To store crypto safely, first decide who holds the private keys: you (self-custody) or a third-party custodian. If you hold them, keep long-term funds in a cold wallet such as a hardware wallet. Keep only a small spending balance in a hot wallet. Write the seed phrase down offline, and never share it or type it into a website. If a custodian holds the keys, research how it is regulated, how it stores assets and whether it lends them out. In both cases, use strong passwords and multi-factor authentication, and check every address before you send. Crypto payments are generally not reversible, so most losses cannot be undone.
The sections below cover each choice and the habits that prevent the most common losses.
What a crypto wallet actually stores
A crypto wallet does not hold coins. The U.S. Securities and Exchange Commission's Office of Investor Education and Assistance published an Investor Bulletin on Dec. 12, 2025. It explains that wallets store the "private keys" or passcodes for your crypto assets. The assets themselves are recorded on the blockchain.
Two keys matter:
- Private key. It authorizes transactions, like a password. The SEC bulletin says a private key cannot be changed or replaced once it is created. If you lose it, you permanently lose access to the assets in that wallet.
- Public key. It lets others send assets to you and verifies transactions, like an email address. It cannot authorize spending.
Many wallets also generate a seed phrase, also called a recovery phrase or mnemonic phrase. It is a random sequence of words that can restore the wallet if the device or private key is lost or damaged. Whoever has the seed phrase controls the funds. Trezor's security guide (Jan. 8, 2025) puts it plainly: sharing your wallet backup is the same as handing your crypto to someone else.
So storing crypto safely really means protecting your private keys and your seed phrase.
Your storage options
Third-party custody (custodial)
With third-party custody, a professional custodian or service provider holds the private keys for you. The SEC bulletin gives crypto exchanges and dedicated crypto custody providers as examples. You log in to an account instead of managing keys yourself.
The trade-off is that you depend on the custodian. The SEC bulletin warns that if a custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets. Before you use one, the bulletin suggests asking these questions:
- How is the custodian regulated, and are there complaints about it?
- Where and how does it store assets and private keys, and who has access? Does it use hot wallets, cold wallets or both, and does it subcontract storage?
- Does it offer insurance against loss or theft, and on what terms?
- Does it lend out deposited assets ("rehypothecation") or commingle customer assets instead of holding them individually? Does it need your consent to do so?
- What fees does it charge, including fees to move assets out?
Self-custody
With self-custody, you hold the private keys. The SEC bulletin describes this as sole control and sole responsibility. If your wallets are lost, stolen, damaged or hacked, you may permanently lose access. No support desk can reset a lost seed phrase, and Trezor states that it does not store your wallet backup.
Self-custody suits people who are comfortable setting up and maintaining a wallet and keeping backups safe for years.
Hot wallets and cold wallets
Both custody models can use hot or cold wallets. The SEC bulletin defines them this way:
- Hot wallet: connected to the internet, as a desktop, mobile or web app. It is convenient for frequent transactions but exposed to cyberthreats.
- Cold wallet: typically a physical device that is not connected to the internet. It is less convenient and generally more secure from cyberthreats, but the device can be lost, damaged or stolen.
Hardware wallets
A hardware wallet is a cold-storage device that keeps private keys offline and signs transactions on the device. You pay to buy one, while many hot wallets are free to start. Transaction fees apply either way (SEC bulletin).
Many holders split their funds. Most long-term holdings go on a hardware wallet, and a small balance stays in a hot wallet for spending. How much goes where depends on how often you move funds.
Where should your crypto keys live?
Answer a few questions to see which storage steps from this guide apply to you.
Who will hold the private keys to your crypto?
- A custodian holds them for me → next question
- I will hold them myself → next question
Have you checked how the custodian is regulated, how and where it stores assets and keys, and whether it lends out or commingles deposits?
- Yes, I have answers to those questions → Custodial account: lock it down
- No, not yet → Ask before you deposit
Is most of this crypto long-term holding rather than money you spend often?
- Mostly long-term holding → next question
- Mostly money I spend often → Keep only a small balance in a hot wallet
Did your hardware wallet arrive with a recovery phrase or PIN already set, or in a package that looks opened or tampered with?
- Yes, one of those → Do not use that device
- No, it arrived sealed and unset → Hardware wallet for long-term funds
Use a strong unique password and multi-factor authentication, preferably a security key or authenticator app. Keep in mind that if a custodian is hacked, shuts down or goes bankrupt, you may lose access, and check the full address before every withdrawal.
Find out how the custodian is regulated and whether there are complaints, where it stores assets and keys and who has access, whether it insures against loss or theft, whether it lends out or commingles deposits, and what it charges to move assets out.
A hot wallet is convenient for frequent transactions but exposed to cyberthreats. Keep the spending balance small, write the seed phrase down offline, never photograph it or type it into a website, and send a small test amount before a large transfer.
A legitimate device never arrives with a recovery phrase or PIN already set. Stop and contact the maker's support, and buy only from the maker or an authorised reseller.
