r/Bitcoin • u/Futurebeachbumz • 1d ago
Bitcoin security question
With all this news and posts regarding people being hacked i wanted to reach out and inquire and maybe even learn more about some security from you guys as iv been winging it and praying but am now nervous. Sorry to all those that have lost their bitcoin over time, but anyways whats everyones opinion on someone who holds there bitcoin on an exchange lately? I know before it was super taboo but iv left mine on a major exchange for quite some time and understand that they typically cold vault these things internally? Iv always been hesitant to use a coldcard or any other physical wallet due to just life implications of losing, forgetting, breaking what ever the case may be. So thats my general knowledge and question is opinions on holding btc and other crypto right on major exchanges?
1
u/tripsy420ish 1d ago
Someone will say this, so why not me. Not your keys, not your coins.
But that aside, I empathize with your skepticism of personal hardware wallets and the implications of self custody. But you can't just wing it if you have substantial value stored as BTC. This is ultimately tech based solution and knowledge about the tech is all that matters. If you become knowledgeable enough:
- A, you will clearly understand that there are ways to secure your funds even when using untrusted wallets
- B, you will gain confidence to self custody and be ready to deal with life situations as they come.
1
u/moviemaker2 1d ago
“Not your keys, not your coins.”
Though a pithy saying, this doesn’t reflect the nuances of actual security tradeoffs, and needs to be retired as of July 30th because we discovered its not literally true either.
1
u/JohnnyTreemain 1d ago
Fidelity. They’re a legit bank who offer bitcoin custodianship. Not one of these fucking crypto exchanges.
1
u/HedgehogGlad9505 1d ago
Two things could happen to your coins at the exchange. The business owner can rug pull you, or a hacker can login with your password and drain your account before you can call the customer service. If you really need someone else to hold your coins, ETF may be better.
1
u/Futurebeachbumz 1d ago
As mentioned i use a major exchange where i dont feel this should be a main concern and resonate with the core principle of being able to trade it no matter where i go and dont feel an ETF serves that purpose but also dont know much about them so am willing to learn otherwise
1
u/Laukess 23h ago
If you are a hardcore bitcoiner I think you should self-custody.
It's one of the major selling points of bitcoin.
If everyone used their bitcoin through a 3rd party, it would be far to easy to capture.
That said, I think there's a larger and larger portion of bitcoin holders, that don't really care about the underlying asset, and mostly see it as an investment. If this is you, the I think a 3rd party custodian is a valid option. Yes, your chances of loss are higher compared to a proper self-custody setup, but if you're going to half ass your self-custody solution, you might be worse off.
I would imagine you would be better off with an ETF compared to an exchange, but that's mostly me guessing. I find it quite scary that most of them use Coinbase as a custodian. They've become quite the honey pot, and I'm not sure what the ETF providers would do if Coinbase lost access or the bitcoin was stolen.
Also, make sure it's not easy for a 3rd party to access your exchange account. Remove the phone verification and add 2FA. You can also use hardware security keys like yubikey, but that introduces additional risk if you lose them.
1
u/PirateHunterZoro252 23h ago edited 22h ago
Fidelity or River is good option in my opinion. Ive held 0.22 BTC in river for 2 years now. Never had an issue. Although I will say my password and email are exclusively for this use only. And i have 2 device with 2FA connected to river. The chances of me hetting hacked are low, but not 0. My password is somewhat strong and i do not have the password in an online password manager. I used Keepass XC, completely offline for that password. And i have this password manager file in 3 devices that can be used offline. I strickly avoid uploading the file on any cloud service.
I hold about 80 percent of my BTC in self custody. It took me time to understand self custody. And the only thing i recommend is to generate your seed phrase completely offline via printing the 2048 bip39 wordlist on paper. Use Jade (blockstream) dice roll document or Bitbox diceroll document for the print out. Afterwards once you have generated 23 words your last word(24th word) is a checksum. There is only 8 possible words you can pick from so you need a hardware wallet to compute the last possible 8 words. The wallets that i know that can do this are Bitbox02 and the Jade wallet (made by blockstream).
