How to Safely Store Crypto Assets: SEC Releases New Investor Bulletin

Dec. 12, 2025 — The U.S. Securities and Exchange Commission’s Office of Investor Education and Assistance has released a new Investor Bulletin aimed at helping retail investors better understand how crypto assets are stored and protected.

The bulletin focuses on crypto asset custody — how investors hold, access, and safeguard digital assets — and outlines the risks and trade-offs between different wallet types and custody models.

What is crypto asset custody?

Crypto asset custody refers to how and where investors store and access their crypto assets. While many investors think of wallets as “holding” crypto, wallets actually store the private keys that grant access to those assets on a blockchain.

When a crypto wallet is created, two cryptographic keys are generated:

• Private key — a secret alphanumeric code that authorizes transactions. Losing it means permanently losing access to the crypto assets.
• Public key — a shareable address that allows others to send crypto assets to your wallet, but does not grant spending access.

Together, these keys establish ownership and control of crypto assets.

Hot wallets vs. cold wallets

The SEC distinguishes between two primary types of crypto wallets:

Hot wallets are connected to the internet and typically come in the form of mobile apps, desktop software, or web-based wallets. They are convenient for frequent transactions but are more exposed to hacking and cyber threats.

Cold wallets are offline storage options, such as hardware devices, USB drives, or even paper backups. While generally more secure from online attacks, cold wallets can be lost, damaged, or stolen — potentially resulting in irreversible loss.

The SEC also stresses the importance of protecting seed phrases, which are recovery phrases that can restore wallet access. Anyone who obtains a seed phrase can take full control of the crypto assets.

Self-custody vs. third-party custody

Investors must also choose between managing crypto assets themselves or relying on a third-party custodian.

Self-custody

With self-custody, investors control their private keys directly. This provides full ownership and independence, but also places complete responsibility on the investor. Lost keys, damaged wallets, or successful hacks can lead to permanent loss.

The SEC encourages investors to consider their technical ability, security discipline, wallet costs, and comfort with sole responsibility before choosing self-custody.

Third-party custody

Third-party custodians — such as crypto exchanges or specialized custody firms — manage private keys on behalf of investors. These custodians may use a mix of hot and cold wallets.

However, the bulletin warns that investors may lose access to assets if a custodian is hacked, shuts down, or enters bankruptcy. Some custodians may also lend or commingle customer assets, a practice known as rehypothecation.

Key questions investors should ask

• How is the custodian regulated and what is its track record?
• Which crypto assets are supported?
• Are assets insured against theft or loss?
• How and where are private keys stored?
• Are customer assets lent out or commingled?
• What fees apply for storage, transfers, and transactions?

General safety tips from the SEC

• Never share private keys or seed phrases.
• Keep crypto holdings private.
• Be alert to phishing and social engineering scams.
• Use strong passwords and multi-factor authentication.
• Carefully research any custody provider before depositing assets.

The SEC notes that crypto asset markets continue to evolve and that custody decisions can have lasting financial consequences. For retail investors, understanding how custody works is a critical part of managing risk.