Crypto trading · Beginner

Custody Risk: Exchanges Vs Cold Storage

Whoever holds the keys holds the asset. Everything else is a database entry saying somebody owes you one.

Last reviewed 15 September 2026 by the MarketPro research desk · Editorial policy

In short

Custody risk is the risk attached to who controls your coins. Funds on an exchange are a claim against that business, exposed to hacks, withdrawal halts and insolvency. A hot wallet gives you the keys and exposes you to malware and phishing. Cold storage removes most remote attack surface and replaces it with physical loss and backup failure.

What to remember

An exchange balance makes you an unsecured creditor. A withdrawal halt freezes the funds and your open positions at the same moment.
Hold only working capital on a venue, meaning margin for open positions plus what you will deploy in the next week or two. Sweep the rest on a schedule.
Self-custody losses are almost always human: a photographed seed phrase, a cloned wallet site, or a backup nobody can find.
Test every new wallet by recovering it from the backup with a small amount, before anything meaningful goes near it.

Lesson 20 of 20 in Crypto trading

PreviousTokenomics: Supply And Inflation Schedules NextEnd of the category

If you do not hold the keys, you hold a claim

Crypto adds a risk that traditional markets handle for you: custody, meaning who actually controls the asset. A balance shown in an exchange account is not a coin in your possession. It is a database entry recording that the venue owes you one, and whether you can collect depends on the venue being solvent, honest and operational when you ask. In any other market you would call that counterparty risk, and the trading glossary uses exactly that term.

That sounds abstract until it is not. Exchanges have been hacked, have suspended withdrawals during stress, and have failed with customer assets on the balance sheet. The distinction between owning a coin and holding a claim on one is the difference between being a holder and being a creditor, and it only becomes visible on the day it matters.

The 2,000 USD balance that was a promise, not a coin

Work through what the exposure actually is. You keep 2,000 USD on an exchange for active trading and 8,000 USD in a hardware wallet. The venue halts withdrawals on a Tuesday morning.

The 8,000 USD is unaffected. Those coins are controlled by keys you hold, and no third party can freeze, lend or lose them.
The 2,000 USD is now a claim in a process, which may return most of it, some of it, or none, over a period measured in years rather than weeks.
Your open positions are frozen too, at whatever level they were, with no ability to close or hedge.

Had the split been reversed, 8,000 USD on the venue and 2,000 USD in custody, the same event costs you 80% of the account instead of 20%. Nothing about your trading changed. The only variable was how much of the balance was sitting somewhere you did not control, which is a decision you make once a week and most people never make deliberately at all.

Three custody models, three different things that fail

Exchange custody. The venue holds the keys. Convenient for active trading, instant to move between pairs, and it makes you an unsecured creditor of a business whose finances you cannot inspect.
Hot wallet. Software on a device connected to the internet, with keys you control. You remove the counterparty and take on malware, phishing and malicious contract approvals instead.
Cold storage. Keys generated and held offline, usually on a hardware device. It removes almost all remote attack surface and replaces it with physical and human risk: loss, damage, theft, and a backup nobody can find.

Notice that none of these is safe in the abstract. Each converts one category of risk into another, and the right answer depends on what you are actually doing with the funds. Trading capital belongs somewhere liquid. Long-term holdings do not.

9 more sections in MarketPro

The failure mode is usually human

Self-custody losses are rarely sophisticated attacks. They are a seed phrase photographed and stored in a cloud account that was later compromised. A phrase typed into a convincing clone of a wallet website. A transaction approval signed on a malicious contract that granted unlimited spending permission. A single copy of a backup lost in a house move.

Three rules cover most of it. The seed phrase never exists in digital form, which means never photographed, never typed into a computer, never stored in a password manager. It exists on paper or metal, in at least two separate physical locations. And every new wallet gets tested with a small amount first, sent and then recovered from the backup, before anything meaningful goes near it. The test is the step people skip, and it is the one that proves the backup works while the stakes are still trivial.

