No single entity controls cryptocurrency. Power over any given coin or network is split across several layers: the protocol code that defines the rules, the private keys that authorize spending, the miners or validators who process transactions, the developers who propose changes, the token holders who vote in community governance, the governments that regulate how crypto meets the dollar economy, and the exchanges that custody most people’s assets. Who controls your cryptocurrency depends on which of those layers you’re asking about, and in the case of exchange-held coins, often on a company you’ve trusted the same way you’d trust a bank.
The Protocol: Rules Enforced by Code
The protocol is the software every participant runs, and it functions as the network’s constitution. It defines how many coins can ever exist, how new ones are created, how transactions are validated, and what happens when someone tries to break the rules. Bitcoin’s protocol caps the total supply at 21 million coins, and that number cannot be changed without rewriting the software and persuading the entire network to adopt the change.1Blockchain.com. Total Circulating Bitcoin
When you send cryptocurrency, every computer running the network software checks the transaction against the protocol’s rules. Try to spend coins you don’t have, and the network rejects the attempt automatically. Once a transaction is confirmed and added to the blockchain, it stays there. There is no customer service line, no chargeback, no manager to escalate to. The code runs the same way for every participant. That predictability is the point. It is also what makes mistakes irreversible.
Some blockchains extend the protocol through smart contracts, self-executing programs that move funds automatically when conditions are met. Ethereum is the main example. The upside is programmability; the downside is that a bug in a smart contract can be exploited before anyone notices. In 2016, an attacker drained roughly $40 million worth of Ether from a project called The DAO by exploiting a flaw that allowed repeated withdrawals before the contract updated the balance. On a project called Beanstalk Farm, an attacker used a flash loan to acquire a 67% governance stake and vote to transfer all project funds to their own wallet, in a single transaction. The code was followed. The logic was exploitable.
Your Private Keys: The Only Layer You Fully Control
At the individual level, control comes down to who holds the private key. A private key is the password that authorizes transactions from a wallet. Hold it yourself in a non-custodial wallet and you have complete sovereignty over your funds. Nobody can freeze your account, reverse your transactions, or stop you from sending your crypto anywhere in the world. Hand that key to someone else, like an exchange, and they have those powers instead.
Hardware wallets store private keys on a physical device that stays offline. Transactions require physical confirmation on the device, so even a compromised computer cannot move your funds without someone holding the hardware. The cost is that you are fully responsible for the device.
Every non-custodial wallet also generates a seed phrase, typically 12 or 24 words in a fixed order, that serves as the ultimate backup. Enter it into a new wallet and you restore full access. Lose it and the crypto is gone permanently. No recovery service exists. The same feature that keeps anyone else from seizing your assets removes the safety net when you make a mistake.
Developers: Influence Without Authority
The people who write cryptocurrency software have influence but not authority. Bitcoin’s code lives in a public repository, and anyone can propose changes through a formal process called a Bitcoin Improvement Proposal.2GitHub. bitcoin/bips: Bitcoin Improvement Proposals Ethereum has an equivalent system. Proposals go through community review, technical debate, and testing. The critical check on developer power is that they can write any code they want, and it means nothing until the people running the network install it.
Each computer running the software, called a node, independently validates transactions against whatever version of the rules it is running. If developers release an update that node operators dislike, the operators keep running the old version. Change happens only when enough of the network voluntarily adopts the new code.
What Happens When the Community Splits
When a disagreement cannot be resolved, the network can fork. A soft fork tightens the existing rules in a backward-compatible way. A hard fork changes the rules so fundamentally that the old and new versions are incompatible, creating two separate blockchains with two separate coins. After the 2016 DAO hack, the Ethereum community hard-forked to reverse the theft. The minority who opposed the reversal kept running the original chain, which became Ethereum Classic. Both networks still exist. Forking is the ultimate expression of decentralized governance: if you dislike where a project is going, you can take the code and build your own version.
Miners and Validators: Who Processes Transactions
Miners and validators are the workers who process transactions and add them to the blockchain. In Proof of Work systems like Bitcoin, miners run specialized hardware that races to solve computational puzzles. The winner adds the next block and earns a block reward, currently 3.125 BTC after the April 2024 halving. In Proof of Stake systems like Ethereum, validators lock up their own coins as collateral, with a 32 ETH minimum for a solo validator, and get selected to propose and confirm blocks. Both groups decide which pending transactions make it into the next block and which wait.
Their power has hard limits. If a miner includes an invalid transaction, every other node rejects the entire block, and the miner wastes energy for nothing. Validators who try to cheat lose their staked collateral through slashing. The incentive structure is designed so that following the rules is more profitable than breaking them.
The 51% Problem
Mining does not stay evenly distributed in practice. Individual miners pool their computing power to smooth earnings, and a handful of large pools end up controlling significant shares of total hashrate.3Blockchain.com. Charts – Hashrate Distribution On the Ethereum side, liquid staking providers concentrate validator power. Lido alone has handled roughly a quarter of all staked ETH, down from a peak of about 32% in late 2023.
Concentration matters because of the theoretical 51% attack. If a single entity controlled a majority of mining power or staked assets, they could rewrite recent transaction history or block other users’ transactions from confirming. For Bitcoin, the estimated hardware cost alone to attempt this exceeds $7.9 billion, not counting electricity, so it is economically impractical but not physically impossible. Smaller networks with less hashrate are far more vulnerable. The protocol rules stay intact even as the distribution of power to enforce them narrows, which is why this risk is easy to miss.
