A friend of mine has never touched crypto. Not once. At our last barbecue, somewhere around the third Corona, he started asking questions and did not stop.
How do you buy it? What is a wallet? Why do people care about Bitcoin at all?
Honestly, I assumed it was barbecue talk. Plenty of people ask, almost nobody follows through.
Then a WhatsApp message landed a few days later. He had decided to start DCA’ing, and he wanted to know one thing: where do you store the coins after you buy them?
That question is the whole game. Meanwhile, we just watched a wave of exchanges shutting down inside a single month. So the timing made me think harder about my answer than I expected.
Is self custody still the right advice? Or has the ground moved under us?
What Is Self Custody?
Self custody means you hold your own private keys. No company sits between you and the blockchain. Your coins live at an address that only you can sign transactions from.
In practice, that usually looks like one of two things.
A hot wallet runs as a browser extension or phone app. MetaMask, Phantom and Rabby are common examples. Setup takes about two minutes, and the wallet stays connected to the internet.
A hardware wallet keeps your keys on a physical device instead. Ledger and Trezor dominate here. Signing a transaction requires the device in your hand, which blocks most remote attacks.
Both approaches hand you the same thing: a seed phrase. Twelve or twenty-four words, generated once, and that string of words is your money. Anyone holding it controls the wallet. Lose it, and no support ticket will bring your funds back.
That last sentence sounds obvious. Later in this post, I will explain why it is not.
The Case for Self Custody
The core argument has not weakened in ten years. When you hold your own keys, nobody can freeze, lend out, or lose your coins.
No counterparty risk. Your balance is not an IOU sitting on somebody’s balance sheet. It is an on-chain position that exists whether or not any company survives the year.
No withdrawal queues. Exchanges pause withdrawals during hacks, bankruptcies and compliance reviews. Your own wallet does not have a support desk that can go quiet.
No permission needed. Nobody asks for a source-of-funds document before you move your own coins. Sanctions, regional exits and licensing changes cannot lock you out.
Full access to the ecosystem. DeFi, airdrops, staking and on-chain trading all require a wallet you control. Sitting entirely on an exchange means sitting out most of what makes crypto interesting.
For anyone who wants to actually use crypto rather than just own it, self custody stops being optional pretty quickly.
Where Self Custody Goes Wrong
Here is the part that rarely makes it into the “be your own bank” speeches.
Self custody transfers risk rather than deleting it. You remove the exchange, then you become the exchange. Every security failure is now yours to prevent.
Wallet drainers
Drainers are the biggest threat to ordinary holders right now. These are malicious contracts that trick you into signing a transaction which hands over your tokens.
The business model industrialised fast. Kits like Inferno Drainer, Angel Drainer and Pink Drainer were sold as a service, with the developers taking a cut of everything stolen. Inferno Drainer alone has been linked to well over $80 million in losses.
Notice what these attacks do not require. No malware on your machine, no leaked seed phrase, no sophistication at all. You simply approve a transaction on a website that looked legitimate.
Fake airdrop claim pages are one of the most common delivery methods, which is exactly why we bang on about verifying URLs. Here’s a guide on how to avoid those.
Supply chain attacks
Sometimes the compromise happens upstream. In December 2023, attackers pushed malicious code into the Ledger Connect Kit, a library used by dozens of legitimate dapps. Users who did everything right still got drained, because the front end they trusted had been poisoned.
Human error
This is the quiet one. Lost seed phrases, corrupted backups, forgotten passwords, phones that die with no recovery, funds sent to the wrong chain.
Chainalysis estimates that a meaningful share of all Bitcoin ever mined is permanently unreachable. Nobody stole it. Owners simply lost the keys.
Which brings me to my own contribution to that statistic.
The Trap: My 400,000 Dogecoin Mistake
Back in 2014, I ran a dogecoin miner. Mining doge at home was a fun hobby project, and the rewards piled up faster than I expected.
Everything went into a Dogecoin wallet. Around 400,000 DOGE ended up in there.
Today I cannot open it. The password is gone, the login details are gone, and years of recovery attempts have produced nothing. My best guess is that I encoded something personal into it, which no longer helps me at all.
Yes, that is entirely my own fault. Storing it properly was always my responsibility.
But consider the context. At the time I created that wallet, the doge inside was worth less than a hundred dollars. Nobody sets up a rigorous backup process for a hundred dollars of joke money mined on a home computer.
That is precisely the trap. Security decisions get made when the amount feels irrelevant, then the consequences arrive a decade later when it very much is not.
