Crypto Wallet vs Exchange: Where Should You Keep Your Coins?

The core difference in crypto wallet vs exchange is who holds the private keys. When your coins sit on an exchange, the company controls the keys and you hold an account balance, which is a claim against that company. When your coins sit in your own wallet, you control the keys and nobody can move the funds without your signature.

Neither option is automatically right. Exchanges are the easiest place to buy, sell and trade, and the large regulated ones run serious security operations. But history shows that exchanges can be hacked, freeze withdrawals or collapse, and when that happens, customers can wait years to get back part of what they were owed. A personal wallet removes that company risk but puts the full responsibility for security and backups on you.

This guide explains custodial vs self-custody storage, what happened at Mt. Gox and FTX, what proof of reserves can and cannot tell you, when keeping funds on an exchange is reasonable, and how to split your holdings between the two with a worked example.

Crypto Wallet vs Exchange: Custodial vs Self-Custody

Every crypto balance is controlled by a private key, a secret number that signs transactions on the blockchain. The question is who holds it.

• Custodial (exchange): A third party, the custodian, holds the keys. The exchange typically pools customer coins in its own wallets and keeps an internal ledger of who owns what. When you “withdraw,” you ask the exchange to send coins from its wallets to an address you choose.
• Self-custody (your own wallet): You hold the keys, usually backed up by a 12- or 24-word seed phrase. Transactions happen directly on the blockchain and need no company’s approval.

Your exchange balance is therefore an IOU: a record that the exchange owes you a certain amount of crypto. It is only as good as the exchange’s solvency, honesty and security. If you are new to wallets, start with what a crypto wallet is and how it works.

“Not Your Keys, Not Your Coins”: What It Means

The phrase “not your keys, not your coins” sums up the custody trade-off. If you do not control the keys, you do not have direct control of the coins, only a promise. In normal times the promise works smoothly. In a crisis, withdrawals can be paused, and the order in which customers get paid is decided by bankruptcy courts and terms of service, not by the blockchain.

It is worth reading the terms of service. Some platforms state that customer assets are held in trust and segregated from company funds. Others have historically allowed the platform to use, lend or rehypothecate (reuse as collateral) customer assets. Whether customer assets are treated as their property or as part of the bankruptcy estate can depend on those terms and the law where the company operates. In 2022, Celsius customers in its interest-earning program found that the court treated those deposits as company property under the platform’s terms.

Also note what does not apply. In the US, crypto held on an exchange is not covered by FDIC deposit insurance, and SIPC protection for brokerage accounts generally does not cover crypto assets that are not securities. Any cash an exchange holds for you may be treated differently from your crypto, so check how a specific platform describes it.

Exchange Custody Risk: Lessons From Mt. Gox and FTX

Exchange custody risk is not theoretical. Two of the best-known failures show different ways it can go wrong.

Mt. Gox (2014)

Tokyo-based Mt. Gox was once the dominant bitcoin exchange. In February 2014 it halted withdrawals and filed for court protection in Japan. Its filing announcement said about 750,000 customer bitcoins and about 100,000 of its own had disappeared, largely through thefts that had gone unnoticed over years. Around 200,000 bitcoins were later found in an old wallet. The case moved into civil rehabilitation, and repayments to creditors only began in 2024, roughly a decade after the collapse.

FTX (2022)

FTX was one of the largest exchanges in the world when it collapsed in November 2022. After reports raised questions about its finances, customers rushed to withdraw, FTX could not meet the requests and it filed for Chapter 11 bankruptcy in the US. Prosecutors showed that customer deposits had been diverted to its affiliated trading firm, Alameda Research, and for other uses. Founder Sam Bankman-Fried was convicted of fraud and conspiracy charges in November 2023 and sentenced to 25 years in prison in March 2024.

FTX’s bankruptcy estate later recovered enough to pay many creditors more than 100% of their claims in dollar terms. But claims were valued at crypto prices on the November 2022 bankruptcy date, when prices were depressed, so customers who held bitcoin got back far less than that bitcoin was worth when repayments began in 2025. They also lost access to their funds for over two years.

Hacks at operating exchanges

Failures are not the only risk. In February 2025, attackers stole about $1.5 billion in crypto from the exchange Bybit, which the FBI attributed to North Korea. Bybit covered customer balances and kept operating, which is the better outcome, but it shows that even large platforms are targets. Other exchanges that halted withdrawals in 2022 include Celsius, Voyager and BlockFi.

Proof of Reserves and Its Limits

After FTX, many exchanges began publishing proof of reserves (PoR): a report showing that they hold enough crypto to cover customer balances. A typical approach uses a Merkle tree, a cryptographic structure that lets each customer check that their own balance was included in the total without revealing anyone else’s, and on-chain evidence that the exchange controls wallets holding at least that much.

