Exchange vs Self-Custody Risk: A Practical Decision Framework

By Chanuka Geekiyanage Oct 15, 2026

Choosing between an exchange and self-custody means choosing which failure you can best survive. An exchange can be hacked, freeze withdrawals, or go bankrupt, while a self-custody wallet can be drained by one bad signature or lost with one misplaced seed phrase. This article compares both risk profiles using real incidents, then gives you a way to decide how much to hold where.

Panaprium is independent and reader supported. If you buy something through our link, we may earn a commission. If you can, please support us on a monthly basis. It takes less than a minute to set up, and you will be making a big impact every single month. Thank you!

Two Different Ways to Lose Money

Exchange risk is concentrated. Your coins sit in pooled wallets run by a company, so you depend on its security, its honesty, and its solvency. You cannot reduce these risks yourself. You can only pick better operators and hold less with them.

Self-custody risk is personal. Nobody can freeze your funds, but nobody can reverse a mistake either. The threats are phishing, malware, fake support staff, lost backups, and in some cases physical coercion. For a deeper primer on how each model holds keys, see this crypto custody explainer.

The useful question is not “which is safer.” It is “which risks can I control, and which can I only avoid by holding less?”

What Real Incidents Show

Recent data shows both models fail, in different ways. Chainalysis reported more than $3.4 billion stolen in 2025, and the $1.5 billion Bybit hack alone made up around 44% of that total. Three hacks accounted for 69% of losses from January to early December.

Bybit: Even Cold Storage Failed

Bybit’s loss came from its Ethereum multisig cold wallet. Attackers altered what Bybit’s signers saw when approving a cold wallet transaction, so they unknowingly authorized a transaction that drained the wallet. Sygnia traced the start to a Safe{Wallet} developer’s workstation that was compromised through social engineering.

The lesson applies to self-custody users too. Multisig and hardware wallets protect keys, but they cannot protect you if the screen you read is lying. Verifying transaction details on the device itself matters more than the wallet brand.

Coinbase: Funds Safe, Customers Still Targeted

In 2025, Coinbase disclosed that criminals had paid overseas support staff for customer data. The company estimated remediation and voluntary reimbursement costs of about $180 million to $400 million. The data was then used to make social engineering scams more convincing, and Coinbase said attackers could not access customer funds directly.

This shows a quieter exchange risk. Even a well-run exchange can leak your identity, balances, and history. Attackers then call you posing as support, which is a self-custody-style failure caused by an exchange breach.

FTX: The Counterparty Failure

FTX is the clearest example of why “not your keys” matters. The FTX Recovery Trust started a fifth distribution on July 31, 2026, with some classes reaching 120% cumulative recovery. Those amounts are based on the dollar value of holdings at the time of the collapse in November 2022.

Customers eventually got dollars back, but they waited almost four years and lost any coin price gains in between. Recovery in dollars is not the same as keeping your assets.

Personal Wallets: Many Small Losses

Chainalysis estimated 158,000 personal wallet compromises affecting at least 80,000 unique victims in 2025, with $713 million stolen from individuals. The firm also flagged a rise in wrench attacks, where physical violence or coercion is used against holders. Self-custody loss is common but usually smaller per person, because individuals hold less than exchanges do.

Comparing Custody Options

Most readers think in two buckets, but there are four practical models. Each moves risk to a different place.

Option	Main risk	If something goes wrong	Best for
Exchange account (Coinbase, Kraken, Binance)	Hack, insolvency, insider leak, frozen withdrawals	Support and possible reimbursement, but no guarantee	Trading, small balances, fiat on- and off-ramps
Software wallet (MetaMask, Rabby)	Phishing, malicious approvals, malware	Usually no recovery	Daily DeFi use with limited funds
Hardware wallet (Ledger, Trezor)	Blind signing, lost seed phrase, fake devices or sites	No recovery without the seed	Long-term holdings
Multisig (Safe)	Compromised signers or signing interface	Depends on how many keys survive	Teams, DAOs, large holdings

Image source: www.ledger.com

Exchange Custody

Strengths: easy recovery of account access, fraud support, and simple fiat conversion. Weaknesses: you hold an IOU, withdrawal rights depend on solvency, and employee or contractor access can leak your data. It suits active traders and anyone who values recovery over control.

Hardware Wallets

Strengths: keys never touch your computer, and an attacker needs the device or seed. Weaknesses: you own a backup, and a hardware wallet does not stop you from approving a bad transaction. It suits long-term holders who are willing to store a seed backup properly.

Multisig With Safe

Strengths: no single key can move funds, which removes single points of failure. Weaknesses: more setup, higher fees, and, as Bybit proved, signers can still be tricked. It suits couples, small teams, and large holders who can spread keys across devices and people.

Decision Framework

Answer these in order. They shift your decision more than any brand comparison.

How much would hurt? Anything you cannot afford to lose should not sit on one exchange.
How often do you trade? Frequent traders need exchange liquidity. Holders do not.
Could you handle a phishing attempt? If you click first and think later, avoid large self-custody balances until you build habits.
Can you protect a backup? A seed phrase photographed in cloud storage is worse than an exchange account.
Who else needs access? Inheritance, partners, and teams push you toward multisig.

