Home / Crypto / Academy / Custody and security

Where to actually keep your crypto

There is no single safest place. There is a sensible allocation, and it changes with how much you hold.

MODULE 10 OF 64 LEVEL 2: CUSTODY AND SECURITY 8 MIN

The four options and what each actually protects against

Custody compared

Regulated exchange

Protects against you

Guards against losing a seed phrase or being drained by a signature, because you never handle either. Fails if the company fails, freezes your account, or is hacked. You are a creditor.

Hot wallet on a phone or browser

Protects against them

Nobody can freeze it. Fails if you approve something malicious, install a fake app, or lose the phrase. This is where drainer attacks land.

Hardware wallet

Protects against both

The key never touches an internet connected device and the screen shows what you are signing. Fails if you buy it secondhand, lose the phrase, or approve a malicious transaction anyway without reading the screen.

Multisig

Protects against a single failure

Several keys must agree. No single compromised key loses the funds. Fails if signers approve without verifying, which is exactly what happened in the largest theft in crypto history.

A sensible split

What you are actively trading: on a regulated exchange. Convenience is worth something and the amount is bounded.
What you intend to hold for months: a hardware wallet. Once the amount exceeds the cost of the device several times over, there is no argument left.
What you use for DeFi: a separate hot wallet holding only what you are willing to lose in that session. Never your main holding.
Anything life changing: multisig, with signers stored separately, and a documented plan for what happens if you are not around.

The separate DeFi wallet is the most underrated idea here. If a drainer catches you, it takes what was in that wallet and nothing else. It costs nothing to set up.

The lesson from the largest theft ever

In February 2025 around 1.4 billion dollars was taken from Bybit. The funds were in a multisig. The contracts were not exploited. The attackers manipulated what the signers saw before they approved, and the signers approved it.

Multisig protects you from a compromised key. It does not protect you from signers who do not verify. Whatever the setup, the moment of approval is where security actually lives.

BEFORE YOU MOVE ON

I keep only trading funds on an exchange I use a hardware wallet for longer term holdings I use a separate wallet for DeFi I verify on the device screen, not the computer screen

Common questions

Is a hardware wallet worth it for a small amount?

Once your holding is worth several times the price of the device, yes. Below that the maths is arguable, and a separate clean hot wallet with a properly stored phrase is reasonable.

Is it safe to leave crypto on a regulated exchange?

It is safe from your own mistakes and unsafe from the company's. Regulated venues fail far less often, but FTX was not an unknown name. Anything you are not actively trading belongs in your own custody.

Risk warning: crypto is highly volatile and largely unregulated. You can lose everything you put in. Nothing here is financial, investment or tax advice.

← PREVIOUS

Approvals, signatures and wallet drainers

How to verify a site, a contract and a person