How to Store Crypto Safely: Wallets, Custody and Backups for Beginners

To store cryptocurrency safely, you decide who holds the keys: a company or you. Then you set up that place and test it with a small amount. If you choose your own wallet, a lost recovery phrase cannot be reset, so the backup comes before any crypto moves.

Where your crypto actually is

If the basics are new to you, what cryptocurrency is comes first. The record of who owns your crypto sits on the blockchain, so a wallet does not actually hold any assets (opens in a new tab), as FINRA puts it. What a wallet does is validate your ownership and give you the means to receive, store, use or transfer your crypto.

The key to that access is the private key: a long, secret code that is your personal way to reach your crypto from your wallet. If you lose it or someone steals it, you might lose access. Crypto hacks and thefts usually happen when a bad actor gets illegitimate access to a private key.

Wallets back up that key as a recovery phrase, a list of words. Some makers call it a seed phrase, a secret recovery phrase or a wallet backup.

Custodial vs non-custodial wallets

A custodial wallet is one where a company holds your private keys. Crypto.com says (opens in a new tab) its App acts as a custodian: you instruct it to handle your crypto, but you do not control the keys. Its separate Onchain wallet is user-custodied, meaning you are the custodian.

A non-custodial wallet (also called self-custody) is one where you hold the keys. The Crypto.com App, a brokerage, is one example of a custodial wallet; the wallets in the checklist below are non-custodial.

If you lose a recovery phrase, nobody can reset it. MetaMask says (opens in a new tab) that if your device breaks, is lost, stolen or corrupted, its support team cannot recover the phrase for you. More generally, the US FTC warns (opens in a new tab) that if something happens to your wallet or funds, no one is likely to be able to step in to help you recover them.

As of October 2026, whether crypto at a failed platform is protected depends on where you live:

• US: FDIC insurance does not protect against the failure (opens in a new tab) of a crypto custodian, exchange or wallet provider. SIPC does not protect any crypto asset (opens in a new tab) that does not qualify as a security.
• UK: the FCA says (opens in a new tab) you are highly unlikely to be covered by the Financial Services Compensation Scheme (FSCS), and should not expect compensation for crypto-related losses.
• EU: ESMA says (opens in a new tab) MiCA, the EU crypto law, gives clients of crypto providers no investor compensation scheme, so if a provider cannot return your crypto there is no safety net. MiCA does require a licensed provider that holds your crypto to keep it separate from its own (opens in a new tab), so the provider's creditors have no claim on it, in particular in insolvency.
• Canada: CIPF says (opens in a new tab) crypto assets held for you by a member firm are not covered. Cash in a crypto trading account with a member can be.
• Australia: ASIC says (opens in a new tab) you are protected only to the extent the crypto and the service fall under the financial services laws it administers, and that help is harder to get if you invest in something unlicensed or unregulated.

Elsewhere, check your own country's financial regulator before you deposit.

As a US example, in January 2023 a US bankruptcy court ruled (opens in a new tab) on who owned the crypto in Celsius's Earn accounts. According to a summary by the law firm Sidley Austin (opens in a new tab), it found that the crypto belonged to Celsius, leaving those customers as unsecured creditors. Sidley adds that those assets were not segregated or held in custody but used freely by Celsius, under terms saying they belonged to Celsius.

The ruling covered Earn accounts only; Sidley says Celsius could not invest assets in its separate Custody accounts. The lesson applies in any country: a platform's written terms about lending, separation and ownership can matter when a company fails.

Hot wallet vs cold wallet

A hot wallet is connected to the web by software on your phone or computer. A cold wallet is paper or hardware, such as a USB device, that generally is not connected to the internet (opens in a new tab). Hot wallets, like any service connected to the internet, are vulnerable to hackers and malicious code. Cold wallets tend to be better for long-term storage and harder to hack.

One cold option is a hardware wallet: an electronic device that stores the private key (opens in a new tab) to your wallet. It does not remove every risk. Hardware wallets can break down, suffer defects, or get lost or stolen, and the recovery phrase is still the backup. For the device itself, see how to set up a hardware wallet.

