What it means
Digital asset systems use pairs of keys. The public key, or the address derived from it, can be shared freely so that others can send you assets, while the private key stays secret and is used to sign outgoing transfers.
The mathematical link between the two means that a signature made with the private key can be checked using the public key, without revealing the private key. The network accepts a transfer only if the signature is valid.
For a business, the main point is custody (who holds and protects the assets). If a company holds digital assets itself it must protect the private keys, and if it uses a custodian then the custodian protects them on its behalf.
Losing the key is usually permanent. There is normally no helpline or password reset, so assets tied to a lost key can become inaccessible, and a stolen key lets a thief move the funds immediately and irreversibly.
Good practice includes keeping keys offline in hardware devices, requiring several people to approve large transfers, keeping secure backups in separate places, and having written procedures for staff changes. Auditors increasingly ask how keys are controlled when reviewing a company that holds digital assets.
Keys that are connected to the internet are called hot, and keys kept offline are called cold. Hot keys are convenient for daily payments but are easier to attack, so firms commonly keep only a small working balance in hot storage and the rest in cold storage.
The same idea is used outside digital assets, since secure websites and software updates also rely on private keys to prove a message came from the party claiming to have sent it.
In practice
Real-world examples.
Example
A fintech start-up holds customer deposits in digital tokens. It stores the private keys in hardware devices kept in two separate secure locations. Any transfer above $50,000 needs approval from three of five officers. The set-up is tested every year to confirm that the backups still work.
Example
A retailer accepts payment in a digital currency and keeps its private keys with a regulated custodian. The custodian provides an annual control report that the retailer's auditor reviews. The retailer avoids the risk of managing the keys itself, although it still has to assess whether the custodian is financially sound and properly insured.
Example
A sole trader loses the device storing her private key and has no backup. The digital assets linked to the key are worth $40,000 but she cannot access them. She learns that recovering a lost key is generally impossible. Her loss is permanent, and no bank or regulator can reverse it.
Case study
Seen in the real world.
Lantern Digital is an illustrative, fictional company that accepted digital tokens from customers and held about $2,000,000 in a single wallet. The wallet was controlled by one private key stored on the chief technology officer's laptop.
During a routine review, the finance director pointed out that if the laptop were lost or stolen, the company could lose all of the funds. The company moved to a set-up in which three out of five senior staff had to approve each transfer, with keys held on separate devices in different offices.
In this illustrative story, a laptop was later stolen from a car, but because the stolen device held only one of the five key shares, the funds remained safe. The extra cost of the new arrangement was small compared with the risk it removed. The finance director added a yearly drill in which the team practised moving a small amount using the backup process. The drill found that one backup had been stored in a drawer that was later cleared out, and it was replaced before it mattered.
Watch out
Common mistakes.
- Storing a private key in an email, shared document or messaging app, where anyone with access can copy it.
- Keeping a single copy of the key, so that one lost device means permanent loss of the assets.
- Treating the private key as a password that can be reset, when there is typically no recovery process.
Questions
People also ask.
What is the difference between a private key and a public key?
The public key can be shared so people can send you assets, while the private key is secret and is used to authorise transfers.
Who owns the assets if someone else holds the key?
In practice the person holding the key controls the assets, which is why custody arrangements, insurance and legal agreements matter so much when a third party looks after the keys for you.
Can a private key be changed?
The key itself cannot be altered, but you can create a new key pair and move the assets to the new address, which is the standard response if a key may be exposed.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related