Token Holders and DAO Governance
Many projects give their communities direct voting power through decentralized autonomous organizations, or DAOs. Hold a project’s governance token and you can vote on proposals ranging from protocol upgrades to how treasury funds are spent. The standard model is one token, one vote, so influence tracks financial stake.
That has a structural flaw. Large holders dominate governance the same way majority shareholders dominate corporate boards. A well-funded actor can accumulate enough tokens to pass proposals single-handedly, which is the extreme form of what happened in the Beanstalk attack. Even without an attack, voter apathy among small holders means a modest stake can control outcomes. Token-weighted governance answers the “who decides” question by reintroducing wealth-based power.
Governments: Rules at the On- and Off-Ramps
No government can delete a decentralized blockchain or rewrite its code. Governments do exert enormous control over how cryptocurrency connects to the real economy, through the exchanges, payment processors, and other businesses that make crypto usable for ordinary people.
U.S. Regulators
The SEC and CFTC share, and sometimes contest, jurisdiction based on whether a digital asset qualifies as a security or a commodity.4U.S. Securities and Exchange Commission. SEC and CFTC Staff Issue Joint Statement on Trading of Certain Spot Crypto Asset Products The classification determines which rules apply and which agency enforces them, and it remains unsettled for many tokens.
Under the Bank Secrecy Act, any business dealing in cryptocurrency must maintain anti-money laundering programs and report suspicious activity to the Treasury Department’s Financial Crimes Enforcement Network.5Financial Crimes Enforcement Network. The Bank Secrecy Act Willful violations carry fines up to $250,000 and up to five years in prison. If the violation is part of a pattern of illegal activity involving more than $100,000 within a year, penalties rise to $500,000 and up to ten years.6Office of the Law Revision Counsel. 31 U.S. Code 5322 – Criminal Penalties
OFAC Sanctions on Wallet Addresses
The Treasury Department’s Office of Foreign Assets Control blacklists specific blockchain addresses. When an address lands on the Specially Designated Nationals list, every U.S. person and U.S.-connected business is legally prohibited from transacting with it.7U.S. Department of the Treasury – Office of Foreign Assets Control. Questions on Virtual Currency Compliant exchanges and service providers screen transactions against the list and freeze funds tied to sanctioned addresses. The blockchain itself does not enforce sanctions; the coins at a blacklisted address are technically still movable. But anyone who touches them risks serious federal penalties. This is one of the clearest examples of government reach extending onto a decentralized network.
International Standards
The Financial Action Task Force sets global anti-money laundering standards that member countries are expected to implement, including requirements for virtual asset service providers to identify customers and share sender and receiver information on transfers.8FATF. Virtual Assets In the U.S., the Travel Rule currently requires financial institutions, including crypto businesses, to collect and share identifying information on transfers of $3,000 or more. FinCEN proposed lowering the threshold for international transfers to $250 in 2020, but that proposal has not been finalized. Even where one country adopts crypto-friendly rules, global standards push toward a baseline of identity verification.
Exchanges: The Custodian Most Holders Actually Depend On
For most people, the practical answer to who controls their crypto is whichever exchange they bought it on. Centralized exchanges like Coinbase, Kraken, and Binance operate custodial wallets. They hold the private keys. That means the exchange can freeze your account, halt withdrawals, delist tokens, or comply with a court order to seize funds. You must hand over identification documents to satisfy Know Your Customer requirements before trading. If the exchange suspects illegal activity or receives a legal order, your funds can be locked indefinitely.
This mirrors traditional banking in most ways that matter, and it carries one risk that traditional banking mostly does not: exchange bankruptcy. When FTX collapsed in late 2022, customers discovered their deposits were not segregated from the company’s own funds. They were classified as unsecured creditors in the bankruptcy proceeding, the same legal category as vendors owed money, and early valuations of their claims hovered around five to thirteen cents on the dollar. The blockchain underlying those assets kept running. The company sitting between customers and the blockchain was the single point of failure. This is the strongest practical argument for self-custody and against treating an exchange account as long-term storage.
Taxes: What the IRS Controls
The IRS treats cryptocurrency as property, not currency. Every sale, trade, or purchase using crypto triggers a taxable event, and you owe capital gains or losses based on the difference between your cost basis and what you received.9Internal Revenue Service. Notice 2014-21 Hold for more than a year and long-term capital gains rates apply. Sell within a year and profits are taxed as ordinary income.
For 2026, federal long-term capital gains rates are:
- 0% on taxable income up to $49,450 for single filers or $98,900 for married filing jointly
- 15% on income above those thresholds up to $545,500 single or $613,700 joint
- 20% on income above those amounts
Starting with transactions in 2025, reported in 2026, custodial exchanges and brokers must send the IRS Form 1099-DA reporting your digital asset sale proceeds. Beginning January 1, 2026, brokers must also report your cost basis on covered transactions.10Internal Revenue Service. Final Regulations and Related IRS Guidance for Reporting by Brokers on Sales and Exchanges of Digital Assets These broker reporting rules apply to custodial platforms. Decentralized and non-custodial platforms are not currently covered, but that does not change your obligation to report. Every taxpayer answers a digital asset question on Form 1040, and failing to report crypto gains is treated the same as failing to report any other income.11Internal Revenue Service. Frequently Asked Questions on Virtual Currency Transactions