Choosing where to hold crypto is a custody decision, not just a platform decision. This checklist helps you compare exchanges, hardware wallets, and self-custody arrangements by looking at account protections, fees, private-key responsibility, recovery procedures, phishing exposure, and transaction controls before you deposit or move funds.
Overview
Crypto custody describes who controls the private keys needed to authorize transactions. With an exchange account, the platform generally holds the keys while you access your assets through an account. With self-custody, you control the keys through a software or hardware wallet. A hardware wallet is a self-custody tool designed to keep key operations separate from an internet-connected device, but it does not remove the need for careful backups and transaction checks.
There is no universally safest arrangement. An exchange may be easier to use and may provide account recovery, while self-custody gives you direct control but makes you responsible for protecting the recovery information. The right setup depends on your technical confidence, transaction habits, time horizon, and ability to maintain a secure backup process.
| Factor | Exchange custody | Software wallet | Hardware wallet |
|---|---|---|---|
| Private-key responsibility | Usually handled by the provider | Handled by the user | Handled by the user, with keys designed to remain separated from routine online activity |
| Account recovery | May use verified account and identity-recovery procedures | Usually depends on the wallet recovery phrase | Usually depends on the recovery phrase and replacement-device process |
| Withdrawal controls | May include address allowlists, delays, limits, or manual reviews; check current terms | Controlled by the wallet and signing device | Controlled by the wallet, device, and signing confirmation |
| Fees | May include trading, withdrawal, spread, and network-related charges | May involve network fees and optional service fees | May involve the device cost, network fees, and optional service fees |
| Phishing exposure | Login, email, support, and withdrawal scams | Fake apps, malicious websites, and fraudulent transaction requests | All of the above, plus counterfeit devices or compromised setup instructions |
| Best question to ask | What happens if access is blocked or the provider changes its terms? | Can I secure and recover the phrase without exposing it? | Can I verify the device, create a reliable backup, and check every transaction? |
Fees and features change by provider, asset, location, and network. Treat the table as a comparison framework rather than a current ranking or guarantee. Before acting, read the provider's latest fee schedule, custody terms, withdrawal rules, and recovery documentation.
Checklist by scenario
If you are opening an exchange account
- Use the provider's official website or application, reached through a trusted bookmark rather than an unsolicited link.
- Review which assets and networks are supported. A deposit can be difficult or impossible to recover if the wrong network or address format is used.
- Read the fee schedule for purchases, trades, withdrawals, conversions, and network charges. Look for minimums, limits, and any fee that is deducted from the transfer.
- Enable a strong, unique password and multi-factor authentication. Prefer an authentication method that is not dependent on easily intercepted text messages where a stronger option is available.
- Check withdrawal protections, including address allowlists, confirmation delays, new-device alerts, and account-lock procedures.
- Confirm how account recovery works and what information support may request. Never provide a password, recovery phrase, or private key to support.
- Start with a small test deposit and withdrawal before transferring a larger balance.
If you are choosing self-custody
- Download wallet software only from a verified source and check that the app, extension, or device is the product you intended to install.
- Create the recovery phrase privately. Do not photograph it, store it in ordinary cloud storage, paste it into a website, or share it with anyone.
- Write the phrase accurately on a durable medium and store it where unauthorized people cannot access it. Consider how the arrangement would work during an emergency or extended absence.
- Test recovery with a separate, controlled process before relying on the wallet for a substantial balance. A backup is useful only if it is complete, legible, and compatible with the wallet.
- Use a hardware wallet for balances that justify the added setup and verification responsibilities. Buy through a source you can verify and inspect the device and packaging for anything inconsistent with the manufacturer's instructions.
- Separate everyday spending from long-term holdings. A wallet connected frequently to websites has a different exposure profile from a device used rarely for storage.
Before sending a transaction
- Verify the recipient address on the signing device, not only on the computer or phone screen. Malware can replace an address during copying.
