Self-custody 101: hot wallet or hardware wallet?

When you buy bitcoin on an exchange, you usually do not hold bitcoin. You hold a claim on a company that holds it for you. Self-custody means holding the keys yourself, in a wallet only you control. That removes one risk, the company, and hands you another: if you lose the keys or someone tricks you out of them, nobody can reverse it. This guide explains what you are actually holding, how a seed phrase works, the real difference between a hot wallet and a hardware wallet, and the habits that protect you more than any device.

Custody on an exchange versus self-custody

A bitcoin balance is controlled by a private key: whoever can sign with that key can move the coins. The question "who holds my crypto?" is really "who holds the key?".

Custody on an exchange. The platform holds the keys. Your account shows a balance, and withdrawals depend on the platform being solvent, honest and willing to process them. Bitcoin.org puts it plainly: when a third party controls your keys, you rely entirely on their security and honesty.
Self-custody. You hold the keys in a wallet. No company can freeze or lend out your coins, but there is also no support desk, no password reset and no chargeback.

The old saying "not your keys, not your coins" is a short way of saying that an exchange balance is an IOU. That is not automatically bad: a licensed custodian can be a reasonable choice for an amount you trade often. It is a different risk, and you should know which one you are taking.

What happens when a custodian fails

The collapse of FTX is the standard example. In its complaint, the US Securities and Exchange Commission alleged that Sam Bankman-Fried diverted FTX customers' funds to his trading firm Alameda Research and used commingled customer funds to make undisclosed investments. When a custodian fails, customers who left coins on the platform are left with a claim against the company. Coins already withdrawn to a wallet the customer controls are not part of that claim.

What a seed phrase is

Modern wallets do not ask you to back up raw private keys. They generate a seed phrase (also called a recovery phrase or mnemonic): a list of ordinary words from which every key in the wallet is derived. The standard most wallets follow is BIP-39.

What BIP-39 specifies, in plain terms:

The phrase encodes random data (entropy) of 128 to 256 bits, which gives a phrase of 12 to 24 words. More entropy means a longer phrase and more security.
Each word is one entry from a fixed public wordlist, so the words themselves are not secret. Their order and combination are.
An optional passphrase can be added. BIP-39 says that if no passphrase is set, an empty string is used instead. A different passphrase gives a completely different wallet from the same words.

The consequence is simple: anyone who sees your seed phrase owns your coins, on any device, anywhere, without needing your phone or your hardware wallet. Ethereum.org puts it bluntly: no legitimate service, support agent or website will ever ask you for it.

Hot wallet or hardware wallet

The difference between the two is not the coins. It is where the private key lives when you sign a transaction.

	Hot wallet (phone or browser app)	Hardware wallet
Where the key lives	On an internet-connected phone or computer	On a separate device that signs inside itself
Main threats	Malware, malicious browser extensions, phishing sites, a stolen unlocked phone	Phishing and fake approvals you confirm yourself, a lost or exposed seed backup, tampered devices bought second-hand
Cost	Free	You pay for the device
Convenience	Fast for daily use and apps	Slower: you confirm each transaction on the device
Best for	Small amounts you spend or move often	Savings you rarely touch

Bitcoin.org's guidance matches the table: keep only small amounts on a computer or mobile device for everyday use, and treat an offline wallet, also known as cold storage, as the highest level of security for savings. Ethereum.org describes hardware wallets the same way: the private key never touches the internet and stays on the device.

Two things a hardware wallet does not do:

It does not protect you from approving a bad transaction. If a fake website asks you to sign a token approval and you confirm it on the device, the device signs it. Read the screen of the device, not the website.
It does not protect a seed backup that someone else can read. The device is only as safe as the paper, or metal, your words are written on.

Many people use both: a hot wallet for small, active amounts, and a hardware wallet for the rest. It is the same logic as sizing a trade: decide in advance how much can sit where, as in our guide to position sizing.

Backing up the seed phrase

This is where most self-custody losses start. A few rules that hold for any wallet:

Write it down offline. Bitcoin.org warns that any backup stored online is highly vulnerable to theft. No photos, no notes app, no email to yourself, no cloud folder. Ethereum.org adds that a screenshot of your seed phrase might sync to a cloud provider without you noticing.
Keep it somewhere that survives a fire or a flood, and consider a second copy in another place. Losing the only copy has the same result as having it stolen: the coins are gone.
Never type it into a website. The only place your seed phrase is entered is the wallet itself, when you restore it.
A passphrase is a second factor, with a second risk. It protects you if someone finds the words, but if you forget the passphrase, the words alone restore an empty wallet.
For larger amounts, look at multisig. Bitcoin's multi-signature feature can require several independent approvals to spend, so one lost or stolen key is not the end.

