Can the Operator Steal Your Funds? How to Audit That Claim

By Inveil Research · Updated January 20, 2023

"Can the operator steal your funds?" is the single most important question to answer before trusting any crypto platform — and the answer is rarely the marketing copy. Plenty of services call themselves "non-custodial," "trustless," or "secure" while retaining a quiet ability to move user funds. The good news is that you don't need to be a smart-contract developer to test the claim. You need to know what gives an operator that power, what removes it, and which concrete questions force the truth into the open. This is a practical audit checklist for the claim that matters most.

What "the operator can't steal funds" actually requires

An operator can move your funds if any path exists for their keys to do so outside the rules you agreed to. So the claim "the operator can't steal your funds" requires that no such path exists — not that the operator promises not to use it. Concretely, a genuinely non-custodial system has these properties:

• Your unlocked funds sit in your control (your own wallet/account), not pooled where the operator holds them.
• Funds in a trade are held by escrow code or multisig, with release rules that the operator can't unilaterally override.
• There is no admin function that lets a privileged key drain, redirect, or freeze user funds.

If all three hold, the honest answer to "can the operator steal your funds?" is "no, by construction." If any one fails, the answer is "yes," regardless of what the website says. This is the substance behind what "non-custodial" actually means.

The audit checklist (no coding required)

You can get a long way by asking and observing, even without reading Solidity:

1. Who holds your funds at each moment? Ask directly: when funds are idle, where do they live — my own account, or a platform balance? When in a trade, what holds them — a contract/multisig, or the company? If idle funds sit in a "platform balance," that's custody, full stop.

2. Is the escrow contract public and identifiable? A non-custodial platform should be able to point you to the actual on-chain contract address holding escrowed funds. "It's on chain, trust us" without an address is a red flag. With an address, anyone can inspect it on a block explorer.

3. Is the code open source and verified? Open, verified source means the contract's behavior can be checked by anyone, and open source is a security feature precisely because it makes hidden backdoors much harder to keep. Closed-source "non-custodial" is a claim you cannot check.

4. Is there an admin key, and what can it do? This is the crux. Ask: is there a privileged role? What functions can it call? Specifically — can any admin function move, freeze, or redirect user funds? Configuration powers (setting fees within limits) are normal; a function that can sweep balances is custody wearing a costume.

5. Are admin powers constrained (timelocks, limits)? Even legitimate admin functions should be bounded — for instance by a timelock that delays changes so users can react, or hard limits on parameters. Unconstrained, instant admin power over the protocol is a risk even if it can't directly touch funds.

6. What happens if the company disappears? If the answer is "you can still reach your funds via the contract," that's non-custodial. If it's "contact support," the funds were the company's to hold — see what happens to escrowed funds if the platform disappears.

Red flags that should end the conversation

Some answers are disqualifying on their own:

• "Your funds are safe with us" / "we're regulated and insured" offered in place of a structural answer. These describe custody with good manners, not non-custody.
• No contract address, or closed-source escrow. You're being asked to trust an unverifiable claim.
• An admin function that can move user funds, hand-waved as "only for emergencies." An emergency drain is still a drain; the capability is the risk, not the stated intent.
• Idle balances pooled in a platform wallet. This is the classic setup behind custodial failures — your funds on their books.
• Evasiveness. A genuinely non-custodial operator can answer these questions plainly and is usually proud to. Deflection is information.

If you can't read code, lean on others who can

You don't have to verify everything yourself. Reputable third-party audits, a public and active community inspecting the contracts, and a track record of the code being scrutinized all substitute for personal expertise — the same way you trust a building is sound without being a structural engineer, because inspectors and codes exist. What you should not accept is a system where no one can check, because that's indistinguishable from a backdoor by design.

The takeaway

The claim "the operator can't steal your funds" is checkable, and checking it is the most valuable due diligence you can do. Find out who holds funds at each step, demand a public and ideally audited escrow contract, and pin down whether any admin key can touch user balances. A real non-custodial platform answers these cleanly and can show its work; a custodial one dressed as non-custodial will deflect, omit the contract, or reveal an admin function that quietly holds the keys. When the honest answer to "could they take it?" isn't a structural "no," treat the funds as custodial — and decide accordingly.

FAQ

How can I tell if a platform is really non-custodial?

Check three things: whether your idle funds sit in your own account or a platform balance, whether escrowed funds are held by a public, verifiable contract or multisig, and whether any admin key can move, freeze, or redirect user funds. If funds are yours or in audited escrow code with no fund-moving admin function, it's non-custodial; if any of those fails, it's custodial regardless of the label.

Do I need to read code to audit the "can't steal funds" claim?

No. You can ask who holds funds at each step, request the on-chain escrow contract address, ask whether the code is open source and audited, and ask specifically what any admin key can do. Clear answers plus reputable third-party audits and public scrutiny substitute for personal coding expertise — what you must not accept is a system no one can verify.

Is an admin key always a sign of custody?

Not necessarily — many non-custodial protocols have admin roles for legitimate configuration like adjusting fees within limits. The disqualifying case is an admin function that can move, freeze, or redirect user funds. Legitimate admin powers should also be constrained, for example by timelocks. The question isn't "is there an admin key?" but "can any privileged function touch user funds?"

What if the platform says funds are insured or they're regulated?

Those are reassurances about a custodial setup, not evidence of non-custody. Insurance and regulation can reduce the likelihood or impact of a failure, but they imply the operator holds your funds in the first place. A non-custodial platform answers structurally — "no one can move your funds outside the rules" — rather than pointing to insurance over funds it controls.