Crypto on an Exchange or in Your Own Wallet: How to Choose

You open your exchange app and see “0.5 BTC”. It looks like a vault with bitcoin inside. What you’re actually looking at is a number in the database of a company that promises to hand you that 0.5 BTC on request. As long as the promise is kept, you won’t notice the difference. You’ll notice it on the day the company stops keeping it.

This article shows what that means in practice, when an exchange is a reasonable place for crypto, and when your own wallet is the better choice. At the end there’s a procedure for moving your funds that you can get through in one afternoon.

What it means to keep crypto on an exchange

An exchange where you only buy and sell is a custodial service. The exchange creates and stores the private keys for the addresses that hold client funds. You have a login, a password and usually a second login factor. When you order a withdrawal, the exchange signs the transaction with its own keys.

Whoever holds the private keys decides what happens to the funds on the network. That’s the whole rule, and it’s where the saying “not your keys, not your coins” comes from. The opposite is self-custody: the keys are with you, and a non-custodial tool such as a hardware wallet never sees them. The keys are stored in a seed phrase, a list of words you keep on paper or on a steel plate.

On an exchange, your rights come from its terms and from the law the exchange is subject to. The bitcoin network has no record of your name or account. It has addresses that belong to the exchange, and an entry in the exchange’s books saying some of them “are yours”.

Three risks: bankruptcy, frozen accounts, hacks

Exchange bankruptcy

The best-known example is FTX. According to Steptoe, the exchange halted withdrawals on 8 November 2022 and filed for Chapter 11 protection in the US on 11 November. On 13 December 2022 the US Securities and Exchange Commission (SEC) alleged that FTX’s founder had secretly passed client funds to his fund, Alameda Research. Those were allegations. The verdict came later: Sam Bankman-Fried was sentenced to 25 years in prison, and prosecutors said he misappropriated billions of dollars of client funds.

For a client, though, a different fact mattered. If you had crypto on FTX in November 2022, you couldn’t withdraw it. The first payout to creditors, about 1.2 billion USD, came only in February 2025, more than two years later. Claims were converted at the prices on the day of the filing, when bitcoin cost about 16,871 USD. Clients received dollars at the 2022 rate, not coins.

In a bankruptcy one question counts: were client funds kept separate from the company’s assets? If they weren’t, the client joins the queue with all other creditors. If they were, the client is in a much better position, although recovery still takes a long time.

Frozen accounts

An exchange doesn’t have to fail for your funds to become unavailable. In its help centre, Kraken lists reasons it may restrict an account or stop withdrawals: a suspected security breach, no reply to a request for more information, withdrawals to wallets linked to fraud, a password change (withdrawals to new addresses are blocked for up to 24 hours). Kraken also says that when it closes an account, it may not give the details of why.

These rules make sense, because exchanges are responsible for preventing money laundering. But for the client the effect is that your access to your funds is decided by the company’s compliance team, not by you. If the account is frozen on Friday and you have to pay on Monday, there’s nothing you can do about it.

Hacks

In February 2025, about 1.5 billion USD in crypto was stolen from the Bybit exchange. The FBI attributed the attack to North Korean groups that investigators call TraderTraitor. Client funds sit in one place under one company’s control, so a break-in hits everyone at once. With a hardware wallet, an attacker would have to get hold of your device or your seed.

This category also includes attacks on you rather than on the exchange: phishing for your password, a hijacked phone number, a fake message “from the security department”. Once an attacker gets into your account, the exchange will pay out the funds, because formally the account holder is the one ordering it.

The risk nobody talks about: your family

When an account holder dies, the exchange won’t pay funds out to someone who knows the password, because that would break its terms. It pays out to an heir who goes through the exchange’s procedure and shows the documents. How long that takes and what you need to bring is described in our guide Crypto on an exchange after the owner dies. On top of that, the family has to know the account exists at all, and that’s where the most money gets lost.

What MiCA changes in the European Union

MiCA is the EU regulation on markets in crypto-assets (2023/1114). According to UKNF, the Polish financial supervisor, it has applied in full since 30 December 2024. A service provider, including an exchange, needs authorisation, and once it has one it can operate across the whole Union.

For a client, the most important part is the rules on holding funds. According to the text of Article 75 as published by ESMA, a provider that holds clients’ crypto-assets must:

1. sign an agreement with the client that sets out the duties and liability of both sides,
2. keep client assets separate from its own, so that the exchange’s creditors can’t reach them, including in a bankruptcy,
3. have procedures for returning assets to clients,
4. be liable for the loss of assets, or of the means of accessing them, caused by events attributable to it, up to the market value of the lost assets.

That’s a real change from the FTX era. It doesn’t solve everything, though. In its paper, UKNF cites ESMA’s position that MiCA does not address all the risks related to crypto-assets. Segregation of funds alone doesn’t protect against a hack, an operational error or an account freeze caused by client verification.

Poland adds one more complication. As of 19 October 2026 Poland has no act implementing MiCA and no designated supervisor of the crypto-asset market. UKNF’s position says that without a designated national authority, Polish firms lose the ability to provide services under the earlier transitional rules after 1 July 2026 and can’t obtain authorisation, while cross-border services from firms licensed in other EU countries remain possible. For readers in other EU countries, the national rules of their own country apply. For you, one thing follows: check in which country your exchange is authorised.

You can do that in the interim MiCA register on the ESMA website. It has files listing authorised service providers and entities that provide services without the required authorisation. An exchange missing from the register is a warning sign. Being in the register only means the exchange holds an authorisation, not that you’re free of risk.