Test the recovery before you trust it

Before you move savings into a new wallet, send a small amount, then wipe or reset the wallet and restore it from the words you wrote down. If the small amount comes back, your backup works. If it does not, you found the problem when it cost almost nothing.

Addresses, networks and irreversible mistakes

On-chain transfers cannot be undone. Ethereum.org reminds users that a transaction sent on Ethereum is irreversible, and the same is true for bitcoin. Before every withdrawal or transfer:

Check the whole address, not just the first and last characters. Some malware swaps a copied address for one the attacker controls.
Check the network. The same token can exist on several blockchains. Sending it on a network the receiving wallet does not support can make it unrecoverable.
Send a small test first when the address is new to you, then the rest.

Phishing, drainers and token approvals

Most thefts from self-custody wallets do not break any cryptography. They trick the owner into giving access away. The FBI's 2024 Internet Crime Report counted $9.3 billion in losses from cryptocurrency fraud complaints reported to it that year.

The common patterns:

Fake support. Someone on Telegram, X or Discord offers to "help" and asks for your seed phrase or to "verify" your wallet on a website.
Drainer sites. A page copies a real project, an airdrop or a mint, and asks you to connect and sign. The signature grants a contract permission to move your tokens.
Unlimited approvals. Many apps ask for permission to spend an unlimited amount of a token. Ethereum.org advises not to allow unlimited spend limits; approve only what the transaction needs and revoke old approvals you no longer use.

The same caution applies to the tokens you choose to hold. A wallet keeps your keys safe; it does nothing about a token designed to trap buyers. Our rug pull check goes through what to look at before you buy, and locked vs burned liquidity explains one of the claims new tokens make about safety.

What MiCA covers if you keep coins with a provider

Self-custody is not the only safe option in the EU. Under MiCA, a licensed crypto-asset service provider that holds coins for you has specific duties under Article 75:

Segregation. Client crypto-assets held in custody must be legally segregated from the provider's estate, so that the provider's creditors have no recourse to them, including in insolvency.
Statements. The provider must give you a statement of your positions at least once every three months, and on request.
Liability. The provider is liable for the loss of client crypto-assets caused by an incident attributable to it, with the liability capped at the market value of what was lost at the time of the loss.

What MiCA does not do: it does not protect coins you withdrew to your own wallet, it does not reverse a transfer you signed yourself, and it does not cover firms that are not licensed. Check a platform's licence first; our guide on how to check a MiCA-licensed exchange shows how.

A simple setup to start with

Keep on an exchange only what you are actively trading, and only with a licensed provider.
Use a hot wallet for small, everyday amounts.
Move savings to a hardware wallet, set up from new, with the seed phrase written offline.
Test the recovery with a small amount before moving the rest.
Treat every request for your seed phrase, and every unexpected signature, as an attack until proven otherwise.

FAQ

What is self-custody in crypto?

It means you hold the private keys to your coins yourself, in a wallet you control, instead of leaving them with an exchange. You gain independence from the company and take on full responsibility for the keys.

Is a hardware wallet safer than a hot wallet?

For savings, usually yes: the private key stays on a separate device and never touches the internet. It does not protect you from approving a malicious transaction yourself, or from a seed phrase backup that someone else can read.

What happens if I lose my hardware wallet?

If you still have the seed phrase (and the passphrase, if you set one), you can restore the wallet on a new device and your coins are still there. If you lose both the device and the seed phrase, the coins cannot be recovered by anyone.

Should I store my seed phrase in a password manager or a photo?

No. Bitcoin.org warns that any backup stored online is highly vulnerable to theft, and screenshots can sync to the cloud without you noticing. Write it down offline and keep it somewhere safe.

Are coins on a MiCA-licensed exchange protected?

MiCA requires a licensed custodian to keep client crypto-assets legally segregated from its own estate, to send position statements and to be liable for losses it causes, up to the market value lost. That is real protection, but it is still a claim on a company, not keys you hold.