Self-custody vs keeping crypto on an exchange: the risks of each

TUREFF• •0

Once you own some cryptocurrency, you have to decide where it lives. You can leave it on the exchange where you bought it, or move it into a wallet where only you control the keys. Neither option is risk-free. They swap one set of risks for another, and the right choice depends on how much you hold and how confident you are with security. This is educational information, not financial advice.

What custody means

Crypto is controlled by private keys, secret codes that authorise transactions. Whoever controls the keys controls the funds.

Custodial: an exchange or provider holds the keys for you. Your account shows a balance, but you rely on the company to let you withdraw.
Self-custody: you hold the keys yourself, usually through a software wallet on a phone or computer, or a hardware wallet, a small device that keeps the keys offline. A recovery phrase, typically a list of words, can restore the wallet if the device is lost.

Risks of keeping crypto on an exchange

Platform failure. Exchanges have collapsed, been hacked or frozen withdrawals. Customers have waited years for partial repayment, or lost funds entirely.
Mismanagement or fraud. Some failed platforms used customer funds for their own purposes.
Account takeover. If someone steals your password and gets past your security, they can withdraw your funds.
Withdrawal limits and freezes. An exchange can pause withdrawals, require extra verification or close accounts.
Limited protection. In general, crypto held on an exchange does not get the same compensation protection as a bank deposit.

To reduce these risks, use a platform registered with your national regulator, turn on strong two-factor authentication with an authenticator app or security key rather than SMS, set up withdrawal address allowlists where offered, and use a unique password.

Risks of self-custody

Losing your recovery phrase. If the device fails and the phrase is lost, the funds are gone. Nobody can reset it.
Theft of your recovery phrase. Anyone who sees it can take everything. Never type it into a website, share it with support staff or photograph it to the cloud.
Scams and fake wallets. Counterfeit apps, tampered hardware and phishing sites target self-custody users.
Sending mistakes. A transaction sent to the wrong address or on the wrong network usually cannot be reversed.
Approving malicious transactions. Signing a contract you do not understand can hand over control of tokens.
Inheritance. If only you know how to access the wallet, your family may never be able to recover it.

Good habits for self-custody

Buy hardware wallets directly from the manufacturer or an authorised seller, never second-hand.
Write the recovery phrase on paper or metal, store it somewhere safe from fire and flood, and consider a second copy in a separate secure place.
Never enter the phrase anywhere except the wallet itself during recovery. No genuine company will ask for it.
Send a small test transaction before moving a large amount.
Check addresses carefully, as some malware swaps copied addresses.
Leave clear instructions for someone you trust about how your assets can be found, without writing the phrase into your will itself.

Choosing between them

Many people use both:

Small amounts you trade often may stay on a reputable, regulated exchange for convenience.
Larger amounts held for the long term may sit in self-custody, once you understand the setup.

Ask yourself honestly whether you are more likely to be hurt by a platform failing or by your own mistake. If you are new and would struggle to keep a recovery phrase safe, rushing into self-custody can be riskier than it seems.

Before you decide

Crypto prices are volatile and losses are possible, whichever method you use. Only hold what you can afford to lose. Check your national regulator, such as the FCA in the UK, which keeps a register of firms and warnings about unauthorised ones, and check your tax authority's rules, since moving between your own wallets should still be recorded. Do you keep your crypto on an exchange, in your own wallet or both? Share your reasoning in the comments.