ISRA.my
ENBM
Menu
Islamic finance concepts for everyday life

Practical guide

Crypto wallets, custody and scams: who controls the asset?

Sources checked 6 October 2026

Ask who can sign a transfer and who can refuse your withdrawal. In a custodial account, a provider controls the private keys and processes your instructions. In self-custody, you control the signing credentials, but must protect them and understand the permissions you grant. Neither model guarantees that lost or stolen assets can be recovered.

A balance on a screen does not tell you who can move it. A crypto wallet manages access to blockchain assets; the assets are recorded on the network, rather than stored as coins inside your phone. Separate control of keys, account access, legal ownership and the ability to turn an asset into ringgit.

Four questions behind one balance

A private key is a secret used to authorise a blockchain transfer. A seed phrase, also called a recovery phrase, can recreate signing keys in a phrase-based wallet. It is different from an app password, a public receiving address and a one-time login code. Never give anyone your private key or recovery phrase, including someone claiming to provide support. This guide never asks for them.

Luno Malaysia’s terms, updated 14 May 2026, say the user retains legal ownership of crypto held in the Luno Wallet, while Luno retains the private keys and the user cannot access them. That is a useful example of ownership and technical control being different. The contractual insolvency wording is not an independent guarantee of the outcome of a real insolvency.

For the selected phrase-based MetaMask setup, the user controls the recovery phrase. Other setups, including its Google, Apple or Telegram login options, have different access paths. “Self-custody” therefore requires reading the actual recovery design, not assuming every app works identically.

Luno Malaysia terms of use; MetaMask recovery phrase and password guide.

Figure 1 · G27

Who controls the keys?

Follow the instruction, the signer and the remaining dependency. Ownership is a separate contractual question.

Custodial account: Luno example

  1. You requestSign in and instruct the provider.
  2. Provider signsLuno controls the crypto private keys.
  3. Transfer depends onAccount checks, supported network, provider service and network confirmation.

Self-custody: phrase-based example

  1. You authoriseYour wallet signs using keys derived from your phrase.
  2. You secure accessProtect device access and recovery credentials.
  3. Transfer still depends onNetwork operation, fees and any token-contract restrictions or permissions.
Selected custody models; not a security ranking. Luno terms §7 (ownership) and §13 (private keys) and MetaMask recovery guide. Phrase-based setup only in the self-custody lane. Luno Malaysia terms of use; MetaMask recovery phrase and password guide; MetaMask spending caps. Checked 6 October 2026.

Sending crypto is different from withdrawing ringgit

Sending crypto moves a supported asset to an address on a specified network. Selling exchanges it for a currency or another asset; a cash withdrawal then moves the available currency to your bank account. These are separate steps, with separate costs and possible delays. Check the asset, network, destination address and any required memo or tag before confirming.

Luno’s terms allow restrictions and compliance checks; incomplete transfer information can leave an incoming transfer visible but unavailable. Its ringgit withdrawal route requires an approved bank account in your own name. A visible balance is therefore not a promise of immediate spending access. The provider also says it cannot cancel or reverse a transaction submitted to a crypto network.

Budget for the buy/sell price and spread, trading or service charges, crypto send/network fees, cash withdrawal charges and any currency conversion. Luno’s current Malaysia fee page describes dynamic send fees and personalised send limits; use the displayed quote rather than treating an advertised rate as the whole cost. Self-custody can add hardware and secure-backup costs, and fees for approvals or revocations. No live fee or asset price is assumed here.

Luno Malaysia terms of use; Luno fees and limits in Malaysia; MetaMask spending caps.

A lost phone is not the same as a lost key

Fictional Malaysian example: Farah loses the phone she used for her custodial account. If she suspects theft or account compromise, she should urgently lock the account or contact official support. For routine access loss without suspected compromise, her next step is the provider’s official recovery process. Luno’s help page distinguishes a replaced device from suspected theft and describes a temporary 48-hour sending and cash-withdrawal hold after a trusted-device change or two-factor authentication (2FA) reset. Verification is required; recovering account access does not recover tokens already sent away.

