Cold Storage vs Exchange: Who Actually Holds Your Crypto?

There are two ways to hold cryptocurrency, and the choice between them is not a security-settings question. It changes who legally holds the asset.

Both arrangements can lose you everything. They just do it in completely different ways, and the failure modes have almost nothing in common.

What custody means here

A blockchain does not record owners. It records addresses and the fact that a particular private key can authorise spending from them.

Whoever controls the private key controls the coins. That is the whole of it, and every other statement about crypto custody is downstream.

So the real question is never "where is my crypto" — it is on the chain, always — but "who holds the key that moves it".

Exchange custody: someone else holds the key

Buy on an exchange and leave it there, and the exchange holds the key. Your balance is an entry in the exchange's database saying it owes you that amount.

That is a claim on a company, not possession of an asset. On a normal day the distinction is invisible and irrelevant. It becomes the only thing that matters when the company fails.

What you get in exchange is real and should not be dismissed:

What you take on:

Note carefully: deposit insurance does not apply to crypto held on an exchange. Schemes like the FDIC in the United States cover bank deposits at insured banks. Where an exchange holds your fiat balance at a partner bank, that fiat may be covered — the crypto is not. Marketing that mentions insurance in the same breath as a crypto balance is exploiting a distinction most readers do not know exists.

Self-custody: you hold the key

Move the coins to a wallet you control and you hold the key. The counterparty risk disappears entirely — there is no company to fail.

It is replaced by risk you cannot delegate:

Self-custody splits further:

Hot wallets — software on an internet-connected device. Convenient, and exposed to everything that device is exposed to.

Cold storage — the key generated and kept on a device that never touches the internet. A hardware wallet signs transactions internally and only ever emits the signature, so the key does not leave even when the device is plugged into a compromised computer.

Cold storage is what genuinely defeats remote attackers. It does nothing about the other failure: you.

The recovery phrase is the actual asset

A hardware wallet's recovery phrase reconstructs the key. Which means the phrase is the wallet. The device is a convenience; the phrase is the thing.

The consequences follow ruthlessly:

So the problem becomes physical: the phrase must survive fire, flood, moving house and thirty years, while being unreadable to anyone who finds it, and findable by the people who should have it if you die.

That last clause is where most plans collapse. Perfect security that nobody else can execute is a guarantee the holding dies with you.

Choosing, honestly

The decision is not "cold storage is correct". It is a question about which risk you are better placed to manage.

Exchange custody is defensible for amounts you would be annoyed but not ruined to lose, for active trading, and for anyone who realistically will not maintain a backup regime for decades. Choosing a large, regulated venue and using strong two-factor authentication is a real mitigation, not a fig leaf.

Self-custody is defensible for amounts you cannot afford to lose to someone else's failure, and for holdings you intend to leave untouched for years.

Many people run both, deliberately: a working balance where trading happens, and long-term holdings in cold storage. That is not indecision. It is matching the arrangement to the job.

Before you move anything

That final step is skipped almost universally, and an untested backup is a belief rather than a plan.

Tax does not care which you chose

Moving your own coins between your own wallets is generally not a disposal. Selling, swapping one asset for another, or spending them generally is — and the rules differ sharply by jurisdiction.

If you have used a crypto card, note that the spending leg is frequently a disposal in its own right, which surprises people annually. Check your own tax authority's guidance; the exchange's export is a record, not a tax return.

Nothing here is financial or security advice. Crypto assets are volatile, largely unprotected by investor compensation schemes, and capital is at risk.

Related reading: Crypto for Traditional Investors: Risk, Allocation, Custody