Exchange or wallet: where should you keep your crypto?
After the Binance hack and the Coldcard flaw, an honest comparison of exchange accounts and self-custody wallets, and how to split your holdings.
Key takeaways
- On an exchange you hold a claim on a company. In your own wallet you control the coins directly.
- Exchanges can be hacked, fail or pause withdrawals.
- Self-custody moves the responsibility to you, and wallet products can have flaws too.
- Many people keep trading funds on an exchange and long-term savings in cold storage.
2026 gave crypto holders two painful lessons. In October, attackers took about $6.3 billion from Binance, the largest crypto theft on record. Only a few months earlier, a flaw in Coldcard hardware wallets let thieves drain around $116 million from self-custody users.
So where is your crypto safest? The honest answer is that each option has a different risk, and you get to choose which one you manage. For long-term savings, many experienced holders prefer a well-set-up self-custody wallet. For good reason: the risks there are mostly in your control.
What you're actually choosing between
| Exchange account | Self-custody wallet | |
|---|---|---|
| Who controls the keys | The exchange | You |
| What you really hold | A claim on the company | Direct control of the coins on the blockchain |
| Forgot your login | Support can usually help | Restore from your recovery phrase. No phrase, no funds. |
| Biggest risks | Hacks, insolvency, frozen withdrawals, account takeover | Lost phrase, phishing, malware, bad signatures, product flaws |
| If something goes wrong | You depend on the company's money and goodwill | Usually nobody can reverse it |
| Best for | Trading, buying and selling, small balances | Long-term holding, using DeFi, full control |
The case against leaving everything on an exchange
- You're trusting the balance sheet. Binance says it's covering customers. WazirX customers waited more than a year and got about 85% back at first. Mt. Gox customers waited about a decade. See the full history.
- Your access can be paused. Exchanges can suspend withdrawals in a crisis, as Binance and Bitget did in 2026. That's a sensible emergency measure, but it also means you can't move your money when you most want to.
- Companies can leave. In 2026 Gemini closed accounts in the UK, EU and Australia, and customers had to move their assets by a deadline.
- Insurance is limited. Exchange funds are not usually protected like bank deposits. Read what any "protection fund" actually promises.
The case against assuming a wallet is automatically safe
- You become the security team. Lose your recovery phrase and no one can help.
- Phishing works on individuals too. Malicious signatures and fake apps cause many self-custody losses.
- Products can have flaws. The Coldcard case involved weak seed generation in firmware. Owners who stored their seeds perfectly were still exposed. If you own a Coldcard, read our seed phrase guide.
- Physical risk is real. Keep your holdings private.
Which fits which situation?
| Your situation | A common approach |
|---|---|
| Trying crypto with a small amount | A reputable regulated exchange, with strong 2FA |
| Trading often | Only your trading balance on the exchange |
| Holding long term | A hardware wallet with a tested backup |
| Using DeFi or NFTs | A separate hot wallet with limited funds, apart from your savings |
| Larger amounts | Multisig, ideally across different brands |
| You don't trust yourself with backups | A well-established regulated custodian may be the better fit. Self-custody isn't for everybody. |
A simple way to split your crypto
Think of it as a wallet and a safe, the same way you treat cash. Keep small spending money somewhere convenient and your savings somewhere harder to reach. Crypto usually works in three layers:
- Exchange: only what you're actively trading.
- Hot wallet: a small balance for everyday use and apps.
- Cold storage: long-term savings on a hardware wallet with an offline backup.
Self-custody checklist
- Bought the device from the manufacturer or an authorized reseller
- Installed wallet software only from official sources
- Recovery phrase stored offline in a safe place
- Backup tested by restoring it
- Firmware and app updated, and security notices checked
- Small test transaction done first
- Instructions in place for your family
Ready to set it up? Compare options on our wallets page, then follow the step-by-step transfer guide.
Sources
- CNBC: Binance resumes withdrawals after $6.3 billion hack
- TRM Labs: Inside the $116 million Coldcard hack
- BleepingComputer: Bitget resumes bitcoin withdrawals after $387.5 million crypto heist
- Gemini Support: closing accounts in the UK, EU and Australia
Keep reading
How to move crypto from an exchange to your own wallet
A careful step-by-step guide to withdrawing crypto to your own wallet: choosing the right network, checking the address and sending a test first.
How to store your seed phrase safely
Where to keep your crypto recovery phrase, what never to do, how passphrases and multisig help, and what the 2026 Coldcard flaw teaches us.
The biggest crypto exchange hacks in history, and what happened next
From Mt. Gox to Bybit and Binance: ten major exchange hacks, how much was stolen, and whether customers ever got their money back.