, but recovery depends on where and how the credential is stored.

MPC reduces the risk of a single point of failure, but requires an understanding of who controls the key shares. A smart contract wallet offers flexible rules, recovery options, and multiple signers; however, the user is then dependent on the contract’s architecture and the available methods for interacting with it.

All of these models can be self-custody models. However, they vary in their degree of independence.

What Needs to Be Checked Now

In the past, to evaluate a wallet, it was often enough to ask: Who holds the private key?

That's not enough anymore.

It is important to understand who can sign a transaction, who can change the signer, what is required for recovery, whether it is possible to switch applications without transferring assets, and what will happen if a device is lost or the company is dissolved.

Another question is particularly important: Is it possible to continue using the wallet without the developer's infrastructure?

It is this metric that best reflects the user's actual level of independence.

Conclusion

Passkeys, MPCs, and smart accounts do not make self-custody any worse. In many cases, they are actually more secure and convenient than the traditional seed phrase.

But they are changing the very meaning of the term.

In the past, "self-custody" almost always meant: " I have the key."

That definition is no longer sufficient.

Today, it makes more sense to ask a different question:

If the app disappears tomorrow, will I still be able to manage my assets?

If the answer to this question is not obvious, then we are no longer dealing with classic self-custody, but with a more complex system, the level of independence of which must be assessed separately.

Sources

Coinbase — Connect or sign in to an app using the Base app

Ethereum — Account Abstraction

Fireblocks — Self-Custody Infrastructure