Where is my money?

This is one of the first bits of confusion I hear from my friends and colleagues that haven’t deeply explored crypto. When I have money on the blockchain, where is it? Is it *in* the blockchain somehow? Is it in my computer? Is it in that weird little USB stick you carry around? Having a simple but true mental model for how blockchains work really helps give you confidence when trying to use them, and they don’t have one.

This is kind of ironic, because the same people can’t answer the same question about their money “in” their bank. I’ve tried this a few times, turning the question around. “Do you know where your money is when it’s in your checking account?” Essentially no one asks themselves this question when they set up direct deposit of their paycheck to their checking account. It’s an unexamined usage pattern so widespread in the culture that the question doesn’t seem worth investigating. Everyone does this because everyone does this. Let’s look at this first, because it’s helpful to be able to compare the mental models for what is going on in each case, and why you might prefer one or the other.

Part 1 - The Banking System

Legally speaking, what you’re doing when you set up direct deposit and have your paycheck delivered to a bank every pay day is becoming an unsecured creditor to the bank. You are lending them money they can do with as they wish. After you deposit it in the bank account, it’s *their money*, not yours. This kind of surprised me when I first read it. We tend to think of the bank relationship as “I give them my money, and they keep it safe until I need it.” But of course, they have costs they need to cover and shareholders they need to satisfy. The ATMs, the bank branches, the employees, the computer infrastructure, these things are not free. So how can they pay for them?

When you get a service for free, the answer as to how this is possible is often ugly. When you get Gmail for free, it’s because Google is getting something more valuable to them in return: your data. They could structure their business so as to charge you money for the email service instead, but they realized they could make a lot more money with a different model because there is a limited amount consumers are willing to pay for such a service. So it is with banks. What they get in exchange for providing the service of keeping your money safe is: your money. So what do they do with it?

Regulatory regimes vary by country, but there is rough consensus on how banks ought to work. Since the COVID-19 pandemic, the US has moved to an actual literal 0% mandated reserve ratio for large banks. There is no one-size-fits-all minimum amount the banks must hold. Instead they do an analysis of their “Liquidity Coverage Ratio” and report this to the Federal Reserve, and they must hold this number, which represents 30 days of net outflows for the bank. This is a more smartly scaled adjustment than the previous rule flat “you must hold at least 10% of your deposit assets in high-quality liquid asset form.” It basically says, “figure out how much you probably need based on an analysis of the trailing three month timeframe, and keep at least that.”

In JP Morgan Chase’s first quarter 2026 filing with the SEC they showed they had $2.68T in total deposits and $1.14T high quality liquid assets (HQLA) at their disposal to respond to withdrawals for a reserve ratio of 42.5%. In Bank of America’s filing they showed $2.04T deposits, $673B in HQLA for a reserve ratio of 33%. That’s actually well above the old 10% floor that was in place before the pandemic, but it’s important to understand that under the old rule the only assets that counted were cash held by the bank directly or in deposits at the Federal Reserve. The concept of HQLA is new and materially weaker than straight cash. So what counts as high quality and liquid?

It basically boils down to: cash held by the bank or in accounts at the Federal reserve as before, but also US Treasuries, Mortgage Backed Securities issued by Fannie Mae or Freddie Mac, and qualifying corporate bonds (i.e. debt issued by large corporations that have sufficient liquidity). Under the old 10% rule, they weren’t earning much or any interest on that 10% so it was pure dead weight. Now they’re earning interest on these instruments, but they are not the same as cash and would have to be sold in a mass withdrawal event. That’s why it’s important that they are “high quality” (likely to retain all or most of their value in a stress event) and “liquid” (easily tradable).

When you deposit a check in one of the large banks like this, all that happens is two numbers in internal databases increase, X amount of assets that you gave them, and X amount of liabilities they owe you. There is nothing in a box with your name on it anywhere. It’s just numbers in databases, and you can’t see or check them yourself. So whether you know it or not, unless you operate in a strictly cash business, you’re already using “virtual currency” just not cryptocurrency.