Situation	Recommended option	Why
New user, small balance	Reputable exchange with 2FA	Recovery options outweigh theft risk at this size
Long-term holder, meaningful balance	Hardware wallet, seed stored offline	Removes counterparty risk
Active DeFi user	Hot wallet with limited funds plus a hardware wallet for savings	Caps phishing losses
Very large holding or shared funds	Multisig with keys on separate devices	No single point of failure
Short-term trading capital	Exchange, with only what you need	Speed and liquidity

Check Before You Move Funds

Look for a public history of incidents and how the platform responded.
Confirm withdrawal and 2FA options, including hardware key support and withdrawal address whitelists.
Read the terms on whether your assets are held in your name or in the company’s pooled account.
Test with a small transfer before moving the full amount.
For wallets, check that the seed phrase is generated offline and verified against the device screen.

Common Mistakes

Treating an audit or a proof-of-reserves post as proof of solvency. These are snapshots and do not show liabilities.
Keeping a seed phrase in notes apps, email, or photos.
Signing transactions you cannot read, especially token approvals and “update” prompts.
Moving everything to self-custody before learning to spot phishing.
Assuming a hardware wallet makes a malicious website harmless.

When Each Choice Makes Sense

An exchange fits you when you trade often, hold small amounts, or need fiat access. Self-custody fits you when you hold long term, value control, and will keep backups safe. If you are still deciding between platform types, this comparison of CEX vs DEX safety for beginners is a good next read.

Exchanges are a poor fit for large, idle balances. Self-custody is a poor fit for anyone who cannot protect a backup or resist urgent messages.

My Take

Split your holdings by purpose. Keep only trading capital and a small spending balance on a reputable exchange, and move long-term holdings to a hardware wallet with an offline seed backup. For amounts that would change your life, use multisig with keys on separate devices and people.

The biggest mistake is picking one model for everything. FTX shows the cost of leaving too much with a counterparty, while the personal wallet data shows the cost of self-custody without discipline.

Before using any setup, I would check three things: whether I can read every transaction detail on the device, whether my backup survives a house fire and a thief, and whether losing one account or one person leaves me with access. If I could not answer yes to all three, I would hold less in self-custody until I could. Hardware wallet plus a small exchange balance is the best tradeoff for most people.

Conclusion

Exchanges carry concentrated risks you cannot control, such as hacks, insider leaks, and insolvency. Self-custody carries personal risks you can control, such as phishing, bad approvals, and weak backups. The right answer is usually a split based on how much you can afford to lose and how well you can protect a key.

Your next step is practical. Sort your holdings into trading, spending, and long-term buckets, then match each to the options in the table above. Start with a small test transfer before moving anything large.

FAQs

1. Is self-custody safer than leaving crypto on an exchange?

It removes counterparty risk but adds user error risk, so it is only safer if you can protect your seed and verify transactions. For many beginners with small balances, a reputable exchange with strong 2FA carries less practical risk.

2. How much crypto should I keep on an exchange?

Keep only what you actively trade or spend, and an amount you could lose without serious harm. Move long-term holdings off the exchange once you are comfortable with a hardware wallet.

3. Does multisig protect me from a Bybit-style attack?

Not by itself, because Bybit used multisig and still lost funds when its signers were shown a disguised transaction. You also need to verify transaction data on independent devices before signing.

4. What happens to my coins if an exchange goes bankrupt?

You become a creditor, and recovery depends on the bankruptcy process and the dollar value of your claim at filing. FTX customers waited years and were repaid based on 2022 prices.

5. Is a hardware wallet enough protection?

It protects your keys from malware on your computer but does not stop you from approving a malicious transaction. Check the recipient and amount on the device screen and keep the seed phrase offline.

References

The Block, Crypto hacks hit $3.4 billion in 2025, attacks on individual wallets rise: Chainalysis: https://www.theblock.co/post/382477.

Cointelegraph, Crypto 3.4 billion losses 2025 wallet hacks: https://cointelegraph.com/news/crypto-3-4-billion-losses-2025-wallet-hacks

Payment Expert, Chainalysis Crypto Crime Report 2026: https://paymentexpert.com/2025/12/19/chainalysis-crypto-crime-report-2026/

NCC Group (Fox-IT), In-Depth Technical Analysis of the Bybit Hack: https://www.nccgroup.com/research/in-depth-technical-analysis-of-the-bybit-hack/

Coinbase Global, Inc., Form 8-K (May 2025): https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm

Was this article helpful to you? Please tell us what you liked or didn't like in the comments below.

About the Author: Chanuka Geekiyanage

Chanuka is a content writer, editor and contributor at Panaprium, specializing in long-form editorial articles. He conducts in-depth research and produces well-structured, carefully edited content with a strong focus on clarity, SEO best practices, and consistent formatting. His work spans lifestyle, fashion, wellness, and technical topics, and all articles are reviewed and refined to meet Panaprium’s editorial standards.

What We're Up Against

Multinational corporations overproducing cheap products in the poorest countries.
Huge factories with sweatshop-like conditions underpaying workers.
Media conglomerates promoting unethical, unsustainable products.
Bad actors encouraging overconsumption through oblivious behavior.
- - - -
Thankfully, we've got our supporters, including you.
Panaprium is funded by readers like you who want to join us in our mission to make the world entirely sustainable.

If you can, please support us on a monthly basis. It takes less than a minute to set up, and you will be making a big impact every single month. Thank you.