Create the seed phrase yourself and store it offline, ideally on metal, with copies in separate secure places. Enter the 24 words only on the device itself, verify every amount and full address on the device screen, and reject any transaction you did not start.
This tree only sorts the guide's published guidance by situation: it does not review any wallet or custodian, set how much to keep hot or cold, or replace your own checks.
How to store crypto safely: practical steps
1. Buy a hardware wallet only from the maker or an authorised reseller
Ledger's buying guide (updated Sept. 18, 2026) recommends buying from Ledger or its authorised resellers. It says a legitimate device never arrives with a recovery phrase or PIN already set. If yours does, do not use it. If the package looks opened or tampered with, stop and contact the maker's support.
2. Create the seed phrase yourself and keep it offline
Trezor's backup guidance (Jan. 8, 2025) says:
- Store the backup offline. Keeping it on a computer, phone or cloud service is "highly risky." Do not keep digital copies of any kind, including photos, screenshots and notes apps.
- Consider keeping several copies in separate secure locations.
- Trezor strongly recommends a metal backup, which resists fire, water and corrosion better than paper.
3. Enter the seed phrase only on the device itself
Ledger and Trezor both say they will never ask for your recovery phrase. Ledger's phishing page says there is no good reason to type your recovery phrase into a computer. The 24 words should go only directly into the device. Trezor says you should never enter the backup anywhere unless your Trezor device prompts you to. Any app, website, email, letter or "support agent" that asks for it is a scam.
4. Lock down every online account
The SEC bulletin recommends strong passwords and multi-factor authentication (MFA) on all online crypto accounts. CISA, the U.S. cybersecurity agency, says any MFA is better than none. It also says FIDO/WebAuthn security keys are the only widely available phishing-resistant option. An authenticator app or security key means you don't rely on text messages, which can be hijacked through SIM swapping.
5. Verify every transaction on the device screen
Ledger advises you to reject on the device any transaction you did not start. Read the amount and the full destination address on the hardware wallet's screen, not just on your computer.
6. Check the full address, and test large transfers
Never copy a recipient address from your transaction history. Compare the whole address, not just the first and last characters. Save trusted addresses in a contact list, and send a small test amount before a large transfer. Address poisoning, covered further down, is the reason for these habits.
7. Keep holdings private
The SEC bulletin advises you not to tell anyone how much crypto you hold or which types. If people know about your holdings, you become a target for phishing and physical threats.
Common ways people lose crypto
Phishing and fake support
Ledger's phishing page lists fake emails, text messages, phone calls, social media DMs, physical letters with QR codes and fake wallet apps. All of them aim to get users to type their 24 words. Ledger says it never contacts users by phone or text, never sends DMs and cannot block or deactivate a device. Download wallet apps only from the maker's official website.
Address poisoning
Etherscan's Information Center (Jan. 15, 2024) describes how the attack works. Attackers send zero-value token transfers from a lookalike address that matches the first and last characters of an address you use. The fake entry appears in your history, often within a minute of a real transfer. If you copy the "latest" address from your history, the funds go to the attacker. To defend against it, check the full address, use saved contacts and hide zero-value transfers.
Investment scams and payment demands
The U.S. Federal Trade Commission's consumer guidance (May 2022) says only scammers demand payment in crypto or guarantee big returns. It warns that scammers pose as well-known companies and government agencies. It also notes that crypto payments typically can't be reversed and don't carry the legal protections of credit cards. Fraud causes the largest reported losses. The FBI's 2025 Internet Crime Report (released April 2026) counted 181,565 complaints involving cryptocurrency and $11.366 billion in reported losses, up 22% from 2024.
Personal wallet compromises
Chainalysis reported on Dec. 18, 2025 that more than $3.4 billion in crypto was stolen from January to early December 2025. It counted 158,000 personal wallet compromises affecting at least 80,000 unique victims, with $713 million stolen from individuals. The figures don't break down which wallet types were involved, so they can't show whether cold storage would have prevented these thefts.
Lost keys, lost devices, no backup
Losing the private key or seed phrase means you permanently lose access (SEC bulletin). A hardware wallet can be lost, damaged or stolen. The seed phrase backup is what lets you restore the wallet on a new device.
Custodian failure
If a custodian is hacked, shuts down or goes bankrupt, customers may lose access to their assets (SEC bulletin). Before you deposit, ask how it stores assets and whether it lends them out.
Quick checklist
- Decide between self-custody, a custodian, or both.
- Long-term funds: a hardware wallet bought from the maker or an authorised reseller.
- Spending money: a small hot-wallet balance.
- Seed phrase: written offline, ideally on metal, with copies in separate secure places. Never photograph it or type it into anything except the device.
- Accounts: strong unique passwords and MFA, preferably with a security key or authenticator app.
- Every send: verify the full address on the device and test large transfers.
- Remember that nobody legitimate will ask for your seed phrase.
