Where does your crypto actually sit? Exchange, app wallet or hardware wallet

1. Keys, not coins

Your coins are not stored in your wallet. They are entries on a blockchain: a public record shared by thousands of computers. What a wallet holds is a key, the secret that lets you move those coins. Whoever holds the key controls the coins. That is where the saying "not your keys, not your coins" comes from. The useful question is never which app you like best, but who holds the key.

2. On an exchange

Leaving crypto on the exchange where you bought it is the easiest option. Forgot your password? There is a reset button. Want to sell? Two clicks. The catch: the exchange holds the key, not you. The balance in the app is the exchange's promise to give your crypto back.

Most of the time that promise holds. But exchanges can be hacked, can freeze accounts, and some have gone bankrupt. Mt. Gox stopped withdrawals in February 2014 and filed for bankruptcy protection the same month; FTX followed in November 2022.

3. In an app wallet

A wallet app on your phone or in your browser, often called a hot wallet because it is connected to the internet, puts the key in your hands. No exchange can freeze your account. Your device is online, though, which changes the risks: fake copies of real wallet apps, websites that ask you to "approve" something that lets them empty your wallet, and malware on a computer. Hot wallets are handy for small amounts and for using crypto apps. With one, you are your own security team.

4. On a hardware wallet

A hardware wallet is a small device, often the size of a USB stick, sometimes called cold storage. The key is created inside the device and never leaves it, even when your computer is infected. Every transaction has to be confirmed on the device's own screen, with your own hands. That makes it the hardest of the three to break into from a distance. It is not magic: if you confirm a bad transaction, the device will sign it. Read what the screen says, buy only from the maker's official shop, never second-hand, and if a device arrives with recovery words already written on a card, don't use it. A genuine one lets you create them yourself.

5. Your seed phrase

When you set up your own wallet, app or hardware, you usually get 12 or 24 words: the seed phrase. Those words are your wallet. Lose the device, and the words bring everything back. Anyone else who gets the words can take everything, from anywhere in the world. Write them on paper or stamp them in metal. No photos, no cloud, no emails to yourself. Keep the backup safe from fire and water, and never type the words into a website. A real wallet company will never ask for them.

6. No reset button

Holding your own keys makes you your own bank, and your bank has no customer service. Lose the seed phrase and the crypto is gone. Send it to the wrong address and it is gone too: nobody can reverse a blockchain transaction.

One more thing people forget: would your family know your crypto exists if something happened to you? Make sure someone you trust knows that it is there and where to find instructions, without handing over the words today.

7. Combining them

There is no single right answer. It depends on how much is at stake, how often you buy or sell, and how comfortable you are doing everything yourself. A common setup is a small amount on a licensed exchange for buying and selling, and whatever people plan to keep for years in a wallet where they hold the key. That is a description of what many people do once they understand the trade-offs, not a recommendation.

8. Moving crypto to your own wallet

Three habits save a lot of pain. Send a small test amount first, check that it arrives, then send the rest. Check the whole address, not just the first and last few characters: scammers create look-alike addresses for exactly that reason. And pick the same network on both sides, because the right coin on the wrong network can disappear. Keep records as well. In most countries moving coins between your own wallets is not a sale, but the tax office may still ask where they came from.