Human error is the real enemy of self custody. Hackers get the headlines, yet forgetfulness has quietly taken far more coins off the market than any of them.
Not Your Keys, Not Your Coins
Every crypto veteran has said this line a thousand times. Worth remembering, though, is where it actually came from.
Mt. Gox handled the majority of global Bitcoin volume before collapsing in February 2014. Around 850,000 BTC disappeared. Creditors are still receiving distributions more than a decade later.
BTC-e was another one. A shady Russian-linked exchange with no oversight and no accountability, eventually seized by US authorities in 2017.
That was the environment where the phrase was born. Exchanges had no licences, no audits, no insurance and frequently no real corporate structure. Handing them your coins meant trusting an anonymous operator with zero recourse if things went wrong.
In that era, I told everyone to self custody. One hundred percent of the time, without hesitation. The alternative was genuinely reckless.
Things have changed since then, and I think honest crypto people should say so.
The Case for Holding on an Exchange
Exchanges solve real problems, and pretending otherwise does beginners no favours.
Recovery exists. You are KYC’d, so a forgotten password means a reset flow rather than a permanent loss. My dogecoin story simply cannot happen to you on a regulated exchange.
Trading is frictionless. Buying, selling and rebalancing happen instantly, without gas fees, bridges or chain selection.
Fiat rails work. Bank transfers in, bank transfers out, no third-party on-ramp required.
Support answers. Sent something wrong? Sometimes a human can actually help you.
Human error largely disappears. No seed phrase to lose, no drainer signature to approve, no wrong-network transfers.
The trade-off is precise, and it is worth stating clearly. Exchanges remove human error and add counterparty risk. Self custody removes counterparty risk and adds human error.
Neither option is safe. You are choosing which failure mode you would rather be exposed to.
The Real Exchange Risk: They Can Just Stop Existing
This is the failure mode that deserves its own section, because July 2026 delivered three separate examples in a fortnight.
BitMEX announced closure on 23 July, with operations ending 23 September. Importantly, the company is solvent, assets exceed liabilities, and it has never lost customer funds to a hack. Users simply have a deadline.
BitMart began winding down on 26 July. Withdrawals stayed open, although users immediately reported delays and extra compliance checks. Trading stops on 26 August.
AscendEX is the genuinely ugly one. Automated withdrawals were paused and moved to manual review, with no guaranteed timeline for users trying to get out. The European new MiCA rules played a part in this one.
Three shutdowns, three completely different outcomes. Some of these are orderly exits, while others leave people stuck. From the outside, on day one, you often cannot tell which is which.
The Dutch case hits closer to home for me. A Rotterdam court declared the exchange Knaken bankrupt on 16 July. Prosecutors allege that roughly €7 million in customer funds went missing. Around 30,000 customers were locked out before anyone outside the company knew there was a problem.
Their office sat about 250 metres from mine. During AirdropAlert’s Rotterdam year, I drove past that building every single day. Never once did I stop in for a chat, which feels slightly absurd in hindsight.
Worth knowing as well, Knaken never appeared in the AFM register of authorised crypto-asset service providers. Anyone could have checked that in public, for free, before depositing a cent.
And then there are the historic blowups. FTX vaporised billions in November 2022 while looking perfectly healthy from the outside. QuadrigaCX went down in 2019 when its founder died holding the only keys, which is a fitting piece of irony for this particular article.
Those are the outliers, though. Treating FTX as the base case for every exchange is like refusing to fly because of a specific crash.
Exchanges That Got Hacked and Survived
Here is the part the “not your keys” crowd tends to skip. Modern exchanges absorb attacks that would have killed any 2014 platform outright.
Bybit, February 2025. Roughly $1.4 billion drained in the largest crypto theft ever recorded. Bybit covered the entire shortfall, kept withdrawals running through the incident, and restored one-to-one backing within days.
Binance, 2019. Around 7,000 BTC stolen, fully covered by the SAFU insurance fund. Users lost nothing.
Bitfinex, 2016. About 120,000 BTC gone. Losses were socialised across users via redeemable tokens, and every one of those tokens was repaid in full by April 2017.
Coincheck, 2018. Roughly $530 million in NEM stolen, with users reimbursed from company funds.
KuCoin, 2020. Around $280 million taken, with the large majority recovered or covered.
BitMart, 2021. Approximately $196 million lost in a hot wallet breach, again covered by the company. Worth noting that BitMart survived the hack and is closing five years later for ordinary business reasons.
