Exchange balances and self-custody

An account balance is a claim on the company

When you buy bitcoin on an exchange and leave it there, the screen shows a balance. The exchange's systems owe you that balance. The private keys that can move the underlying coins are held by the company, or by a custodian the company hired. You can ask to withdraw. You cannot sign the withdrawal yourself. Support can delay it, compliance can freeze the account, and a bankruptcy court can decide what the balance is worth in a proceeding. Until a withdrawal confirms on the chain, the coins have not moved into your control.

Self-custody means a wallet you control holds the keys. A hot wallet keeps them on a phone or a computer. A hardware wallet keeps them on a device that signs. The exchange cannot freeze those coins, and it also cannot reverse a send you regret, restore a phrase you lost, or stop a signature you approved. The two arrangements fail in opposite directions. Exchange custody fails when the company will not or cannot pay. Self-custody fails when the keys are lost or misused. This page is the comparison. It is not a ranking of the exchanges in the fee table, and it is not advice about how much of your money belongs in either place.

What the company can do while it holds the coins

Withdrawals are a feature of the account, not a property of the asset. The company can require a new login check, a waiting period, or extra documents. It can pause withdrawals for everyone during an outage. It can refuse a particular address. Those controls are why an exchange is a usable on-ramp, and they are the same controls that matter on a bad day. Two-factor authentication raises the cost of stealing the login. It does not move the keys into your pocket. The login page describes SMS, authenticator apps, and passkeys. Set that up before you leave a large balance where a password reset can reach it.

Trading fees are a different subject from custody. A low taker fee on an order book does not describe what you can withdraw, on which network, or what happens if the company fails. Read the fee guide when you are choosing how to trade. Read this page when you are deciding where the coins sleep. The profiles record published trading fees with the date they were read. They do not record a solvency opinion. This site does not audit exchanges and does not publish a reserve ratio for any of them.

A public failure of exchange custody

In November 2022, FTX halted customer withdrawals and filed for bankruptcy. People who had account balances could not send those balances out. They became creditors of a bankruptcy estate. That is the shape of this risk when it arrives all at once: the screen still shows a number, and the withdrawal button does not work. This guide does not quote a hole in the balance sheet, a recovery percentage, or a timeline for that estate. Those figures live in court papers and they move. The mechanism is the point. An IOU is not a key.

Other companies have frozen withdrawals, for hours or for good, under hacks, runs, and regulatory orders. Naming a partial list would imply this site had investigated each one. It has not. The habit that does not depend on the list is the same: keep on an exchange the amount you are willing to have stuck in an account, and withdraw the amount you are not. If you cannot describe what you would do during a weekend pause, the balance is larger than the account setup you have actually practiced.

What self-custody will not fix

There is no password reset for a recovery phrase. If the phrase is lost and you have no other copy, the coins are gone in the practical sense that nobody can sign for them. If the phrase is copied into a cloud note, a screenshot, or a form on a website, anyone who reads that copy can sign. Support at the wallet company cannot roll the transfer back. Miners and validators will not reverse a confirmed transaction because you changed your mind or because you were lied to.

A hot wallet is self-custody with the keys on an online device. Malware that can read the keys, or a signature you approve, moves the coins without ever touching an exchange. A hardware wallet narrows that to signatures you confirm on the device. It does not narrow it to signatures that were a good idea. The setup guide is the procedure. The drainer guide is what a bad signature looks like. Self-custody is not a moral upgrade. It is a change in who can lose the funds, and how.

Some assets can still be frozen by their issuer after you withdraw them. USDT and USDC are centrally issued. The issuer can blacklist an address. Withdrawing from an exchange into a wallet you control removes the exchange from the path. It does not remove the issuer. The token checker labels freeze and blacklist as context on the canonical contracts for those assets, because that authority is part of the product, and it still flags a random contract that merely uses the ticker. Withdrawing does not turn a stablecoin into a bearer instrument with no admin key.

A split you can actually operate

Pick the boundary in amounts you have already thought about, not in a ratio copied from a stranger. Money you are about to trade in the next few days can sit on the exchange you already verified and logged into with a non-SMS factor. Money you would not spend this month can sit in a wallet whose phrase you have written down and tested. Money you cannot replace belongs on a hardware device you set up yourself, bought from the maker, with the phrase stored offline. If you skip the test and only imagine the setup, you do not yet have the second or third tier. You have an intention.

