Holding Bitcoin: an exchange account or your own wallet?

Who can move the assets?

An exchange app and a wallet app may look similar, but who controls the assets can differ. In a custodial account, the company manages the keys and lets you request a sale or withdrawal under its terms. With self-custody, the keys are under your control, and there may be no company able to restore access if you lose the recovery material.

This is a choice of responsibilities, rather than labels such as “easy” and “safe”. An account adds reliance on the company, its security and procedures. A personal wallet adds responsibility for keys, backups and signatures. You may use both; know which model applies in each place.

If the phone is lost

Suppose you lose the phone used to sign in to an exchange account. The company’s process may let you recover the account, but a password alone may be insufficient if authentication or email also depended on that phone. Establish in advance how email is recovered, where backup codes are kept, and which documents or waiting periods the service may require.

Now change the example: the phone holds a self-custody wallet. The correct recovery information may let you recreate the keys in a compatible wallet, depending on the system used. Losing the phone and the only copy of its keys and recovery material can instead mean permanent loss of access. Replacing a device or reinstalling an app does not recreate missing keys.

If the company stops operating

Recovering a login is different from recovering money after a company fails. If it is the custodian, you depend on its ability to honour withdrawals and on the contract and procedures that apply if it fails. A balance screenshot does not guarantee an asset is available to withdraw, and a licence does not guarantee compensation for every loss.

With self-custody, one app failing need not mean the asset is lost if you retain the keys and compatible recovery material. But do not assume any app can restore any wallet; check the system used to create the keys and any additional passphrase required. The difference between an exchange balance and keys explains why these situations differ.

For the exchange account and linked email

Secure the linked email first; it may be the password-reset route. Use a phishing-resistant passkey or security key where supported. If you use a password, make it unique and add another authentication factor. A password manager helps prevent reuse.

Authenticator-app codes improve on a password alone, but can still be stolen if entered into an imitation page. Do not approve a login you did not initiate. Store recovery codes according to the service’s instructions, review devices and sessions, and know how to revoke a lost phone’s access. The NIST reference distinguishes sign-in methods and phishing resistance.

For a self-custody wallet

In many wallets, a recovery phrase recreates the keys. It differs from the app password and an exchange account’s recovery codes. Someone who obtains it may move assets from another device. If you use an additional passphrase, understand that the recovery words alone may not restore the intended wallet.

Follow your wallet’s instructions to create a correct, readable backup and keep it offline somewhere protected against theft, loss and damage. Do not photograph the words, send them in a chat or keep them in an ordinary cloud file. Check the backup through the wallet’s supported official process, never through a practice website or a form asking to “verify the wallet”.

Before relying on self-custody, answer two questions: how will I access the backup if the device is lost, and who else can access it? Do not keep every recovery requirement with the device itself or copy secrets into an exposed file for convenience.

Before an on-chain transfer

Check the asset, network, address and amount before signing. Compare the entire address with a trusted source for the recipient, rather than only the first and last characters. If your wallet device displays details independently, compare them with the computer or phone display. Do not approve a request whose permissions you do not understand.

A small test after completing the checks can reveal a technical error, but does not establish the recipient’s trustworthiness or guarantee a later transfer. Tests can add charges; see network and withdrawal fees. If a recovery phrase is exposed or you see a transfer you did not authorise, use the compromise and scam response steps; changing an app password alone does not invalidate exposed keys.