Open the broker's app, and there is your balance, with all the decimal places. The screen isn't lying, but it's describing something else. That isn't your bitcoin. It's a note that a company owes you bitcoin.
The previous four lessons described a wallet: your key, your address, a transaction that only you sign. None of that happens there. The coins are in the company's addresses, mixed with those of all other clients, and your share exists in an internal database that only they can see. You don't sign anything. You ask, and they execute if they want and if they can.
It's exactly the arrangement described from start to finish in the first module: the balance as a promise, the money of many kept by one, the withdrawal that depends on the health of the keeper. But without a central bank behind it, without deposit insurance, and, for much of the sector's history, without any regulator.
The phrase that sums this up has become a proverb in English: not your keys, not your coins. If they aren't your keys, they aren't your coins. It is attributed to Andreas Antonopoulos and became famous because reality kept proving it true.
In February 2014, Mt. Gox in Tokyo was processing most of the world's bitcoin transactions. On the 7th, it suspended withdrawals. On the 28th, it filed for bankruptcy, declaring that 850,000 bitcoins were no longer there. Clients saw the balance on the screen until the last day, and the return, initiated a decade later, still hasn't ended.
This isn't an old story from an immature sector. On November 11, 2022, FTX filed for bankruptcy with a gap of about 8 billion dollars in client money, used to cover another company owned by the same person. Sam Bankman-Fried was convicted of fraud and sentenced to 25 years in prison.
And there's the case that doesn't even require bad faith to happen. In December 2018, Gerald Cotten, founder of the Canadian broker QuadrigaCX and the only person with access to the keys, died in India. About 190 million Canadian dollars from 76,000 clients were left on the other side of a password that no one had. A subsequent investigation showed that much of the money had already disappeared before — and from the outside, no one could distinguish one from the other.
None of this automatically makes self-custody better, and anyone who claims it does without caveats is selling something. A broker returns access when you forget your password, has support, and is where most people can exchange reais for bitcoin. Lesson 1 already warned: a large part of the losses happens to those who took on a responsibility alone for which they weren't prepared.
The sector has also changed. Law 14.478, sanctioned in December 2022 and in effect since June 2023, placed virtual asset service providers under the supervision of the Central Bank. Several companies began to publish proof of reserves, which shows the coins they have and doesn't show what they owe — it's a real advancement, and it's partial.
In practice, the decision isn't all or nothing. Three questions solve most cases: how much of this money can't you afford to lose, how long do you plan to keep it, and what happens if the company closes its doors tomorrow. A small amount and short term in a regulated broker is a reasonable arrangement for beginners. An amount that changes your life and a term of years push the answer to the other side, and the middle path is legitimate.
What you can't do is make this choice without knowing it exists. In the next lesson, the survival manual: the five most common ways to lose bitcoin and the habit that prevents each one.