In 2025, blockchain analytics firm Chainalysis counted roughly 158,000 personal wallet compromises affecting at least 80,000 people. Not exchanges. Not giant DeFi protocols. Regular people with regular wallets.
Here’s the part that should get your attention: the total dollar value taken from individuals actually fell that year, to $713 million, down from $1.5 billion the year before. More victims, smaller hauls each. Attackers stopped fishing for whales and started trawling.
So the thing standing between you and that statistic isn’t how much you own. It’s where you keep it and who holds the keys. Learning how to store crypto safely turns out to be less about buying an expensive gadget and more about understanding one idea, then building a boring routine around it.
Let’s start with the idea, because almost everything else follows from it.
You don’t store crypto. You store keys.
Your coins never leave the blockchain. They don’t sit in your phone, they don’t live inside a little plastic device, and they aren’t tucked into a folder somewhere. They’re entries on a public ledger, and they stay there.
What you actually hold is a private key: a long secret number that proves you’re allowed to move those entries. A wallet isn’t a container. It’s a keyring.
That’s the whole game. Whoever controls the key controls the coins, permanently and without appeal. There’s no password reset, no fraud department, no chargeback, no manager to escalate to. If someone else gets your key, the coins are theirs the moment they use it.
Every honest answer to the storage question comes back to that one thing: who is holding the keys, you or somebody else?
The three places your crypto can live
There are really only three options, and each one trades convenience against control.
An exchange account (custodial). You buy on an app, the coins show up in your balance, and the company holds the keys. You have an IOU, not a key. It’s the easiest option and the one with the most counterparty risk.
A hot wallet (self custody, online). A phone or browser wallet where you hold the keys, but the device holding them touches the internet constantly. Fast and flexible, and exposed to malware, phishing, and bad approvals.
A cold wallet (self custody, offline). A hardware device or another setup where the keys never touch an internet connected machine. Slower to use, far harder to drain remotely.
| Where it lives | Who holds the keys | Main risk | Best for |
|---|---|---|---|
| Exchange account | The company | The company fails, freezes, or gets hacked | Buying, selling, small active balances |
| Hot wallet | You | Malware, phishing, signing a bad approval | Spending money and everyday app use |
| Cold wallet | You | You losing the recovery phrase | Anything you’d be upset to lose |
Notice the last column of risks. Two of them are somebody else’s failure. One of them is yours. That trade is the entire decision, and it’s why the honest answer to how to store crypto safely is usually “use more than one.”
Why an exchange is not a bank
This is the part people skip, so it’s worth being blunt about it.
Your crypto balance on an exchange is not insured the way a bank deposit is. The FDIC does not cover cryptocurrency, and neither does SIPC. The FDIC has gone as far as sending letters to crypto companies telling them to take down marketing that implied otherwise. Some exchanges do hold your cash balance at insured banks, which is real but covers only the dollars sitting there, not the coins.
What happens when a custodian fails isn’t theoretical. FTX filed for Chapter 11 in November 2022 with roughly an $8 billion gap between what customers were owed and what was actually there. In the Celsius bankruptcy, a US court ruled that assets deposited into Earn accounts belonged to the bankruptcy estate rather than to the customers, because the terms of use had customers grant Celsius title to those assets. People who thought they were depositors found out they were unsecured creditors, near the back of a very long line.
Size doesn’t save you either. In February 2025, attackers took $1.5 billion from Bybit in a single incident, the largest crypto theft on record, at a company with a professional security team and institutional resources.
None of this means exchanges are useless. They’re the normal way to buy, and keeping a modest working balance there is a reasonable choice most people make. It means an exchange is a storefront, not a vault, and treating it like a savings account is where the trouble starts.
How to store crypto safely, step by step
Here’s a sequence that works whether you’re holding $200 or a serious position. Nothing here requires being technical.
- Split your holdings into spending money and savings. Be honest about the number. Spending money is what you’d shrug at losing. Everything else is savings, and savings shouldn’t sit anywhere you don’t hold the keys.
- Move savings into cold storage. A hardware wallet is the standard tool. Buy it new, directly from the maker, never secondhand and never from a marketplace listing. A tampered device is a real attack, not paranoia.
- Set it up yourself, offline. Generate the recovery phrase on the device. If a wallet arrives with a phrase already printed on a card, it’s a scam. Throw it away.
- Keep a small hot wallet for anything active. App use, small transfers, experiments. Assume that wallet could be drained tomorrow and size it accordingly.
- Harden the accounts you keep. Use an authenticator app rather than SMS, since phone numbers get hijacked. Use a unique password from a password manager. Lock down the email address tied to the account, because that email is the master key to everything else.
- Test your recovery before you trust it. Send a small amount, wipe the device, restore from your written phrase, confirm the funds reappear. A backup you’ve never tested is a guess.
- Write down where things are for someone else. Not the phrase itself. Just enough that a spouse or executor could find what exists and get help. A shocking amount of crypto is lost simply because nobody else knew it was there.
That’s it. The whole system is a decision about what goes offline, plus one honest test.
