The secret value that authorises transfer of a digital asset; loss of the key ends practical control of the asset. It is never published to the ledger and never sent anywhere: the holder uses it to produce a signature over one specific instruction, and the network verifies that signature against the public key behind the address being spent from. Nothing about the holder is examined. Whoever can produce the signature can move the asset, and whoever cannot, cannot — which is why the key, not the account, is the object that regulators, custodians and courts now write rules about.
How a private key authorises a transfer
The sequence is short, and each step has a different actor.
- Generation. The holder’s software or device produces a very large random number. The public key is derived from it, and the address from the public key. Both derivations run one way only: an address discloses nothing that helps reconstruct the key behind it.
- Instruction. An unsigned transaction is assembled — the inputs to be spent or the contract call to be made, the destination, the amount, the network fee.
- Signing. The key produces a signature over that exact instruction. The signature is bound to that instruction and worthless for any other: altering the destination by one character invalidates it. On most public ledgers this is an elliptic-curve signature — Bitcoin and Ethereum use ECDSA over the secp256k1 curve; Bitcoin’s Taproot outputs use Schnorr signatures over the same curve.
- Broadcast and verification. Nodes check the signature against the public key committed to by the address. Passing that check is the entirety of authorisation. There is no second party asked to approve it.
- Settlement. Once the transaction is included in a block and confirmed, the sending party cannot reverse it. Recovery, where it happens at all, is a legal and investigative exercise against a recipient, not a network function.
For anyone reconciling a payment, the practical consequence is at step 3: the signature is evidence that the instruction was authorised by the key. It is not evidence of who held the key, or how the assets reached that address.
Who holds the key, and who can sign alone
“Private key” describes a role more often than a single object. Four arrangements dominate, and they differ in exactly one respect that matters operationally — how many parties must act before an asset moves.
| Arrangement | What actually exists | Who can sign alone | Effect of losing one component |
|---|---|---|---|
| Single key (software or hardware device) | One key, plus its backup | The holder | Loss of the key and every backup ends control permanently |
| Multi-signature | Several independent keys; the ledger enforces an m-of-n rule visible on-chain | Nobody, below the threshold | Survivable up to n−m keys; beyond that, terminal |
| MPC / threshold signature | Key shares that are never assembled into a whole key; the signature produced jointly looks ordinary on-chain | Nobody, below the threshold | Same threshold logic, but the policy is off-chain and therefore not visible to a counterparty |
| Third-party custody | A provider holds the means of access | The provider | The client’s remedy is contractual and regulatory, not cryptographic |
The distinction is not cosmetic for a counterparty performing diligence. A multi-signature arrangement publishes its own governance to the ledger; an MPC arrangement does not, so its controls are established from the provider’s documentation rather than from the chain.
What a signature proves to a third party
Signing a message with a key produces an artefact that anyone can check without ever seeing the key: the address, the message text, the signature, and the time it was produced. Verification is arithmetic, repeatable by the recipient, and does not depend on trusting the person who supplied it.
That property is why European rules have made the signature a compliance instrument rather than only a control instrument.
The Transfer of Funds Regulation, Regulation (EU) 2023/1113, and the European Banking Authority’s Travel Rule Guidelines, EBA/GL/2024/11, have applied since 30 December 2024. Where a transfer above €1,000 runs between a regulated provider and a self-hosted address, the provider must establish by technical means that the customer owns or controls that address. The guidelines name the acceptable methods: a message signed with the key corresponding to the address, a predefined micro-transaction sent from the address (the “Satoshi test”), a qualified electronic signature, or another means giving equivalent assurance. A customer’s own confirmation does not qualify — a declaration is not a proof.
That distinction has been tested. In decision ASF 062/2025, Malta’s Office of the Arbiter for Financial Services examined a platform that had asked a customer to confirm ownership of a destination address by ticking a box, with no technical verification behind it. The address was the scammer’s. The provider was held responsible for 40% of a loss of roughly €30,000. The broader Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 and tightens the surrounding due-diligence obligations further.
What changes for a counterparty planning a transfer: the address has to be verifiable before it is used, the wallet software has to support message signing, and the resulting artefact belongs in the transaction file rather than in a screenshot folder.
Why EU custody law regulates the key rather than the coin
MiCA, Regulation (EU) 2023/1114, defines custody and administration of crypto-assets as safekeeping or controlling, for a client, the crypto-assets or the means of access to them — in practice, the private keys. Article 75 builds on that definition: a written custody agreement, a register of client positions, segregation of client holdings from the provider’s own, client means of access clearly identified as the client’s, and liability on the provider for the loss of the crypto-assets or of the means of access following an incident attributable to it, capped at the market value of what was lost at the time of the loss.
The drafting choice is the substantive point. The regulated object is the key, because control of the key is the only thing that determines where the asset goes. A custody arrangement is assessed by asking who can sign — not by what the provider’s statements say the client owns.
