What is a private key? Ownership, custody and safety
A private key is a secret number that proves ownership of a crypto address and authorises every transaction from it — whoever knows the key controls the coins. You can hold it yourself or let a custodian hold it for you, and no legitimate desk will ever ask you to reveal it.
KEY FACTS
| Term | Private key — the secret that controls a crypto address |
|---|---|
| Size | 256 bits — about 1.16 × 10^77 possible keys |
| Backup format | Seed phrase of 12 or 24 words (BIP-39) |
| Rule when selling | Never share the key; you sign the transfer yourself |
| Meridian flow | From ~100,000 USDT; your keys until settlement |
Source: BIP-39 specification and Meridian OTC published flow, as of September 2026.
How does a private key work?
A private key is a randomly generated 256-bit number — one of roughly 1.16 × 10^77 possibilities — from which your public address is derived and with which every transaction is signed. The network verifies the signature, not your identity: anyone who can produce a valid signature from the key can move the coins.
In practice you rarely see the key itself. Your wallet stores it and backs it up as a seed phrase — 12 or 24 ordinary words under the BIP-39 standard — from which every key in the wallet can be regenerated. Guessing a key is not a realistic attack; stealing the backup is.
That is why key storage is the central security question in crypto. Who holds the key decides who owns the assets, which is the subject of our guide to custody and segregation of client assets.
Who holds the private keys under each custody model?
Under self-custody you hold the private keys yourself, in a hardware or software wallet; under a custodial model a licensed third party holds them for you. Self-custody makes a lost key a permanent loss, while custody shifts the risk to a counterparty you must be able to verify.
| Model | Where the key lives | If you lose access |
|---|---|---|
| Hardware wallet (self-custody) | Inside the device; it never leaves it | Restore from the seed phrase — without it, nothing |
| Mobile or desktop wallet (self-custody) | On the phone or computer, encrypted | Restore from the seed phrase; malware is the main risk |
| Custodial provider | The provider's systems, under its controls | Account recovery process — if the provider is regulated |
Every self-custody model ends at the same point: the seed phrase is the last line of defence.
In Dubai outside the DIFC, holding client keys is a regulated activity: VARA licenses custodians and requires client assets to be held separately from the firm's own. Before handing keys to anyone, check the licence in VARA's public register.
Why does your private key matter when you sell USDT?
When you sell USDT at an OTC desk, the desk never needs your private key — it needs an on-chain transfer that you sign locally in your own wallet. You accept a written quote, broadcast the transaction yourself, and the key never leaves your device at any point in the trade.
Any counterparty that asks for the key or seed phrase "to verify the wallet" or "to speed up settlement" is describing theft. Verification at a licensed desk runs on identity documents and, where needed, a small test transaction — the patterns we see reported are listed in our breakdown of crypto OTC scams in Dubai.
The same logic covers your payout side. A desk that settles to your own-name bank account will ask you to register that account in advance; address whitelisting explains how this control stops last-minute substitution attacks.
Worked example: selling 750,000 USDT without sharing your key
Suppose you hold 750,000 USDT on a hardware wallet and want AED in your own account. The figures below are illustrative, as of September 2026 — not a quote.
-
STEP 1
Quote accepted — key untouched
You accept an all-in written price at a 0.15% spread, held for a defined window. Nothing is signed yet, and the desk has seen neither your key nor your seed phrase.
-
STEP 2
Transfer signed locally
You connect the hardware wallet, enter the desk's deposit address, confirm the amount and network fee on the device screen, and sign. The choice between TRC20 and ERC20 for USDT is covered in our network comparison.
-
STEP 3
Settlement in dirhams
At the 3.6725 peg, 750,000 USDT is AED 2,754,375; minus the 0.15% spread, AED 2,750,243 goes out by UAEFTS to your own-name account the same business day.
-
STEP 4
After the trade
Your key never left the device, and your remaining balance was never exposed. Total exposure of the key across the whole trade: zero.
What a legitimate desk will never ask you for
Five requests mark a counterparty as unsafe, whatever the branding on the website:
- Your private key or seed phrase, in full or "just the first few words".
- Remote-access software "to help you set up the wallet".
- A screen share of your wallet while you sign a transaction.
- Coins sent "for verification" to a personal address instead of a company deposit address.
- A "release fee" to be paid before your AED can be sent.
A licensed desk asks for identity documents — the list is in our onboarding section — and nothing about your keys, ever.
FAQ
Is a private key the same as a seed phrase?
Not exactly. A private key controls one address; a seed phrase is a 12 or 24-word backup from which a wallet regenerates all of its private keys. Both must be kept secret — either one gives full control of the coins.
Can an OTC desk ask for my private key?
No. A desk needs only an on-chain transfer signed in your own wallet. Any request for your key or seed phrase — from a desk, an exchange or "support" — is a theft attempt, and the correct response is to walk away.
What happens if I lose my private key?
In self-custody the loss is permanent: no one can reset the key or freeze the coins, and the balance becomes unreachable forever. That finality is the price of removing counterparty risk.
How should I store a private key for a large USDT balance?
On a hardware wallet kept offline, with the seed phrase written on paper or steel and stored in two separate secure locations. Never in email, cloud storage, a phone photo or a chat app.
Sell USDT without ever sharing your keys
Meridian OTC is a VARA-licensed Broker-Dealer in Dubai. You sign the transfer in your own wallet; AED lands in your own account by UAEFTS the same business day. All-in spread 0.08–0.40% by size, from around 100,000 USDT.
SOURCES
- BIP-39 specification — the seed-phrase backup standard, accessed 11 September 2026.
- VARA public register — licence status check, accessed 11 September 2026.
- Central Bank of the UAE — payment systems (UAEFTS), accessed 11 September 2026.
- Meridian OTC published pricing bands and onboarding requirements, September 2026.
This guide is informational and is not legal, tax or investment advice, nor an invitation to buy or sell any virtual asset. Rules and figures are as of September 2026 — re-check the sources before acting. Virtual assets may lose their value in full or in part and are subject to extreme volatility.