Exchanges and Custody: Who Holds Your Keys?

Category: Security and Scam Prevention · Published 2026-07-01

Security reviewed and sourced on 2026-07-02

What does this mean?Editorial review covers clarity and neutrality. Technical, security, and source reviews indicate whether an article's material claims were checked against relevant authoritative material. A source link being available does not by itself mean every claim has been verified. A reviewed status means the article's material claims were examined; it does not mean the article is exhaustive or that future protocol, market, or software changes cannot make it outdated.

What a crypto exchange actually is

A crypto exchange is a company that lets you swap money for bitcoin, turn bitcoin back into money, or trade one coin for another. Think of it as a currency booth joined to a marketplace. You open an account, prove your identity, deposit funds, and press buy or sell. It is the on-ramp most people use first, because it is fast and familiar.

The important detail hides behind that convenience. On a typical centralised exchange, the coins you appear to own are not really in your possession. The exchange keeps them in its own wallets and simply records, in its private database, that a certain balance belongs to you. Your account screen shows a number. That number is a promise from the company, not coins sitting under your direct control.

Who holds the keys: custodial vs self-custody

Bitcoin is controlled by private keys — secret data that authorises spending. Whoever holds the keys holds the coins. Everything else is just bookkeeping.

That leaves two very different arrangements:

  • Custodial: a third party, usually an exchange, holds the keys for you. You log in with a password and they move the coins on your behalf. Convenient, but you are trusting them completely.
  • Self-custody: you hold the keys yourself, usually backed up as a recovery phrase (also called a seed phrase) — a short list of words that restores your wallet. No company stands between you and your coins.

This is the whole meaning of the well-worn phrase "not your keys, not your coins." If you cannot move your bitcoin without asking someone's permission, then in a real sense they hold it and you hold an IOU.

The convenience, and the counterparty risk

Custodial exchanges exist because they solve real problems, and it is only fair to name their honest advantages:

  • Easy to start — buy with a card or bank transfer, with no keys to manage.
  • Forgot your password? You can reset it — a safety net self-custody does not offer.
  • Deep liquidity and quick trades, all in one place.

The cost of that convenience is counterparty risk1 — the danger that the party holding your coins fails to give them back. It can happen several ways: a hack drains the company's wallets, poor management leaves it insolvent, balances get frozen or seized, or, in the worst cases, the operators were dishonest all along. None of these depend on you making a mistake. You can do everything right and still lose coins that someone else was holding. Unlike bank deposits, crypto held on an exchange is generally not government-insured, so if the company fails there may be no authority that makes you whole.4

History shows exchanges can fail

This is not hypothetical. The industry's clearest lessons come from exchanges that failed while holding customers' money.

  • Mt. Gox: once the largest Bitcoin exchange in the world, based in Japan. It collapsed in 2014 after losing a very large amount of customer bitcoin, and filed for bankruptcy. Many users waited years to recover only a fraction of what they had held.
  • FTX: a major global exchange that collapsed in 2022 when it could not meet customer withdrawals; customer funds had been misused. It filed for bankruptcy, and its founder was later convicted of fraud and sentenced to 25 years in prison.2

The point is not fear. Plenty of exchanges operate for years without incident. The point is that an exchange balance carries a risk that self-held coins do not — and that risk stays invisible right up until the moment it isn't.

Some exchanges publish a proof of reserves to reassure customers. It is worth understanding its limits: a proof of reserves can show that an exchange controlled certain assets at a moment in time, but on its own it does not prove solvency — it does not reveal the exchange's liabilities or debts, and balances can be moved or borrowed around the snapshot.3 Treat it as one data point, not a guarantee. Regulation, likewise, does not guarantee safety.

Concrete ways to reduce your exposure

You do not have to choose between never using an exchange and keeping everything on one. A middle path works well for most people: treat an exchange as a doorway, not a vault.