Proof of reserves is useful, but it has real limits:

• It often ignores liabilities beyond customer balances. An exchange can hold enough bitcoin to match customer bitcoin balances while still owing large debts elsewhere. True solvency needs assets and all liabilities.
• It is a snapshot. Assets could be borrowed for the day of the check and returned afterwards.
• It is not a full audit. Most PoR reports are “agreed-upon procedures” engagements with limited scope, not an audit opinion on the company’s financial statements. In 2022, the US Public Company Accounting Oversight Board (PCAOB) warned investors to be cautious about relying on such reports.
• It cannot catch everything. Fraud, hidden borrowing and internal control failures can sit outside what a reserve check examines.

Treat a recent PoR with liabilities included, plus regulated status and audited financial statements, as signs of a better-run platform. Do not treat any of them as a guarantee.

When Keeping Funds on an Exchange Is Reasonable

Self-custody is not the right answer for every coin you own. Leaving some funds on an exchange can make sense when:

• You trade actively. Moving coins on and off for each trade costs network fees and time, and every transfer is a chance for a mistake.
• The amount is small. If the balance is less than a hardware wallet costs, or less than a few network fees, the security gain may not justify the effort.
• You are just starting. Learning to buy on a reputable exchange before handling a seed phrase is reasonable, as long as you plan to learn self-custody as balances grow. Our guide to buying Bitcoin safely covers choosing an exchange.
• You are not ready to manage backups. Self-custody mistakes are permanent. If you cannot store a seed phrase securely yet, a well-regulated custodian may be safer for you than a wallet you might lose.
• You want a regulated wrapper. Some investors prefer a spot bitcoin ETF in a brokerage account, which shifts custody to institutional custodians under securities rules. See Bitcoin ETF vs buying Bitcoin.

If you do keep funds on an exchange, choose a platform licensed in your country, turn on two-factor authentication with an authenticator app or security key rather than SMS, enable withdrawal address allowlisting if offered, and use a unique password.

Crypto Exchange vs Cold Wallet for Long-Term Holdings

For coins you plan to hold for years, the comparison is usually a crypto exchange vs a cold wallet. A cold wallet keeps the private key away from internet-connected devices, most commonly on a hardware wallet. It removes company risk and greatly reduces hacking risk, while adding the responsibility of guarding a seed phrase.

The trade-off is mostly about time horizon. Long-term holdings rarely need to move, so the inconvenience of a hardware wallet barely matters, while the protection matters for years. Money you trade weekly is the opposite. Read hardware wallet vs software wallet to choose a device and hot vs cold wallets for the broader comparison.

How to Split Your Crypto Between an Exchange and a Wallet

A practical approach is to treat your holdings like money in a checking account versus long-term savings. Keep a working balance where you trade and move the rest into self-custody on a schedule.

Adjust the percentages to how you use crypto. An active trader may keep more on an exchange; someone who buys once a year may keep almost nothing there. The key idea is to make the exchange balance a deliberate choice, not a default.

Self-Custody Risks to Plan For

Moving to your own wallet swaps company risk for personal risk. Plan for these before you withdraw:

• Lost seed phrase. There is no password reset. Store the words offline, ideally on metal, in two secure places. See our guide to seed phrases.
• Phishing and fake support. No real wallet or exchange will ask for your seed phrase. Scammers often pose as support staff.
• Wrong network or address. Sending coins on a network your wallet does not support, or to a mistyped address, can make them unrecoverable. Check both before sending.
• Inheritance. If only you know how to access the wallet, your family may never recover it. Leave clear, secure instructions.
• Taxes and records. Moving coins between your own wallets is generally not a taxable sale in the US, but you still need records of your cost basis. Rules differ by country.

Bottom Line

An exchange is a service you trust; a wallet is a tool you control. Keeping a small working balance on a reputable, regulated exchange is reasonable for trading and convenience. For larger, long-term holdings, self-custody removes the risk that a company’s failure, hack or freeze will cut you off from your coins, as long as you take your seed phrase backup seriously. Decide on a split, write it down, and move funds on a schedule rather than leaving everything wherever you last bought it. For more guides, visit our crypto hub.

Sources

• Investor.gov (SEC) – Crypto Asset Custody Basics for Retail Investors
• MtGox Co., Ltd. – Announcement Regarding an Application for Commencement of a Procedure of Civil Rehabilitation (February 28, 2014)
• US Attorney’s Office, SDNY – Samuel Bankman-Fried Sentenced to 25 Years
• FBI IC3 – North Korea Responsible for $1.5 Billion Bybit Hack
• SIPC – What SIPC Protects
• FDIC – Understanding Deposit Insurance
• Kraken – Proof of Reserves