“Not your keys, not your coins” is a slogan. Underneath it sits a harder fact that beginners keep learning the expensive way: a balance shown on an exchange is not a pile of crypto with your name on it. It is a promise from a company. Most of the time that promise holds. When it breaks, it tends to break completely, all at once, with the withdrawal button already disabled. Start with the mistakes, because the mistakes are where the money actually goes.
Mistake one: treating an exchange balance like a bank deposit
When you buy crypto on an exchange and leave it there, the exchange holds the private keys. You hold an account claim — closer to an IOU than to cash in a safe. That distinction stayed abstract until it didn’t. Mt. Gox, once the largest Bitcoin exchange in the world, collapsed in 2014 with about $450 million in customer crypto lost. QuadrigaCX, a Canadian exchange, fell apart after its founder died in 2018 reportedly holding the only passwords; about $190 million in customer funds became unreachable. FTX, a global giant praised on magazine covers, imploded in 2022 with roughly $8 billion in customer funds missing or misused. Add a long tail of smaller failures and hacks, and the pattern stops looking like bad luck. It looks like a structure.
Bank deposits carry protections that exchange balances do not. A failed bank’s insured deposits are covered by a public backstop, and customers expect their money back quickly. A failed crypto exchange sends customers into bankruptcy court as creditors, waiting years for a partial return in whatever assets remain. Some recovered funds eventually; many took deep losses. The lesson is not that every exchange is a fraud. The lesson is that “keep it on the app” is a decision with a known worst case, and the worst case is total.
Mistake two: chasing high “earn” yields with money you cannot lose
The second mistake wore a friendlier face. Platforms offered 10, 15, even 20 percent annual yields on deposited crypto, paid in dashboards that ticked up daily. Those yields were not magic and not savings interest. The deposits were being lent out, traded, or pledged in chains of risk the depositor could not see. Celsius and Voyager built huge deposit bases on exactly those promises, then froze withdrawals in 2022 and entered bankruptcy, trapping ordinary savers alongside sophisticated traders.
A simple screen protects you here. If a yield is far above what boring, well-understood markets pay, someone is taking risk with the money, and the marketing page will not name it plainly. Earning a little extra on a long-term holding sounds harmless. In practice it converts a custody choice into an unsecured loan to a company whose books you cannot read. For most holders, that trade was never worth making at any quoted rate.
Mistake three: skipping the boring hardening
The third mistake needs no collapse at all. Accounts get drained quietly, one at a time, through reused passwords, email-based resets, SIM-swap attacks on phone numbers, and phishing pages that copy an exchange login screen pixel for pixel. A holder can choose a sound exchange, do everything else right, and still lose the account in an evening because the password also appeared in some old data breach, or because two-factor codes arrived by text message to a number an attacker had just ported.
Skipping setup steps feels like saving ten minutes. What it actually does is leave every later defense resting on the weakest login you own — usually your email. Attackers know that, which is why account-takeover losses keep happening in quiet weeks when no headline exchange is failing at all.
What you actually hold on an exchange
An exchange account bundles three different things: the crypto claim, access to trading, and a cash balance if you keep dollars there too. Understand the claim and the rest falls into place. The exchange pools customer assets in wallets it controls. Your screen shows your slice of the pool. As long as the company is solvent, honest, and operational, the slice is honored. The consumer risks around that arrangement are laid out in the CFPB’s consumer guidance on crypto asset risks, which is worth reading before any large amount sits anywhere.
Not all venues carry equal risk. At the safer end sit large, regulated exchanges operating in the United States, publishing audits or proof-of-reserves work, keeping most customer assets in cold storage, and surviving full market cycles. In the middle are smaller or offshore platforms with thinner disclosure. At the risky end are brand-new venues, unregulated derivatives shops offering extreme leverage, and any platform whose main attraction is a yield or a bonus. Size does not guarantee safety — FTX was huge — but opacity should always lower the amount you are willing to leave exposed.