Now, in defense of the banks, they are subject to huge array of regulatory and reporting requirements. You can’t ask to audit them to make sure they have a way to repay you, but regulators are doing this on your behalf. This creates a lot of overhead for the bank. Compliance is embedded in nearly every function and the staff at big banks spend almost a quarter of their time on activities to satisfy regulatory requirements. That’s a huge drag on the financial performance as a business because responding to regulatory requirements doesn’t make any money.

Small and medium-sized banks, legally banks with less than $250B in assets, fall outside this rule entirely and are instead responsive to a complicated mixture of federal and state regulatory bodies that analyze their balance sheets with a framework called the CAMELS rating system. This is not worth detailing for our purposes. You can assume someone, somewhere is trying to make sure a bank chartered in the US is operating safely. It might be the Office of the Comptroller of the Currency, it might be the Federal Deposit Insurance Commission, it might be the Federal Reserve, it’s probably also state regulators in the state in which it’s chartered. You can read more about it here if this is remotely interesting to you. Individual cases vary, but what remains the same is that money deposited in the bank is almost certainly just numbers in a database. Anything but the cash in the drawers at your local branch is virtual.

So the bank doesn’t really have your money. Once you’ve deposited it’s not even your money anymore. What it has instead is an entry in a database that says you are owed a certain amount of money. So where is the money, really? If you’ve lent it to them with the expectation that they will give it back when asked, it might be worth exploring where it goes. We’ve already seen that 30-40% of it is invested in the high quality liquid assets listed above. You may think that the rest of it is lent out to businesses who want to invest in growth. That is the function that most people associate with banks.

When a business wants to buy a new piece of equipment or a building, or hire more staff, with the expectation that this will make them more money, if they don’t simply have the cash on hand they take out a loan from a bank. This helps businesses grow; it’s capitalism working! So that seems good, we like this. So are the big banks doing this?

Yes, to some degree. Roughly 18-20% of JPM and BoA balance sheet is loans to businesses. Feels a little underwhelming to me at least, because that is the thing I most want them to do if I give them money for free. I can rest content that my deposit is fertilizing the national economy. I may not directly benefit, but at least the bank is making money, and helping other businesses make money, which makes everyone wealthier.

So we’ve accounted for 50-60% of the money now. 30-40% HQLA, 20% business loans. Another 10% roughly is a mix of direct personal lending to consumer, and tied up in credit card operations, which hopefully you’re only floating for 30-60 days and not paying interest. So we’re at 60-70% now. What’s left?

Largely, JPM’s trading portfolio. There is some overlap in asset type that makes this a little hard to understand. They have corporate bonds that they intend to hold to maturity as part of their HQLA asset portfolio and then also have corporate bonds held by their trading business where they’re taking directional bets on whether they will increase or decrease in value in a given timeframe and then exiting the position. They also hold commodities like gold, oil, and lean hogs maybe, they hold assets to facilitate corporate mergers and acquisitions, they trade the mortgage backed securities too. At the level of detail we need here, we can just say that they’re doing a bunch of trading stuff they think will make them money that ranges widely in terms of risk.

This was basically the picture even before 1998 when the Glass-Steagall Act was formally repealed for JPM because carve outs through the 1980s and 1990s had gradually defanged the law that originally mandated separation between investment and commercial banks. So things have been working this way for a fairly long time at this point. Ok, now that you understand that your money is already “virtual currency,” and that the bank doesn’t really have it either because they used it for their own purposes, let’s turn to cryptocurrency proper.

Part 2 - Cryptocurrency

Functionally cryptocurrencies are a lot like cash, but weightless and it can move at the speed of light. When you say “I have 10 SOL,” what you really mean is that you are the only person that is able to access and use a specific 256-bit number to “sign” transactions that move value out of an address to which ownership of 10 SOL is assigned on the blockchain ledger. That’s a bit complicated, so let’s unpack.