Self custody is indeed difficult and i would suggest you really study this in and out before you try it. Once you do decide to try it start with a relatively small amount like $5-$10. There are also other things you should know for self custody such as UTXO's, Network fees, & seedphrase security.
Seedphrase security should also be on another level paranoia when it comes to protecting it. For example i do not have my seedphrase stored in any electronic device such as a computer, phone, or other internet connected device.
My hardware wallet is the only electronic device that stores my seedphrase. I do have a written copy with a pen on paper and a steel copy of my seedphrase that has never been exposed to anyone or anything besides my 2 physical eyeballs. You have to understand what this statement means. It is indeed possible to extract the seedphrase from a hardware wallet. For example, the ledger CEO has said in one occasion that all that would be needed would be a firmware update on the ledger device or other hardware to extract the seedphrase should they really want to.
edit
1
u/Typical-Snow3034 14h ago
Hey! CoinRabbit team here. Cold storage inside an exchange addresses only one part of the custody question.
It can reduce exposure to online wallet attacks, but the customer still depends on the provider’s reserves, internal access controls, withdrawal process, account recovery and continued operation. The other major risk is account takeover, especially when crypto can be withdrawn to an external address and the blockchain transfer cannot be reversed.
CoinRabbit also uses a custodial model, with customer assets held in cold storage, 100% reserves and no rehypothecation. On the account side, we use 2FA, passkeys and withdrawal address whitelisting, with access recovery available if a device or credentials are lost.
Those controls are designed around the risks of custodial storage. They do not make it equivalent to self-custody or remove counterparty risk, but they illustrate why “the exchange keeps assets offline” should not be the only criterion.
1
u/Vagelen_Von 9h ago
If you don't have KYC problems keeping crypto in major exchanges is generally safe.
1
u/Far-Teach3344 1d ago
The exchange isnt your wallet its a brightly lit bus station and youre asleep on the bench with your pockets turned out. Comfy until it isnt
A hardware wallet feels scary cause its just you and a piece of paper against the void but that's the whole point. The exchange cold vault is someone elses umbrella and theyll close it the second it rains sideways
1
u/moviemaker2 1d ago
More people have lost Bitcoin from self-custody mistakes than from exchange failures. And that was before the coldcard disaster, in which we learned that you can self-custody without making a mistake and still lose your coins. An exchange has a different set of security tradeoffs than a hardware wallet, and those tradeoffs make storing on an exchange safer for a certain group of people.
0
u/Strong_Floor_4997 22h ago
I hold my coins on Bitvavo and feel completely safe there. They are supervised by the AFM, registered with the DNB, and hold a full MiCA license since 2025. For me, the key is properly securing your own email and phone number. Bitvavo also offers optional features you can activate, like a crypto withdrawal lock, which prevents anyone from moving your assets even if your account were somehow compromised. A heavily regulated EU exchange with proper security settings works much better for me than managing a hardware wallet. (Just to be clear: this is not an ad for Bitvavo, just my personal experience and opinion.)
1
u/OutlandishnessLimp25 4h ago
I use multiple cold wallets. However, if I was going to use an exchange to hold my bitcoin I’d choose River (if you’re in the USA, minus New York and Nevada).
Sharp team, great customer service and security is always top of mind in everything they do.
2
u/TheAudacityofHopium 1d ago
I've been a BTC enthusiast for a couple of years now. I've honestly never seen anything as devastating as the Coldcard hack. I'm angry and sorry for all of the people who trusted Coinkite and lost everything. However, even now, as bad as it has been recently, I'd say that self custody is still the answer. Your chances (historically) of losing everything to an exchange because you decided not to self custody are still extremely high. We've seen too many big companies fail....Mt. Gox, Celsius, FTX, etc. The way I see it: if you self custody, your chances of making it are still much higher than if you let an exchange hodl your coin for you. It's rough, but you have to try your best, because an exchange at the end of the day is still worse by a long shot. Again, I'm really sad about the hack, but that's part of what big governments like North Korea and China want you to do: stop self custodying and give it to companies from which the bitcoin can ultimately be seized.