Deciding how much stays on the exchange

The workable rule is to hold only working capital on a venue. Working capital means the margin behind your open positions plus what you intend to deploy in the next week or two. Everything beyond that is sitting in someone else's business for no return and no reason.

Set the figure as a number, not a feeling. A fixed cash amount or a fixed percentage of the account, written down.
Sweep on a schedule. Once a week, move the excess out. A routine survives a busy fortnight; an intention does not.
Split across venues if the amount is meaningful, in the same way you would not keep everything at one small bank.
Turn on every control the venue offers. Hardware-key two-factor authentication rather than SMS, a withdrawal allowlist, and withdrawal confirmations by email.
Treat yield on idle balances as payment for risk. Someone is doing something with that money, and the rate is what they are paying you to accept it.

A custody routine worth ten minutes a month

Once a month, check three things. That your backup is where you think it is and still legible. That the withdrawal allowlist on your exchange still contains only addresses you control. And that the token approvals granted by your hot wallet are still ones you need, revoking anything from a protocol you no longer use, since an old unlimited approval is a standing permission to move your funds.

There is no custody option without a trade-off, and pretending otherwise is how people end up with everything in one place. What you are choosing between is convenience, control and security, and the sensible position is usually a split: a small trading balance on a reputable venue, the bulk in cold storage, and a clear rule for how funds move between the two. That is the same principle the risk management guide applies to position size, applied to the thing that holds the positions.

Finish this lesson in MarketPro

The rest of Custody Risk: Exchanges Vs Cold Storage, a quiz that checks it landed, and your place kept in the curriculum.

9 more sections of this lesson
All 320 lessons, with no cap and no paywall
Free on any account, including a free one

In your browserContinue on webor continue on web

Same account as the app · No install · Free to start

Or scan with your phone camera to get the MarketPro app.

Download on theApp Store Get it onGoogle Play

Free account, no card needed.

Not investment advice. Past performance is not indicative of future results.

Run the numbers while this is fresh

Work it through on your own position size. Nothing leaves your browser and there is no sign-up: Position size calculator, Leverage calculator.

Written and reviewed by the MarketPro research desk

MarketPro is a trading-signal and trading-education app operated by Harajuku Holdings LTD (Cyprus). Our signal desk publishes and tracks every trade idea in-app, and every page here is checked against the app's live behaviour before publishing. Last reviewed 15 September 2026. How we produce signals and content · About MarketPro

FAQ

Custody Risk: Exchanges Vs Cold Storage: questions

Is it safe to keep crypto on an exchange?

It is acceptable for the amount you are actively trading and poor practice for everything else. Holding a balance on a venue means relying on that business staying secure, solvent and operational, and several large exchanges have failed on at least one of those counts. Keep working capital there, move the rest to custody you control, and enable hardware-key two-factor authentication and a withdrawal allowlist.

What is cold storage in crypto?

Cold storage means holding the private keys to your coins offline, typically on a dedicated hardware device that never exposes the keys to an internet-connected computer. It removes almost all remote attack surface, so hacks and phishing cannot reach the funds. In exchange it introduces physical risks: the device can be lost, damaged or stolen, and the recovery phrase has to survive for years.

What happens if you lose your seed phrase?

The funds are permanently inaccessible. There is no support desk, no password reset and no recovery process, because the phrase is the only thing that proves control of the wallet. That is why the phrase should exist on paper or metal in at least two separate physical locations, never in digital form, and why every new wallet should be test-recovered with a small balance first.

Trade · Learn · Earn

The whole academy is free in MarketPro

All 320 lessons, 12 guided paths, quizzes and a daily streak. Free on every account, in the app or your browser, with vetted free signals alongside it.

In your browserContinue on webor continue on web Download on theApp Store Get it onGoogle Play

Same account as the app · No install · Free to start

Not investment advice. Past performance is not indicative of future results.