Trezor points out (opens in a new tab) that if someone gains access to your backup, they can reach your wallet without your device. If your device is lost or damaged, your funds can still be recovered with the backup.

How to choose where to keep your crypto

There is no single right answer, so ask yourself four questions:

• How often will you send or sell? Cold storage tends to suit long-term holding. To turn crypto into money, read how to cash out crypto to your bank.
• Will you really keep a paper backup in a safe place? If not, a custodial account may suit you better, because there is no phrase for you to lose.
• Does the wallet or platform support your coin and its network? Check its list of supported assets before you send anything.
• Can you afford a mistake? A custodial company can fail, and a self-custody mistake cannot be undone.

If you keep crypto on an exchange

If you leave crypto on an exchange, the company holds the keys for you. Start with the login. Use a unique, complex password, turn on two-factor authentication (2FA, a second check besides your password) and never turn it off, as the FBI advises (opens in a new tab). Our exchange security guide shows how to set up 2FA and withdrawal protections step by step.

A code does not help on a fake page: the FBI warns that MFA (multi-factor authentication, a login that needs more than your password) will not protect you if you land on a fraudulent login page. That warning covers financial accounts in general. Open your platform from a bookmark, and avoid search results and advertisements.

Where the platform offers one, choose a security key. CISA describes (opens in a new tab) security keys as small external devices that connect through a port, a biometric or Bluetooth. Phishing scams do not work against them, since only the key owner has physical access. Look in your security settings; if no key is offered, pick the strongest option listed.

Before you deposit, check the platform's registration, and see how to choose a crypto exchange. A registration is not a safety guarantee.

As of October 2026, one example is New York's financial regulator (opens in a new tab), which expects the crypto custodians it licenses to keep customer crypto separate from company assets, not to use it to secure the custodian's own debts or lend to others, and to disclose how they may use it. That guidance applies only to New York licensees, but the questions fit any platform. Find the user agreement and look for:

• Who owns the crypto, and what rights do I keep in it?
• Is it kept separate from the company's own assets?
• May the company lend, pledge or otherwise use it, and with what limits?

If the agreement does not answer one of them, ask support before you deposit. When you later move crypto out, read how to send crypto from an exchange to your wallet.

Your checklist for storing crypto in your own wallet

If you choose your own wallet, work through these points in order. Each one links to the guide that holds the steps.

1. Get the wallet from its maker. Buy a hardware wallet from the maker or an authorized reseller, and install the app only from the maker's own site. Ledger says (opens in a new tab) that if a package appears opened or altered, you should not use the device and should contact Ledger Support immediately. Steps: how to set up a hardware wallet, or how to set up a Bitcoin wallet for an app.
2. Write the recovery phrase on paper before any crypto arrives. Keep the paper offline in a safe place only you can reach, and never make a photo, screenshot or cloud note of it. Routine: how to write down and protect a seed phrase.
3. Pass the backup check, if your wallet has one, and do not receive crypto until it passes.
4. Send a small test first, then the rest. Match the network, add any memo or tag, and check the whole address, because crypto payments typically are not reversible (opens in a new tab). Steps: how to send crypto from an exchange to your wallet.
5. Expect costs. As of October 2026, cold wallets cost (opens in a new tab) whatever you pay for the hardware, and each send pays a network fee. Read crypto exchange fees explained for what an exchange charges to send crypto out.

Risks to understand

• Fake wallet messages and sites. Read common crypto scams to learn the warning signs before you set up a wallet, and see crypto address poisoning.
• Theft of the device. Trezor says (opens in a new tab) it is highly unlikely that someone could use a lost or stolen Trezor without your PIN, and that the physical security of your backup is even more important than that of the device. Keep the two apart.
• Losing both device and backup. Then nobody can reset the wallet for you.
• Dying without a plan. On an exchange the platform decides what it asks of a family member, and in your own wallet whoever finds the phrase controls everything in it. Read what happens to your crypto when you die so someone can find your accounts.

Next step: before you buy, read how to buy crypto and decide where the coins will go.