The tiered approach that answers the question
So, is it safe to keep crypto on an exchange long term? For a small working balance, with strong account security, on a reputable venue — reasonably, yes. For a life-changing sum, for years, untouched — that is the exact use case exchanges are worst at. The practical answer most experienced holders settle on is tiered custody.
Tier one is self-custody for long-term holdings. Anything you plan to hold for months or years belongs on a hardware wallet — devices typically costing about $70 to $150 — where the private keys live on the device and never touch the internet. That is the holding you do not trade, do not lend, and do not think about weekly. Choosing a first device and setting it up carefully matters more than chasing features; a plain, well-supported wallet beats a fancy one used carelessly. Options and setup basics are compared in the safest crypto wallet for beginners in Houston.
Tier two is the hot balance: roughly 10 to 20 percent of your total, or simply the amount you are actively trading or expect to sell soon, kept on the exchange for convenience. If the venue froze tomorrow, the loss would hurt without wrecking you. That percentage is not a law. It is a gut check with numbers attached. The right share is the one whose total loss you could absorb and still sleep.
Hardening whatever must stay on an exchange
For the balance that stays, do the boring steps, all of them. Use a unique password generated and stored by a password manager. Turn on two-factor authentication with an authenticator app or a hardware security key — not text messages, which SIM-swap attacks defeat. Set withdrawal address allow-listing if the exchange offers it, so funds can only leave to addresses you approved in advance. Turn on anti-phishing codes for official emails. Keep the email account itself locked down the same way, since email resets bypass almost everything else. Review active sessions and API keys every few months, and delete any you do not recognize or no longer use. None of this is exciting. All of it is the difference between being a target of opportunity and not.
Warning signs that mean withdraw today
Exchanges rarely fail without smoke first. Withdrawals slowing down, pausing for “maintenance” again and again, or quietly shrinking in maximum size. Support going dark. Executives leaving. Sudden, generous bonuses begging for new deposits — a platform short of cash needs fresh money most. Wild rumors alone are not proof, but rumors plus any operational delay deserve action, not debate. Moving funds off takes minutes when systems work. The tragedy in past collapses is how many holders saw the smoke, meant to move that weekend, and met a disabled button instead. When in doubt, withdraw first and evaluate from safety.
What self-custody honestly involves
Self-custody trades company risk for personal responsibility, and honesty requires naming the cost. A hardware wallet generates a recovery phrase — usually 12 or 24 words — that can rebuild your wallet anywhere. Whoever holds those words holds the money. There is no help desk, no password reset, no fraud department to call. Lose the phrase and lose the device, and the funds are gone. Photograph it or store it in a cloud note and you have handed the keys to anyone who breaches that account.
The working routine is simple but unforgiving: write the phrase on paper or stamp it in metal, store copies in separate secure places, never type it into a website, test a small transfer first, and send a trial amount back before moving a large sum. Practice the recovery once with a tiny balance so the process is familiar before it is urgent. Done with that care, self-custody is the strongest storage most individuals can get. Done casually, it fails faster than any exchange.
One practical habit ties the tiers together: rehearse the exit before you need it. Move a small amount off the exchange to your hardware wallet, confirm it arrives, then move a small amount back or onward so every step is familiar. Keep a plain written record of where each holding lives — which exchange, which wallet, roughly how much — stored securely offline. If something happened to you, could a trusted family member even find the accounts, let alone the recovery phrase? A sealed note with instructions, kept where your other vital documents live, answers that without exposing the words themselves to anyone day to day.
The plain answer
Keep on an exchange only what you are actively using and could afford to see frozen. Harden that account like it holds real money, because it does. Move the long-term majority into your own keys, in tiers, with the recovery phrase treated like the asset itself. The holders who came through 2014, 2018, and 2022 intact were rarely the cleverest traders in the room. They were the ones who had already moved their keys before the headline arrived.
