Exchange vs Self-Custody: Which Storage Choice Fits the Risk You Can Actually Manage?

Is self-custody always safer than an exchange?

No. Neither is safer in general. An exchange moves risk onto a company: you trust its solvency, its security and its willingness to honour withdrawals. Self-custody moves risk onto you: you must protect the keys, verify addresses and survive your own mistakes. The useful question is which failure you can realistically prevent.

Whoever controls the private key controls the asset. On an exchange the company holds the keys and you hold a claim on the company, which is what 'not your keys, not your coins' is pointing at. In self-custody you hold the key yourself, and no support line can restore it if it is lost.

Five ways each choice can go wrong

Company failure. If an exchange fails, freezes withdrawals or is hacked, your balance is a claim on that company, and getting it back can take years or may never happen. Self-custody removes this particular risk.

Lost keys. Exchanges usually offer account recovery through identity checks. In self-custody, losing both the device and the recovery phrase means the funds are gone; nobody can reset them.

Phishing and malicious approvals. On an exchange this usually looks like an account takeover, and some platforms can lock an account in limited cases. In self-custody, signing a malicious request can drain a wallet with no recourse.

Death or incapacity. With an exchange, heirs deal with a company process. With self-custody, heirs need instructions and access, or the funds are effectively lost.

Rule changes and account closure. A platform can restrict or close your account. Self-custodied keys keep working, but the on-ramps and off-ramps you rely on may not. Neither column is risk-free: if you cannot name which failure you are guarding against, you are not yet choosing, you are guessing.

How do I check an exchange before trusting it?

Treat it like choosing a bank branch you cannot visit. Start by checking that the firm is authorised where you live, on the regulator's own register; our step-by-step guide is at /guides/how-to-check-crypto-exchange-licensed.

In the EU, ESMA says the MiCA transitional period ended across the EU on 1 July 2026, and that after that date any entity providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law. ESMA's consumer warning is to check that the company is listed as authorised in the ESMA Interim MiCA Register before you invest or transfer funds, and to confirm which legal entity you actually contract with, because MiCA protections apply only to that authorised EU entity.

Proof of reserves is a snapshot of assets at one moment. It may not show liabilities, internal controls, or whether the same assets were borrowed for the snapshot, so read it as one data point rather than a guarantee. Also read the terms for what happens to customer assets if the company becomes insolvent; how assets are held differs by company and country. The collapse described in /guides/exchange-collapse-thodex-lesson shows why this matters.

What does safe self-custody actually require?

Self-custody is safer only when you can protect the recovery phrase, verify addresses, resist phishing and recover the wallet under stress. A hardware wallet narrows one risk, keys being copied from an infected device, but it does not stop you approving a malicious transaction; our buying framework is at /guides/hardware-wallet-buying-guide, and shared-control setups are covered in /guides/multisig-mpc-collaborative-custody-explained.

Practise before it matters. Restore the wallet from your written phrase with a tiny balance, send a test transaction first, and compare the whole receiving address rather than the first and last characters. Write an inheritance note so a trusted person can act without you (/guides/crypto-inheritance-plan). If you have no safe place to store a phrase, /guides/self-custody-with-no-safe-place covers the options, and /guides/seed-phrase-safety-checklist covers storage.

The hybrid many people end up with

A common structure is a small spending balance on an exchange or in a hot wallet, plus a larger amount in self-custody that is touched rarely. This describes a structure, not a recommended split: the amounts depend on your skills, your risk tolerance and your circumstances.

A decision test with no right answer. If this company froze withdrawals for six months, what would that do to me? If I lost my phone and my paper backup tomorrow, could I recover everything? Could someone I trust find and use my assets if I could not? Do I verify addresses and approvals every time, even when tired or rushed? If the first answer hurts and the others are no, the weak point is in both places, and the first fix is process, not product.

Disclosure: hardware wallet cards on this site are labelled if a link could ever earn WildWildCrypto a commission; today none of them carries a tracking ID. Buying only from the maker's official store matters more than any link.

Risk: self-custody mistakes are usually permanent, and exchange failures can also be permanent or take years to resolve. Counterfeit devices and fake support accounts target both groups. Never type a recovery phrase into a website or tell it to 'support'.

FAQ