Exchanges vs self-custody: who holds your keys?

What an exchange balance really is

When you buy bitcoin on an exchange, no coins move to you. The exchange updates a number in its own database and keeps the actual coins in wallets it controls, pooled with everyone else’s. You hold a claim on the exchange, much like a bank deposit, except that crypto balances are rarely covered by deposit insurance.

Most of the time this works. The risk is what happens when it does not: a hack, a freeze ordered by a regulator, an account lock you cannot resolve, or an exchange that has been lending out or losing customer funds. In each case, what you can withdraw depends on the exchange, not on the blockchain.

This has happened at scale. Mt. Gox, then the largest Bitcoin exchange, stopped withdrawals in February 2014, and its customers waited about a decade for partial repayment. FTX froze withdrawals and filed for bankruptcy in November 2022, and its customers’ claims were valued in dollars at that month’s prices, missing everything the market did afterwards.

What self-custody changes

In self-custody, your wallet generates the keys and only you hold them, usually backed up as a 12- or 24-word seed phrase. Coins at your address are controlled by those keys and nothing else. No company can lend them out, lose them in a bankruptcy or block you from moving them.

One exception matters: issuers of stablecoins such as USDT and USDC can freeze their tokens at any address, including yours, because the freeze is written into the token contracts. Bitcoin and ether have no such switch.

The trade-off is that nobody can help you either. Lose the seed phrase and a broken phone means lost coins; reveal it to a scammer and the coins are gone within minutes. Self-custody is safer only if the backup is stored properly, which the seed phrase guide explains.

The two compared

• Who can move the coins. Exchange: the exchange, on your instruction. Self-custody: whoever holds the keys.
• If you forget your password. Exchange: account recovery with identity checks. Self-custody: the seed phrase is the only way back.
• If the company fails. Exchange: you become a creditor in a bankruptcy. Self-custody: nothing changes, because no company is involved.
• Mistakes and scams. Exchange: some hold unusual withdrawals for review and can occasionally stop one before it leaves. Self-custody: every signature is final.
• Privacy. Exchange: identity checks, and your trades and withdrawals are recorded and increasingly reported to tax authorities. Self-custody: your addresses are public on the chain, but not labelled with your name unless you link them.
• Cashing out. Exchange: buy, sell and withdraw to your bank in one place. Self-custody: you still need an exchange or broker to turn crypto into your currency.

If you use an exchange, choose carefully

• Authorised in your country. In the EU, crypto-asset service providers need authorisation under MiCA, and ESMA publishes a register of them. In the UK, check the FCA register.
• Publishes proof of reserves: evidence that it holds the customer assets it owes, ideally with a way for you to check that your balance is counted. It shows assets at one moment and does not prove the exchange has no other debts.
• Offers strong account security: sign-in with an authenticator app or security key, and a withdrawal allowlist that makes new addresses wait before they can be used.
• Has a track record of how it handled outages, hacks and regulators, which you can read about before you deposit.

Moving coins to your own wallet

Most people end up using both. Keep on the exchange what you actively trade or plan to sell soon, and move longer-term holdings to a wallet you control. For amounts that would hurt to lose, use a hardware wallet; crypto wallets explained compares the options. The first withdrawal is where mistakes happen, so go step by step.

1. Set up the wallet and write its seed phrase on paper. Never photograph it or type it into anything connected to the internet.
2. Copy a receive address from the wallet. If you use a hardware wallet, confirm the address on its screen.
3. Paste the address into our address validator to confirm it is well formed and on the network you expect.
4. In the exchange’s withdrawal form, pick the network your wallet supports for that coin. Sending on a network your wallet does not show is a common way to strand funds.
5. Withdraw a small test amount and wait until it arrives. Then send the rest.

Once the coins are in your own wallet, a watch-only monitor can alert you to any movement using only the public address, or an xpub for a Bitcoin wallet. It cannot move anything.