September 3, 2026

The last post in this series covered the on-ramp, the MoonPay account and the KYC flow that turns a bank transfer into USDC. The purchase itself went through without much drama, but where the token actually landed is a separate question I hadn’t thought through in advance. Without a self-custody wallet address connected, the balance stayed inside MoonPay’s own account system: a number in an app, not something sitting under an address I control on-chain. That distinction, custodial versus self-custody, is easy to skip past when the interface just shows a balance, but it changes what you actually own.

Custodial: a claim on a ledger, not a claim on the chain

A custodial balance means the provider, MoonPay in this case, holds the private keys and keeps its own internal record of who owns what. What I see in the app is an entry in their database, not a UTXO or account balance I can point to on Ethereum or Solana. This is the same arrangement as money sitting in a bank account or on an exchange: convenient, no seed phrase to manage, but the token itself belongs to the custodian’s wallet, and my ownership is only as good as their solvency and willingness to let me withdraw. It’s a second, separate layer of counterparty risk on top of the one already described in the GENIUS Act post, that one was about whether Circle actually holds the reserves behind USDC. This one is about whether the company holding my USDC on their books will hand it over when asked.

Self-custody: the key moves the risk, not the amount of it

The alternative is holding the private key myself, which comes in two common forms. A software wallet like MetaMask or Phantom keeps the key encrypted on whatever device runs the browser extension or app: convenient, free, but exposed to anything that can compromise that device, malware, a fake extension, a phishing site that requests a signature. A hardware wallet like a Ledger generates and stores the key on a separate secure element and signs transactions on the device itself, so the key never touches an internet-connected computer. That’s real protection against remote compromise, but it doesn’t remove risk, it relocates it: lose the seed phrase backup or the device without a working recovery, and the funds are gone with no customer support line to call. Custodial risk is institutional, self-custody risk is operational, and neither one is smaller than the other, they just fail differently.

Smart contract wallets split the difference

A third option, common on EVM chains, is a smart contract wallet like Safe, formerly Gnosis Safe. Instead of one private key controlling funds, a contract deployed on-chain enforces its own rules: multiple signers required for a transaction, spending limits, or social recovery through a set of trusted contacts instead of a single seed phrase. It removes the single point of failure a hardware wallet still has, but adds on-chain complexity and, on most chains, a deployment cost. It’s also not universal: the model doesn’t map cleanly onto non-EVM chains like Solana, which use a different account structure and need separate tooling, such as Squads, to get comparable multisig behavior.

The network is a second, independent choice

None of this is separate from the network question the MoonPay post ended on. USDC is issued natively per chain, Circle mints a distinct token on Ethereum, Solana, Base, and others, with no built-in bridge between them. A hardware wallet can hold keys for many chains, but the balance itself is chain-specific, and a MetaMask address set up for Ethereum can’t receive Solana USDC without a Solana-compatible wallet in the mix. Moving a balance from one chain to another means either Circle’s own Cross-Chain Transfer Protocol, which burns the token on the source chain and mints it on the destination, or a third-party bridge that wraps it instead. Wallet type and network are two decisions that have to be made together, not one.

For now the balance is still sitting in MoonPay’s custodial account, which is a fine place to stop for an amount whose whole point was understanding the mechanics rather than holding value long-term. But it’s worth being precise about what that means: I don’t hold anything on-chain yet, only a claim against a company that does. Picking a wallet type and a network is a distinct step from buying the token, and it’s the one I haven’t taken.