Pattern recognition matters here. A well-capitalised exchange today can eat a nine or ten-figure hack and keep operating. That was simply not true when the “not your keys” mantra was written.
Regulation deserves some credit too. Licensing regimes, proof-of-reserves publishing, segregated customer funds and insurance pools all exist now. None of it is perfect, yet it is a different world from BTC-e.
Your Purpose Decides Your Storage
Forget the ideology for a second. The right answer depends entirely on what you plan to do.
Buy and hold for years. Self custody, almost certainly. Long time horizons mean long exposure to exchange risk, and you are not touching the coins anyway.
Active trading. An exchange, obviously. Nobody self-custodies between scalps.
DCA’ing small amounts. Start on an exchange, then migrate once the balance becomes serious. Moving $200 a week into a hardware wallet is friction with no real benefit.
Using DeFi or farming airdrops. Self custody, because there is no alternative.
Notice that most people fall into more than one bucket. Splitting across both is completely normal, and honestly it is what I do.
Support Our Work
If you found this helpful, consider signing up on OKX or Bybit using our referral links. Your support keeps this content free and flowing.
What I Actually Told My Friend
So I asked him the only question that mattered. What is your purpose here?
His answer was simple. He wanted three or four of the bigger coins, bought steadily, held for the long run. He had no prior crypto experience and no trading experience of any kind. His DCA budget worked out to roughly two months of salary, spread across ten weekly buys.
Under those conditions, self custody would mean managing multiple wallets across multiple chains. Bitcoin, Ethereum and Solana do not share an address. That is three seed phrases minimum, or one hardware wallet he has never used before, while he is still learning what a blockchain even is.
Realistically, the odds of him making a mistake in year one are far higher than the odds of a major exchange failing in year one.
My advice was to keep it on an exchange for now. I recommended Bybit, since the interface is beginner-friendly and the platform demonstrated in 2025 that it can absorb a billion-dollar hack without users losing a cent. You can check our Bybit review here.
Then I gave him a threshold. Once the position approaches something like a year of salary, revisit the decision. Learn self custody with a small test amount long before you need it, and move deliberately rather than in a panic.
Because when the money gets big enough, my preference flips. At that point, I want control over convenience, every single time.
I also walked him through both risk sets honestly. He knows exchanges can fail. Equally, he knows I lost 400,000 doge to my own carelessness.
Final Words
The old rule was written for a world of unregulated offshore exchanges with no accountability whatsoever. In that world, self custody was the only rational choice, and I gave that advice to everyone.
Today the picture is genuinely more complicated. Major exchanges are licensed, audited, insured and capable of surviving enormous attacks. Meanwhile, drainers have become an industry, and human error remains undefeated.
So the honest answer is uncomfortable for purists. For a complete beginner with a modest position, a well-known exchange may genuinely be safer than a self custody wallet they do not yet know how to protect.
That said, self custody remains the endgame. Coins you never intend to sell should not live on somebody else’s balance sheet indefinitely. Learn it early, practise it with small amounts, and graduate to it before your stack becomes life-changing.
Choose your failure mode deliberately. That is really all this decision is.
You can find our full reviews and comparisons in the exchange review hub
As always, don’t forget to claim your bonus on Bybit below. See you next time!
FAQ
What is self custody in crypto? Self custody means holding your own private keys, usually through a hot wallet or hardware wallet. No company can freeze, lend or lose your coins, because no company is involved.
Is self custody safer than an exchange? It depends on the user. Self custody removes counterparty risk but makes you fully responsible for security and backups. Beginners frequently lose more to their own mistakes than to exchange failures.
What happens if an exchange shuts down? Outcomes vary widely. Orderly wind-downs give users months to withdraw, while insolvencies and fraud cases can lock funds indefinitely. Acting quickly on any shutdown notice is always the correct move.
How much crypto should I self custody? There is no fixed rule, though a common approach is to migrate once the position becomes financially significant to you. Practising with a small test amount first is strongly recommended.
Can you recover a lost self custody wallet? Only with the seed phrase or private key. No support team exists, and no recovery process is possible without them, which is why backups matter so much.
What is a wallet drainer? A wallet drainer is a malicious contract that steals tokens once you approve a transaction. Fake airdrop pages and lookalike websites are the most common delivery methods.
WRITTEN BY
Morten ChristensenFounder, AirdropAlert
Crypto class of ’13, airdrop farmer since 2016. Avid trader and DeFi veteran. His market commentary has been featured by Bloomberg, The Wall Street Journal, The New York Times, Forbes, and CNN.
Credit: Source link