- Confirm the asset, network, destination tag or memo where required, amount, and expected fee.
- Check the first and last characters of the address and, when practical, compare the complete address using a trusted method. Do not rely on a contact name alone.
- Reject unexpected requests to connect a wallet, sign a message, approve token spending, or transfer funds. A transaction can be dangerous even when it does not immediately send the asset.
- Send a small test amount when the destination, network, or process is unfamiliar. Wait for the expected confirmation before sending the remainder.
- Save the transaction identifier and review the destination through an appropriate block explorer without entering your recovery phrase.
What to double-check
Custody terms: Determine whether your balance represents direct control of a specific asset, a contractual claim, or another account entitlement. Read how withdrawals, maintenance periods, account restrictions, and inactive accounts are handled.
Recovery design: A password reset is not the same as recovery of a self-custodied wallet. For self-custody, the recovery phrase is generally the critical backup. Anyone who obtains it may be able to control the funds, while losing it may leave no ordinary support path. Keep the phrase separate from the device and from routine login credentials.
Approval permissions: Some applications request permission to spend tokens or interact with contracts. Review approvals periodically and revoke permissions you no longer need using a trusted tool. Be especially cautious when a site pressures you to act quickly or promises an unusually large reward.
Operational continuity: Decide what happens if your phone is lost, your device fails, you become unavailable, or a trusted family member needs to understand the arrangement. Document the location of instructions without documenting secrets in an exposed file.
Portfolio fit: Custody is only one part of investment risk. Position size, concentration, liquidity needs, volatility, and tax records also matter. A secure wallet cannot make an unsuitable allocation appropriate. For broader planning, compare your crypto exposure with your overall portfolio and net worth using a consistent tracking process, such as the approach outlined in the net worth tracker guide.
Common mistakes
- Confusing convenience with protection: A simple interface can reduce friction, but it does not eliminate account, device, or phishing risk.
- Keeping every asset in one place: Concentrating funds creates a single point of failure. A divided arrangement may reduce operational risk, provided each part remains manageable.
- Typing a recovery phrase into a website: Legitimate support should not need it. Treat any request for the phrase or private key as a severe warning.
- Skipping a test transaction: Network selection, address errors, and memo requirements can create avoidable problems.
- Approving blindly: Signing is not merely logging in. Read what the wallet and signing device display, and stop when the request is unclear.
- Ignoring small balances: Small accounts often receive less attention, yet they may remain connected to old apps, devices, or permissions.
- Assuming a device is automatically safe: Hardware wallet security still depends on authentic hardware, private setup, accurate backups, current documentation, and careful user verification.
When to revisit
Review your custody setup before opening a new account, moving a material amount, changing devices, using a new blockchain network, or connecting to a new application. Schedule a practical security audit at least annually and whenever your household, contact details, trusted people, or storage arrangements change.
Also revisit the setup after a provider changes its fee schedule, withdrawal process, supported networks, authentication options, or custody terms. Provider policies and wallet software can change, so confirm details from current official documentation rather than relying on an old comparison. The same applies after a significant security incident or a suspected phishing attempt: stop transactions, secure email and account access, review approvals, and use verified support channels.
For a repeatable annual audit, print or save this short checklist:
- List every exchange, wallet, device, and connected application.
- Confirm that official apps, bookmarks, contact details, and authentication methods are current.
- Verify that recovery backups are private, readable, complete, and accessible to the intended owner.
- Review withdrawal controls, account limits, fees, network support, and transaction history.
- Remove unused applications and token approvals, then test a small recovery or transfer process where appropriate.
- Record any change in custody, allocation, or transaction rules in your investment plan. If you use a recurring approach, the Bitcoin DCA strategy guide can help you define review rules rather than making decisions ad hoc.
Good crypto custody is less about choosing a single “best” wallet and more about matching control to responsibility. Compare the trade-offs, move gradually, verify every transaction, and revisit the process whenever the tools or your circumstances change.