In contrast, Daniel used a phrase-based self-custody wallet. If he still has a usable secure backup, the official wallet restoration process may restore access. If the device and all usable signing/recovery routes are gone, an account-password reset by a support agent cannot recreate the keys. A missing phrase alone does not prove permanent loss if another valid access route remains. Never send a backup to a “recovery expert”.

Wrong-network transfers, unsupported tokens, scams, compromised keys and provider failure are different cases. Ask the relevant receiving provider what is technically possible; do not assume recovery. A blockchain explorer can show a transaction record, but it does not give you the recipient’s keys or compel repayment.

Luno: lost, stolen or replaced phone; MetaMask recovery phrase and password guide; Luno Malaysia terms of use.

Figure 2 · G27

Lost access: what may still be possible?

Identify the failure first. Account recovery, restoring keys and recovering stolen assets are different tasks.

Provider login lost

  1. Suspected theft or compromise?Urgently lock the account or contact official support.
  2. Routine access loss only?Open the known provider site or app for recovery.
  3. Prove account access/identityFollow its recovery checks; temporary holds may apply.
  4. LimitRestored login does not undo a completed transfer.

Phrase-based wallet access lost

  1. Usable backup or route remainsRestore through verified official wallet software.
  2. All signing/recovery routes lostProvider cannot recreate your signing secrets.
  3. LimitRestoration gives control of remaining assets, not compensation for losses.
Fictional cases; no recovery promise. The 48-hour hold belongs to the selected Luno help process, not every wallet. Other self-custody designs need their own recovery documentation. Luno: lost, stolen or replaced phone; MetaMask recovery phrase and password guide; Luno Malaysia terms of use. Checked 6 October 2026.

Test the offer before giving it power over your money

Fictional scenario: a WhatsApp group promises guaranteed crypto income, uses a registered exchange’s logo and asks Mei Ling to send assets to an outside wallet. A registered exchange used to buy the tokens does not make the outside scheme authorised. A screenshot of profit is not proof of funds available for withdrawal.

Another message asks for an “unlock fee” or her recovery phrase to return missing tokens. The SC has warned of people impersonating the regulator and offering recovery for a fee. Stop and verify independently. Check the exact legal entity and official domain, not just the name or logo. Search the SC register and Investor Alert List through the regulator’s own site; absence from an alert list is not proof of approval.

An app can also gain spending authority through a token approval. A smart contract is program code on a blockchain; “gas” is the network execution fee. For selected MetaMask-supported token types, a spending cap is permission for a contract to spend that token. Unlimited approval can expose the entire balance of that token. Disconnecting a website is different from revoking its on-chain allowance. Revocation costs gas and cannot return assets already spent; it does not make a disclosed private key safe again.

SC digital-assets portal; SC Investor Alert List; SC warning: fake investment letters and recovery fees; MetaMask spending caps; SC Investment Checker.

Figure 3 · G27

Verify a suspicious offer

Pause → identify → check → read the action. These are evidence prompts, not a scam score.

Before you pay or sign

  1. Pause the requestGuaranteed returns, urgency or another payment to release funds require scrutiny.
  2. Identify the counterpartyExact entity, official domain, recipient and service.
  3. Check official evidenceSC register / Investment Checker and alerts; verify identity independently.
  4. Read the permissionWhich asset, network, recipient, amount or spending allowance will change?
Editorial checklist based on SC warnings and MetaMask permission guidance. No prediction, endorsement or guaranteed protection. SC digital-assets portal; SC warning: fake investment letters and recovery fees; SC Investor Alert List; MetaMask spending caps; SC Investment Checker. Checked 6 October 2026.

Choose the complaint route for the actual loss

If a scam has happened, act promptly: contact the relevant provider through its official support channel. If a bank transfer or bank-account compromise is involved, contact the bank immediately and call NSRC 997; BNM’s newer Annual Report 2025 describes the hotline as operating 24 hours, seven days a week. Make a police report. These actions can support investigation and response; they do not promise reversal of an on-chain transfer.