  • Keep on an exchange only what you are actively trading, and move the rest to self-custody — a wallet where you control the recovery phrase.
  • Write that recovery phrase on paper or metal, store it offline, and never type it into a website or share it with anyone.
  • Send a small test amount first to confirm the address works before moving more.
  • For larger holdings, consider a hardware wallet that keeps the keys on a dedicated device.
  • Turn on two-factor authentication — but remember it protects your login, not against the exchange itself failing.
  • If you mine, independently verify whether an exchange accepts direct mining (coinbase) deposits before using its deposit address as a payout address — some exchanges do not, and funds can be delayed or lost.

One rule prevents most theft: no legitimate wallet, exchange, or pool will ever ask for your recovery phrase, and nothing legitimate guarantees returns. Anyone who does either is trying to rob you. With self-custody, by contrast, coins sit at an address you control and no company holds them on your behalf in the first place.

Self-custody is a responsibility, not a magic shield

Honesty cuts both ways. Self-custody removes counterparty risk, but it hands you the full job of a bank's security team. There is no password reset and no support line that can undo a mistake.

  • If you lose your recovery phrase, the coins are gone — permanently.
  • If someone else sees it, they can take everything.
  • Sending to a wrong or scam address cannot be reversed.

That is not a reason to avoid self-custody; it is a reason to learn it calmly, start small, and build good habits before moving meaningful amounts. Custody is really just a choice about who you trust — a company, or your own preparation. Understanding the trade-off is what lets you choose on purpose instead of by accident.

FAQ

If I leave my bitcoin on an exchange, is it safe?

It is convenient, but it is not truly yours to control. The exchange holds the private keys and records your balance as a promise in its database. As long as the company stays solvent and secure you can withdraw, but if it is hacked, mismanaged, or dishonest, your balance can be frozen or lost. A sensible habit is to keep on an exchange only what you are actively using.

What does 'not your keys, not your coins' mean?

Bitcoin is controlled by private keys. If you do not hold the keys yourself, you cannot move your coins without a third party's permission, which means they effectively hold the coins and you hold an IOU. The phrase is a reminder that only self-custody gives you direct, unconditional control over your bitcoin.

How do I move bitcoin from an exchange to self-custody?

Set up a wallet where you control the recovery phrase, and write that phrase down offline — never online. Copy your wallet's receive address, send a small test amount first, confirm it arrives, then move the rest. For larger amounts, a hardware wallet keeps the keys on a dedicated device separate from your everyday computer or phone.

Should I ever give my recovery phrase to support to fix a problem?

Never. No legitimate wallet, exchange, or pool will ever ask for your recovery phrase for any reason. Anyone who asks — in a chat, email, form, or phone call — is trying to steal your coins. The recovery phrase is only for restoring your own wallet, on a device you control, and no genuine service needs to see it.

Is self-custody always safer than using an exchange?

It removes counterparty risk, but it makes you fully responsible. There is no password reset: if you lose your recovery phrase or send to the wrong address, the coins are gone for good. For many people the safest approach is a mix — an exchange as a doorway for buying and selling, and self-custody for holding — while practising the habits with small amounts first.

Key takeaways

  • An exchange balance is a promise; whoever holds the keys holds the coins.
  • Custodial exchanges add counterparty risk — hacks, insolvency, freezes — even if you do nothing wrong.
  • Exchanges can and have failed (e.g., Mt. Gox 2014, FTX 2022); proof of reserves does not prove solvency.
  • Self-custody removes counterparty risk but adds full personal responsibility.
  • Confirm whether an exchange accepts direct mining coinbase deposits before using its address to mine.

Sources

  1. What to know about cryptocurrency and scams — US Federal Trade Commission
  2. Samuel Bankman-Fried Sentenced to 25 Years in Prison — US DOJ (SDNY)
  3. Investor Advisory: exercise caution with proof-of-reserve reports — US PCAOB
  4. Bulletin analyzing the rise in crypto-asset complaints — US CFPB

Related educational reading