Where to keep your crypto and how to back up your wallet

Keep crypto on an exchange only while you trade it actively. Keep small amounts on a phone or computer for everyday use, and put savings in an offline wallet. Back the wallet up to offline storage, test the backup, and never give anyone your private key or seed phrase. That is the shared advice of three security guides. The first is Security.org's crypto safety guide, last updated on August 24, 2026. The second is bitcoin.org's wallet security pages. The third is Own Your Online, the New Zealand government's cyber security guide.

Sort each holding by how you use it

The three guides do not compete with each other. Each one covers a different kind of money.

• Coins you trade actively. Security.org: "Only keep your cryptocurrency on an exchange if you're trading it actively. Otherwise, transfer it to an external wallet."
• Everyday money. Bitcoin.org says "it is a good practice to keep only small amounts of bitcoins on your computer or mobile device for everyday use."
• Savings. Bitcoin.org: "An offline wallet, also known as cold storage, provides the highest level of security for savings."
• The middle ground. Bitcoin.org says "Hardware wallets are the best balance between very high security and ease of use." Its wallet chooser calls them "one of the most secure methods to store funds" and "ideal for storing large amounts of bitcoin." It also warns they are "difficult to use while mobile."

None of the guides gives a dollar figure for "small amounts" or defines "active" trading. You decide where each line falls.

Holding your own keys

Bitcoin.org's advice is: "Whenever practical, prefer holding your own keys." It explains what that buys you. With a wallet that gives you full control, "no third party can freeze or take away your funds." The trade-off follows straight after: "You are still responsible, however, for securing and backing up your wallet."

Back up the wallet, offline

Own Your Online says wallets used to store cryptocurrency "must be backed up to offline storage," and adds: "Test your backup so you know you can restore it."

Bitcoin.org explains why the backup matters and how to keep it:

• "Your bitcoins can be lost forever if you don't have a backup plan."
• On hardware wallets: "Loss of device without proper backup can make funds unrecoverable."
• "Any backup that is stored online is highly vulnerable to theft."
• "Single points of failure are bad for security." In practice, that means keeping the backup in more than one safe place.
• Some wallets need to be backed up again from time to time: "you may need to back it up regularly."
• For a password, "you might want to keep a paper copy of your password in a safe place like a vault."

Where the guides differ

Own Your Online suggests a password manager as "an easy way to store your passwords and private keys." In the same guide it says wallets must be backed up to offline storage. It does not say whether a password manager counts as offline storage. Bitcoin.org says any backup stored online is "highly vulnerable to theft." If your password manager syncs to the cloud, treat it as online.

Never share the key or seed phrase

Own Your Online says sharing your private key "with anyone will give them access to all of your cryptocurrency." Bitcoin.org's scam guide adds a rule you can check any request against: "No legitimate support representative will ever ask for your seed phrase or private key."

Bitcoin.org also describes scammers who pose as wallet or exchange staff. They often reply after someone posts a public question, then ask for credentials or remote access to the device. It also flags these:

• Recovery offers that charge a fee upfront, especially from people who contact you after an earlier loss.
• Fake accounts that copy a real person's name and profile to push giveaways. The guide says never join giveaways.
• Unexpected requests for bitcoin. The guide says to "verify any unexpected request for bitcoin through a second, independent channel before acting."

Lock down logins and software

• Two-factor authentication (2FA). Security.org says not to use text messages for 2FA "if at all possible," because attackers can intercept the codes through SIM swapping. It says an authenticator app "like Google Authenticator or Authy" is "a much more secure option."
• Passwords. Bitcoin.org: "A strong password combines length and unpredictability." It says a long passphrase made of randomly chosen words is much harder to break than a short password.
• Encryption. Bitcoin.org says encrypting your wallet or smartphone sets a password against anyone who tries to withdraw funds. It also warns that encryption "cannot protect against keylogging hardware or software."
• Updates. Bitcoin.org: "Using the latest version of your Bitcoin software allows you to receive important stability and security fixes."
• Multi-signature. For larger holdings, bitcoin.org describes wallets that "require multiple independent approvals" before a transaction can be spent.

Why it matters: the latest loss figures

Security.org notes that crypto "is not insured by the FDIC" (the Federal Deposit Insurance Corporation, which insures US bank deposits). Recent figures show the size of the losses:

• Fraud reported to the FBI, 2025. The FBI's Internet Crime Complaint Center (IC3) published its 2025 annual report in April 2026. The Block reported on it on April 12, 2026. According to that coverage, IC3 received 181,565 crypto-related complaints in 2025, with reported losses of $11.366 billion. Crypto investment fraud accounted for $7.2 billion of that across 61,559 complaints. People aged 60 and over reported $4.4 billion in crypto losses. Total reported internet crime losses were $20.9 billion.
• Theft, 2025. In a report dated December 18, 2025, blockchain analytics firm Chainalysis counted "over $3.4 billion in theft from January through early December 2025." One February breach at a centralised exchange accounted for $1.5 billion of that. Chainalysis counted 158,000 thefts from individuals' personal wallets in 2025, with at least 80,000 unique victims. The value stolen from individuals fell from $1.5 billion in 2024 to $713 million in 2025.
• Earlier figure. Security.org says crypto hacks and exploits drained about $2.2 billion in 2024, "a 21 percent increase over 2023."

These figures measure different things: complaints reported to the FBI, thefts traced on-chain, and hacks and exploits. Do not add them together or rank them against each other.

What self-custody changes

Taking coins off an exchange does not remove risk. It moves the risk to you. The Chainalysis data shows both sides. The largest single loss of 2025 hit a centralised exchange. Thefts from personal wallets kept growing in number, even though the total value fell. Once you hold the keys, two failures are yours alone: losing the device without a backup, and handing the key to a fake support agent. A tested offline backup and a firm rule never to share the key are the two safeguards that depend only on you.

If you trade often

The rule from Security.org still leaves the coins you trade actively on an exchange. A separate explainer covers how crypto day trading works, what it costs and three checks to run first. A simple routine is to list each holding and sort it by how you use it. Check the list again whenever you buy, move or stop trading a coin.

Limitations: the 2025 FBI figures come from The Block's report on the IC3 release, because the FBI's own pages could not be retrieved; none of the guides sets amount thresholds.