What MiCA gives the client	What MiCA doesn’t solve
An authorisation requirement for service providers	Hacks of the exchange
Client funds kept separate from the exchange’s assets	Account freezes caused by client verification
An agreement describing duties and the custody policy	Liability above the market value of lost assets
A procedure for returning assets to clients	Your own mistakes: fraud, phished passwords, a wrong address
An ESMA register of authorised providers	Exchanges operating from outside the EU

When an exchange makes sense

An exchange is a good place for what it was built to do. If you buy and sell regularly, swap one cryptocurrency for another, or convert crypto to fiat, keeping part of your funds on the account saves network fees and time. Moving everything to a wallet after every trade makes no sense.

An exchange also makes sense when the amounts are small relative to your budget and you don’t plan to hold them for years, when you’re still learning to use crypto, or when you need instant access to funds for everyday payments.

That setup stops making sense when the account holds a sum whose loss would change your life, or when nobody close to you knows the account exists. At that point it’s no longer about trading convenience but about storage. For storage you use hardware wallets, covered separately.

Your own wallet: what you get and what you take on

In a hardware wallet the keys are created on the device and never leave it. You sign transactions on the device’s screen, so even an infected computer can’t send your funds. Nobody can lock you out, and nobody goes bankrupt with your coins. A transfer from your wallet works at midnight on Sunday the same as on Monday morning.

The price is concrete. Nobody is responsible for a lost sheet of paper with the words. If the seed falls into the wrong hands, someone will move the funds and nobody can reverse that transaction. If you write the words down wrongly and never check, you’ll find the error on the day it’s too late. That’s why your own wallet needs two things, and without them it’s worse than an exchange: a well-made backup (how to store it) and a tested recovery procedure. We’ve collected the most common errors in the guide Common crypto security mistakes.

The whole approach to securing crypto, from the backup to your family, is in the pillar How to secure crypto.

Exchange vs your own wallet in a table

Criterion	Exchange (custodial)	Own wallet (self-custody)
Who holds the keys	The exchange	You
What you actually have	A claim against the exchange	Funds under your own keys
Exchange bankruptcy	You join the creditors’ queue	Doesn’t apply
Account freeze	The exchange’s decision	Doesn’t apply
Exchange hack	The risk is on your side	Doesn’t apply
Losing access	Password reset by the exchange	Without the seed you recover nothing
Theft of the seed backup	Doesn’t apply	Someone can move everything out
Trading and swaps	Fast, in one place	Needs a transfer to an exchange
Fees	Exchange commissions	Network fee on each transfer
After your death	The exchange’s procedure and documents	Your family must know the place and the instructions
Knowledge required	Low	Medium, but you can learn it

An exchange moves the risk to someone you have no influence over. Your own wallet moves it to you, so you have to prepare for it.

Moving funds to your own wallet in eight steps

The procedure below is for a hardware wallet, for example a Trezor. The steps are the same for other devices, only the button names in the app differ. Buy the device only from the manufacturer or an authorised reseller, never second-hand.

1. Set up the wallet. Generate the seed on the device, write it down by hand, don’t photograph it and don’t type it anywhere else. Nobody, including us, should see it.
2. Check the backup. Before you send anything, run a recovery test: go through the restore procedure using the words you wrote down. It’s better to find an error in one word while the wallet is empty.
3. Generate a receiving address in the manufacturer’s app and check it on the device screen. Trezor describes this directly: copy the address from the app, paste it into the exchange and compare it with what the wallet screen shows. You can trust the device screen more than your computer.
4. Choose the right network. The same cryptocurrency can exist on several networks, and sending it on the wrong one can mean losing it. Trezor has a separate guide on choosing the network when you withdraw from an exchange.
5. Send a test amount. Withdraw a small sum from the exchange, one you wouldn’t mind losing. Wait for confirmation on the network and make sure the funds show up in the app. The exchange may ask for extra confirmation or hold a withdrawal to a new address for a while. That’s normal, so don’t repeat the withdrawal.
6. Send the rest. After a successful test, send the remaining amount. You can do it in several batches. For a large sum the network fee is small compared with the risk of a mistake.
7. Check recovery once more. Reset the device and restore the wallet from the written words. If the balance matches, the backup works. If it doesn’t, you’re still at the point where you can fix something.
8. Write down what you did, on a sheet for your family: where the device is, where the backup is and who to call. Without it, your own wallet is harder for your family than an exchange. That’s what access instructions for your family are for.

Keep two things in mind. First, don’t click links in messages and ads that offer “help moving your funds”. Second, don’t type your seed on any website or in any app. A real wallet will never ask for it anywhere except on the device’s own screen.

For bitcoin we additionally recommend a 2-of-3 wallet, where a transfer needs two of three keys. We build it during setup. For other cryptocurrencies, a well-moved hardware wallet with a solid backup is enough.

How to split funds between an exchange and a wallet

There’s no single number and we won’t give one: it’s an investment decision, and we don’t advise on those. What we can give is a rule for the split. The exchange holds what you need for day-to-day operations. Savings you don’t plan to touch in the coming months sit in a hardware wallet. A simple test: imagine that tomorrow you lose access to the account for three months. If that thought doesn’t scare you, the amount is fine.

You don’t have to pick “all or nothing”. Many people keep part on an exchange and part in a wallet, and move the line as they learn more.

If you don’t know where to start

Start with a list: where you have accounts, roughly how much is on each, and which of your family members know. Then check whether your exchanges are in the ESMA register. Only at the end decide what to move. If you’d rather do it with someone, the check-up is an hour-long online conversation after which you have a list of risks, most urgent first. We never see your keys, not for a moment, and we leave the decision about what to buy and sell to you.

We cover inheritance in the pillar Crypto inheritance.

Accurate as of 19 October 2026. This is not legal or investment advice. Exchange rules, the ESMA register and national crypto-asset rules change, and the act implementing MiCA in Poland is still being drafted, so check the current state and your exchange’s terms before you decide.