A blockchain is a specialized database that functions as a ledger. It reflects which addresses own which balances of which tokens. This isn’t so different from the bank so far. The bank also maintains an internal database of account numbers and which assets belong to them. If you have non-cash assets like stocks the bank will maintain a separate account for you that reflects your ownership of those assets. If you have loans, separate account again reflecting how much you owe them. The big difference is that these are all internal to the bank and only inspectable by regulators or in some cases business partners that have a need to know. With a blockchain, it’s all out in public.

There are advantages and disadvantages to this arrangement. The big advantage is that you don’t need regulators and auditors to validate balances. You can do it yourself any time you like with special software called a block explorer.

So what is this 256-bit number mentioned above? This is your “private key.” When you go to authorize debiting your account, you cryptographically sign a message using this number. You also have a “public key” which serves as the address that owns the balances, sort of like an account number at a bank. When the chain receives a signed message explaining that you want to transfer tokens from your address to another address, it validates it running through at least the criteria in the checklist in the graphic. If all these things are true, the validator executes the database transaction and the destination account is credited. If any are not true, the message is rejected and nothing happens.

What if someone guesses your number? It’s hard to get a good intuition for just how astronomically large a 256-bit number is. The known universe contains about 10^24 stars, and about 10^80 atoms. A 256-bit number is about 10^77, so within a few orders of magnitude of the number of atoms in the universe. The number of possible keys is so vast that its completely infeasible to guess, even using the best current hardware. Developments like quantum computing could change this for some algorithms, but there are also quantum resistant ones.

So the more practical danger is that you lose it. Back to the point about crypto being like cash, if you lose a $20 bill, the new owner is whoever finds it. But as we just saw the sea of 256-bit numbers is so vast it is lost for all time. So that’s a bummer. This is a risk specific to crypto that a wallet designer needs to put some real thought and care into. Fortunately, there are technical solutions but they all involve tradeoffs of effort and preparedness. You don’t want it to be easy to recover your wallet. If you lock yourself out of your bank account because you lost your password, do you want just anyone to be able to reset it? No. You want there to be some friction before a customer service agent will just reset it for anyone who says they’re you.

A simple answer to the question “where is my money?” is that it’s in the blockchain. You can move it using your private key but it’s not actually on your computer. What is the blockchain? It’s a globally distributed network of computers, all of which store all of the present state, which is to say the mapping of who owns what. A dozen can go offline and nothing changes with respect to the availability and integrity of your account balances. A dozen new machines can join the network and nothing in particular happens. It’s resilient to changes in the composition of the network like the internet itself.

Why do people run this service? Because they are paid to do so. If they provide compute to process and verify transactions, they get a share of the transaction fees. These are tiny individually, often fractions of a cent on Solana, but add up to durable income on a blockchain with real activity. But basically they’re incentivized to provide the service. Even better, they’re only rewarded for doing so honestly because other parts of the network double-check the results.

The real disadvantage to the public ledger is that everybody can see your activity. Your public address is “pseudonymous” in that you can’t tell just by looking at an address who holds the corresponding private key for it. But this is a thin veil of anonymity a little bit like a phone number. There are services like Arkham Intelligence dedicated to mapping which addresses belong to whom. If you on-ramp to crypto with a regulated exchange, the exchange has KYCed you and knows who you are.

You probably don’t want to conduct sensitive business operations like in public. Fortunately there are privacy services you can access that make these operations truly anonymous, but governments generally haven’t quite gotten a handle on what the approach to this situation should be. There are few clean ways to ensure only the right people can access the information and the wrong people cannot. So what most tools offer is either full anonymity or mere pseudonymity. I’ll probably do a full article in future on what the tradeoffs for individuals and policymakers are so we can leave this to the side for now.

So in a cryptocurrency system, no one else is really holding your money for you. As long as the network exists, and you have the private key for your account, you are holding your money.

Conclusion

The traditional banking system and cryptocurrency systems work very differently and there are different risks that attach to each. With cryptocurrency, you don’t hand your money to someone else who promises to give it back later but is really using it for their own purposes (and may lose it). Crypto has risks, but not that one. And crypto eliminates the specific risk that a custodian loses your money; there is no custodian. Crypto unbundles two things that traditional banking ties together. Your private key contains the authority to transact, and the blockchain holds the state of the balances.