The hot wallets in this set, including MetaMask, Phantom, Exodus, Trust Wallet, Coinbase Wallet, Rabby, Rainbow, and Solflare, are different apps for different chains. Coinbase Wallet is not the Coinbase exchange balance. The similar name is a common mix-up and a common phishing theme. Hardware devices in this set include Ledger, Trezor, Keystone, Tangem, COLDCARD, and BitBox. COLDCARD is Bitcoin-only. Tangem's default backup is extra cards rather than a written phrase. Read the profile before you treat them as interchangeable. Prices are not quoted on this page.

Move a small amount, then the rest

Withdraw a small test first. On the exchange, open the withdrawal page from a bookmark, choose the network, and paste an address you copied from the receive screen of the wallet. Compare the whole address, not the first and last four characters. Address poisoning exists so that a history row will match at the ends and differ in the middle. Networks matter as much as the address. An Ethereum-style address can be valid on Ethereum, Base, Arbitrum, and Polygon, and those are different ledgers. Sending on the wrong one strands the coins until you have a wallet that can sign on the network you actually used. If you do not know which network the exchange is about to use, stop and read the withdrawal screen. Do not guess from the ticker.

Wait until the test arrives and you can see it in the wallet you expected. Then send the rest, to the same address, on the same network, starting again from the receive screen rather than from memory. Exchange withdrawal fees and network fees change and are not invented here. The exchange shows the fee before you confirm. Read it. A large percentage fee on a tiny test is annoying and still cheaper than a wrong address on the full balance.

The other direction is the same discipline. When you deposit to an exchange, copy the deposit address from the exchange at that moment, send a test, and do not reuse an address a person in a chat sent you while claiming to be support. Support does not need you to deposit to a personal wallet so they can 'release' a withdrawal. That sentence is the scam version of a deposit.

Records you will wish you had

Write down which exchange holds which login email, where the backup codes are, and which wallet holds the long-term coins. Do not write the recovery phrase in the same note as the exchange password. Do not photograph the phrase. A future you who is tired will otherwise 'temporarily' put the phrase in the same manager as the email password, and then both problems collapse into one.

If you die or disappear, an exchange account may have a documented estate process and may also have a policy you never read. A self-custody wallet has no process at all unless you left instructions a person you trust can follow without posting the phrase to the internet. This site does not sell inheritance products and does not claim a legal template. The minimum is a letter in a place your executor already knows about, saying which companies and which devices exist, and a phrase stored where that letter does not contain the words themselves. Getting this wrong is quiet. Nobody writes to you about it.

Taxes and reporting do not vanish because you withdrew. A transfer from an exchange to your own wallet is often not a sale, and a later sale from the wallet still needs a record of what you bought and when. This page is not tax advice. Download the exchange's history while you still can log in. A bankruptcy or a frozen account is a bad moment to discover that the CSV lived only on their server.

Questions

Is leaving coins on a large exchange safer than a hot wallet? It is safer against a bad click on a random website, and it is weaker against a freeze, a hack of the company, or a bankruptcy. A hot wallet is safer against the company failing, and weaker against malware and a rushed signature. A hardware wallet is the version of self-custody that makes the signature physical. The amount is what chooses among them.

Does the token checker tell me an exchange is solvent? No. The checker reads a token contract from public sources. It does not see an exchange's liabilities, its bank accounts, or its cold wallets. A Low score on USDC is a statement about that contract's flags, not about the venue where you bought it.

If I withdraw USDT, can anyone still freeze it? The issuer can blacklist an address. Self-custody removes the exchange. It does not remove a freeze function that the contract actually has. Read the checker row for the contract you hold. A token with the same ticker at a different address is not the issuer's contract.

Can I keep a small trading balance on the exchange after I set up a hardware wallet? Yes. That is the ordinary split. The hardware wallet is for the amount you withdrew on purpose. The exchange balance is for the amount you are still willing to trade, with the login hardened and the withdrawal address allowlisted if the venue offers it. Review the exchange balance when it grows past the amount you decided, not when a headline reminds you.

What if the exchange asks me to move coins to a new address because of maintenance? Open the exchange from your bookmark and look for the same instruction there. A person in email, in chat, or on the phone is not the withdrawal page. Maintenance that requires you to deposit to a stranger's wallet is a theft script. The company can move its own cold wallets without your coins taking a detour through a chat window.