Your recovery phrase is the whole ballgame
When you set up a self custody wallet, it hands you 12 or 24 words. That phrase is your crypto. Anyone who reads it can take everything, from anywhere, without touching your device.
Write it on paper, or stamp it into metal if the amount justifies it. Keep it offline and somewhere it won’t burn or flood. Many people keep a second copy in a separate location, which protects against fire and loss but doubles the number of places a thief could find it. That trade is yours to make.
What never to do: no photos, no screenshots, no cloud notes, no password manager entry, no email to yourself, no typing it into any website or support chat. Nobody legitimate will ever ask you for those words. Not support, not a wallet maker, not a giveaway, not a “validator” fixing your account. The request itself is the fraud. We go deeper on this in our guide to what a seed phrase is and how to protect it.
The mistakes that actually wipe people out
Almost nobody loses crypto to some brilliant cryptographic attack. They lose it to a handful of ordinary mistakes.
- Photographing the recovery phrase. It syncs to the cloud within seconds, and now your coins are only as safe as your cloud account.
- Signing approvals without reading them. Connecting a wallet to a sketchy site and approving a transaction can hand over spending permission for a token indefinitely.
- Trusting whoever messages first. Real support never DMs you. A stranger who appears right when you’re frustrated is not luck.
- Pasting an address without checking it. Clipboard malware swaps the address at the moment you paste. Check the first and last few characters every time.
- Keeping everything in one place. One exchange, one device, one copy of one phrase. Every single point of failure is a coin flip you didn’t know you were making.
Read that list again and notice how boring it is. Good security in this space is mostly the refusal to be rushed.
What a realistic setup looks like
Say Dana owns about $6,000 of crypto and doesn’t want a hobby, just to not get robbed.
She keeps roughly $300 on the exchange app she buys through, because moving small amounts around is genuinely easier there. She has a phone wallet with maybe $200 in it for the one app she actually uses. The remaining $5,500 sits on a hardware wallet she bought new from the manufacturer, with the recovery phrase written on paper in a fireproof box at home and a second copy at her sister’s place.
Once, she wiped the device and restored it from the paper, just to prove the paper worked. It took twenty minutes. She hasn’t thought hard about it since.
Dana isn’t running anything clever. She decided what was worth protecting, put that part offline, and checked her own backup once. That’s the bar, and most people never reach it.
Key takeaways
- You never store coins, only keys. Whoever holds the key holds the crypto, with no reversals and no support line.
- Exchange balances aren’t covered by FDIC or SIPC insurance, and bankruptcy courts have ruled deposited assets belonged to the company, not the customer.
- Use an exchange to buy and a hot wallet to spend. Put anything you’d be upset to lose into cold storage.
- Buy hardware wallets new, from the maker, and generate the recovery phrase yourself on the device.
- Keep the phrase offline on paper or metal, never in a photo or the cloud, and test the restore once so you know it works.
- Most losses come from boring mistakes: cloud backups, blind approvals, fake support, unchecked addresses.
Frequently asked questions
What’s the safest way to store crypto?
A self custody cold wallet, set up by you, with the recovery phrase kept offline and tested. That combination removes both the company failing and the internet reaching your keys. It also puts the entire burden of the backup on you, which is the honest trade.
Is it safe to leave crypto on an exchange?
It’s convenient, and for small working balances plenty of people accept the risk. But you’re trusting a company to stay solvent, stay honest, and not get breached, with no deposit insurance behind any of it. The bigger the balance, the worse that trade looks.
Do I need a hardware wallet if I only own a little?
Not necessarily. If losing the whole amount would annoy you rather than hurt you, a well secured hot wallet or exchange account may be a reasonable choice. The question isn’t the dollar figure, it’s how you’d feel if it vanished tonight.
What happens if my hardware wallet breaks or gets lost?
Nothing, as long as you have the recovery phrase. The device is replaceable. You buy a new one, restore from your words, and your funds are there. The device was never holding the coins, only the keys, and the phrase regenerates the keys.
Should I split my recovery phrase into pieces?
Some people do, keeping different words in different places. It protects against one location being found, but it multiplies the ways you can lock yourself out permanently, and partial phrases have been brute forced before. Most people are better served by one complete phrase, stored well.
Can stolen crypto be recovered?
Usually not. Transactions are final by design, and there’s no institution that can reverse one. Funds are occasionally frozen or clawed back when they hit a compliant exchange, but that depends on speed, luck, and law enforcement. Prevention is essentially the only real protection.
Before you go
Working out how to store crypto safely isn’t the exciting part of owning it. It’s also the only part that decides whether you still own any of it in five years. Pick what goes offline, protect the phrase, test the restore once, and then go do something else.
More beginner walkthroughs live in our Security section, and if you’re still choosing a device, our roundup of the best hardware wallets compares the honest options. New to all of this? Start with the best crypto apps for beginners.
This article is general information, not financial, investment, or tax advice. Crypto is volatile and self custody puts full responsibility for your keys on you. Only risk what you can afford to lose. Figures cited were verified on the publish date against Chainalysis, FDIC, and court reporting; re verify current details before acting on them.
