Most people who own cryptocurrency hold it on an exchange, which means the exchange holds the keys. The balance shown to the customer is a database entry rather than a position on the chain.
Control of the key is control of the asset
On a public blockchain, ownership is defined entirely by the ability to produce a valid signature with a private key. There is no register of names.
An exchange holding that key can move the asset. The customer's claim is a contractual one against the exchange, not a direct claim on the chain.
This is the substance behind the warning that assets not held with one's own keys are held on someone else's promise.
Internal ledgers make trading possible
Recording every trade on the underlying chain would be far too slow and expensive to support an order book with continuous matching.
Exchanges therefore net trades internally, updating a database and settling on-chain only when funds enter or leave the platform.
Speed and low cost inside the venue are a direct consequence of the custodial arrangement, which is why non-custodial venues behave differently.
Hot and cold storage split the operational risk
A small portion of holdings sits in keys connected to the internet to service withdrawals. The bulk is kept in offline storage requiring manual processes to access.
The split limits what a remote compromise can reach, at the cost of withdrawal delays when the online portion is depleted and must be replenished.
Cold storage typically requires multiple parties to authorise a movement, so no single person or compromised machine can release the reserve.
Proof of reserves shows only one side
Exchanges sometimes publish cryptographic evidence that they control addresses holding a stated quantity of assets.
Demonstrating assets does not demonstrate solvency, because it says nothing about liabilities owed to customers or about borrowings secured against the same holdings.
A meaningful attestation covers both sides and is verified independently, which is a considerably higher bar than publishing a wallet address.
Self-custody moves the risk rather than removing it
Holding one's own keys eliminates exchange failure as a risk and replaces it with the risk of losing the key material, which is irreversible.
Recovery phrases, hardware devices and backup arrangements exist to manage that, and each introduces its own failure modes involving theft, damage or simple misplacement.
The choice is between counterparty risk and personal operational risk, and neither option is free of the possibility of total loss.