Control is not title
Losing a key does not extinguish ownership; it removes the ability to act on it. In England, Wales and Northern Ireland, the Property (Digital Assets etc) Act 2025, which received Royal Assent and came into force on 2 December 2025, confirms in a single operative clause that a thing can be the object of personal property rights even though it is neither a thing in possession nor a thing in action. A stolen crypto-token remains the owner’s property; the courts are left to develop what that third category contains.
The practical limit is enforcement. A property right survives the loss of the key, but acting on it requires a defendant, a jurisdiction and an asset a court can reach. Where an asset’s control and its record are the same object, the loss of one credential removes both at once. Where they are separate — a register naming a holder against numbered items, held under an agreement with an identified operator — the record survives the loss of any single credential, and the counterparty’s position is established from the register rather than from possession of a secret.
What goes wrong, and what it leaves behind
- Loss. No issuer, no administrator, no reset. Backups of the key or its recovery phrase are the only route, and their absence is the end of the matter.
- Compromise. A copied key produces valid signatures indistinguishable from the holder’s own. There is no alert; the holder learns from the outgoing transfer. Unlike a stolen card, the credential does not have to be taken away to be used.
- Threshold shortfall. In multi-signature and MPC arrangements, losing shares below the threshold is survivable and losing enough of them is identical to losing a single key. The recovery plan is a documented count, not a hope.
- Blind signing. Approving an instruction whose contents the device cannot display in full. The signature is valid, the authorisation is genuine, and the destination is not the one the signer believed they were approving.
- Rotation is a transfer. Replacing a compromised key is not a password change. It requires an on-chain transfer to a new address, at network cost, and the address changes — so every counterparty that has verified the old address must verify the new one.
Key material now has a stated retirement schedule
NIST’s draft report IR 8547, Transition to Post-Quantum Cryptography Standards, published as an initial public draft in November 2024 and still in draft as of mid-2026, proposes that classical public-key algorithms at 112-bit security strength — RSA, ECDSA, ECDH and their relatives — be deprecated after 2030 and disallowed after 2035. Its scope is US federal systems. Public ledgers are not bound by it and set their own signature schemes.
The relevance is indirect and real: the custodians, banks, hardware vendors and software an institution buys key management from are writing migration plans against those dates. A key-management policy drafted now inherits a schedule someone else has already published.
Private key, public key, address, seed phrase, wallet
The five are used interchangeably in conversation and are five different things. The private key is defined above; the other four are not it.
- Public key — derived from the private key, published or implied by the address, used by anyone to verify a signature. Disclosing it does not endanger the asset.
- Address — a shortened, encoded form of the public key, used as a destination. Shareable without risk.
- Seed phrase (recovery phrase) — a mnemonic encoding of a master secret from which a whole tree of private keys is derived. It is not a backup of one key; it is the key material for all of them, and anyone holding it holds every key beneath it.
- Wallet — the software or device that stores key material and assembles instructions. It holds no assets; the ledger does.
The comparison that misleads most often is to a password. A password authenticates a person to a service that maintains the record and can reset the credential. A private key authorises an instruction to a network that maintains no relationship with the holder and has nothing to reset.
What a private key cannot do, and what fills the gap
A private key answers one question: who can move this asset now. It answers nothing about where the asset came from.
The two are easily conflated, because the same object is now used for both purposes. Since December 2024 a signature has been the accepted way to demonstrate that a self-hosted address belongs to a customer, so an address that has passed a proof-of-control check acquires a settled look in a file. It has not been cleared. Proof of control is forward-looking and instantaneous: it establishes that whoever produced the signature can sign today. It cannot show who controlled the address last year, whether the assets sitting at that address arrived from a documented sale or from a counterparty on a sanctions list, or whether the holder is entitled to the assets they can move.
The provenance question is answered by different instruments entirely — the licensed platform’s transaction and wallet screening, the blockchain analytics record, the conversion and settlement documents, and the source-of-funds file assembled around them. A compliance reviewer at a receiving bank asks both questions and accepts neither answer for the other. The failure mode is not a refusal; it is a payment that arrives, sits unattributed, and cannot be released because the file establishes control and stops there.
This is also where the key stops being load-bearing. Where a bullion purchase is funded from digital-asset proceeds, the key is exercised once, by the counterparty, to pay a licensed digital-asset platform that screens the transaction and converts it. Golden Ark Reserve is settled in fiat against a named order reference, holds no digital assets and issues no token or claim on metal. What identifies the counterparty’s position from that point is a register entry — bars allocated by serial number, named to the counterparty — and an evidence set that requires no signature to read. Two questions, two sets of evidence, and the file has to answer both: see Source of funds and Travel Rule.
For how a purchase funded from digital-asset proceeds is structured, settled and documented, see Buy Physical Gold with Crypto.