For the Luno example, its current site links to a complaints process last updated 1 March 2021. Use the support route for access or fraud assistance and its formal complaints channel for a service grievance; keep the ticket and ask for a written outcome and the applicable Malaysian escalation route. That older page’s broadly worded legal-action time clause should not be read as a statement of Malaysian statutory limitation law.

Report suspected unauthorised capital-market activity or misconduct to the SC. Its role is regulatory; it cannot act as your legal adviser or decide every private civil claim. Keep transaction IDs, network/address details, bank receipts, messages, dates and the entity’s name. Do not include signing secrets in a complaint.

FMOS is a conditional redress route for covered disputes against its Members, including a separate eligible bank/payment dispute where relevant. Its published direct-loss limit is RM250,000, with product and other exclusions. First make a formal complaint to the Member; referral is generally within six months of receiving its final decision, or after no response within 60 days. Check the actual provider on the member list and the particular product scope. We have not verified FMOS membership or coverage for the Luno crypto example; SC registration alone does not establish either. Crypto price loss, a self-custody key loss and an offshore platform dispute are not automatically covered.

BNM Annual Report 2025: fraud response; Luno complaints process; SC capital-market complaints; FMOS scope; FMOS filing process; FMOS member list.

Figure 4 · G27

One incident can have different routes

Separate urgent reporting, provider service complaints and conditional financial redress.

Access or crypto-service issue

  1. ProviderOfficial support; formal complaint if needed.
  2. Regulatory concernSC for relevant misconduct or unauthorised investment activity.
  3. Monetary redressCheck legal entity, membership and jurisdiction; no automatic FMOS route.

Scam with a bank-payment leg

  1. Urgent responseBank + NSRC 997; police report.
  2. Bank disputeFormal complaint to the bank and keep its response.
  3. If eligible for FMOSCheck RM250,000 limit; six-month / 60-day referral conditions and exclusions.
Product-specific routing; no compensation or recovery guarantee. Bank-loss route is separate from a token transfer. FMOS limits and deadlines apply only within its jurisdiction. SC capital-market complaints; BNM Annual Report 2025: fraud response; FMOS scope; FMOS filing process; FMOS member list. Checked 6 October 2026.

Registration, deposit protection and Shariah status answer different questions

Crypto holdings are not made PIDM-insured deposits by using a Malaysian app or a registered exchange. PIDM’s scheme concerns eligible deposits at member banks, not general crypto investment loss. Self-custody also removes neither price risk nor the risk of harmful contracts or compromised devices.

Luno’s published eligibility conditions include being at least 18, using your own identity and complying with applicable rules; they do not impose a Muslim-only condition. Muslim and non-Muslim readers face the same custody and recovery questions. A Muslim reader may additionally check the exact asset and activity against a documented Shariah decision. The SC’s asset-status table and SAC resolution have stated scope; a wallet brand, custody model or compliant asset entry does not approve every staking, lending or return scheme. This article issues no new Shariah ruling.

PIDM deposit insurance; Luno Malaysia terms of use; SC digital-assets portal; SAC digital-assets resolution.

Before keeping assets in a wallet

  • Name the legal provider and the asset/network; check the current official register and terms.
  • Identify who controls the keys, who can freeze service, and what signing permissions already exist.
  • Read recovery steps before access is lost; keep secure backups according to the actual wallet design.
  • Compare the full buy → send → sell → bank-withdrawal cost and restrictions.
  • Know which official support, regulatory-reporting and dispute routes apply. Keep records without sharing secrets.

Related guides (planned URLs)

Sources and scope

Evidence checked on 6 October 2026. Named providers illustrate different arrangements, not recommendations. Read the exact product, network and accepted account terms. Current source dates and limits are listed below

Related reading

When a bank or takaful claim goes wrong: complaint routesCrypto in Malaysia: rules, exchanges and what approval meansIs crypto Shariah-compliant? Check the asset and the activityStablecoins, tokenised deposits and CBDCs are different things

Search

Search guides, glossary entries, research and publications in English.