Watch on YouTube · the figures on screen (JSON) · every claim and how it resolved
Owning crypto comes down to one question: who holds the keys? Hold them yourself, and nobody can freeze your coins, but nobody can give them back if you lose them. Let a company hold them, and you are trusting that company. Here is what each choice really means, the safety habits that apply to both, and how to judge who deserves your trust.
Start with what you actually own. Your coins never leave the blockchain. They sit there, on a public record, and what you hold is a key: a secret that lets you move them. Most wallets turn that key into a list of twelve or twenty-four ordinary words, called a seed phrase or recovery phrase. Whoever has those words has the coins. Not a copy of the coins. The coins. That is the whole meaning of the old saying, not your keys, not your coins. If someone else holds the key, what you hold is their promise.
So there are two basic ways to hold crypto. Self-custody: you hold the key, in a wallet you control. Nobody can freeze it, lend it out or lose it for you. And nobody can recover it for you either. Custodial: an exchange or another company holds the key, and your account shows a balance. That balance is a promise to pay, a bit like a bank deposit, but often without the same protections. There are in-between options too. A multi-signature wallet needs several keys to move money, so you can share control with family or a service, and no single key can empty it. In our episode on software with a wallet, the spending limits lived in the wallet itself. Same idea.
One Cardano detail matters here. Staking ADA from your own wallet does not hand over your key, and it does not lock anything. The ADA never leaves the wallet, and it can be spent at any moment. Staked ADA remains fully liquid. Measured from this channel's own copy of the chain, 1.3 million wallets were staking at the latest snapshot, with 21.54 billion ADA between them. Some of those wallets belong to exchanges, staking for their customers. The chain does not say which ones, and this channel does not guess.
Holding through a company works, until the promise breaks. Three dated examples, as reported at the time. In February 2014, the Mt. Gox exchange in Tokyo filed for bankruptcy and said that about 850,000 bitcoin were missing, most of them customers'. In June 2022, the crypto lender Celsius paused all customer withdrawals. It filed for bankruptcy the next month. In November 2022, the exchange FTX and over a hundred related companies filed for bankruptcy. The pattern is the same each time. Withdrawals stop first. Then customers find out they are creditors, waiting in line, rather than owners.
Self-custody has its own failure, and it is just as final. Lose the seed phrase and the device, and the coins are gone. There is no reset link and no help desk. And many losses do not come from broken code. They come from people being talked into handing over keys or sending money. The FBI's Internet Crime Complaint Center says Americans reported about 9.3 billion dollars in crypto-related losses in 2024. About 5.8 billion of that was investment scams. Those are only the losses that were reported, in one country. The safety habits that follow are mostly about people, not technology.
So, habits. First, the ones for your keys. Write the seed phrase down, on paper or metal, offline, and keep it somewhere safe. Some people keep two copies in two places. A hardware wallet, a small device that keeps the key offline and signs inside itself, is one way to keep the key off your computer. Use a different password for every account, kept in a password manager. For two-factor codes, use an app or a security key, not text messages. A criminal can talk a phone company into moving your number to their SIM card, and then your codes go to them.
Then the habits for sending. Check the whole address, not just the first and last few characters. Scammers make look-alike addresses that match at both ends. For a new address or a large amount, send a small test payment first, and check that it arrived. Bookmark the official sites you use, and open them from the bookmark, not from a search ad or a link. And keep your wallet software and your phone up to date.
Now the don'ts, and the first one matters most. Never give your seed phrase to anyone. No real support team, exchange or wallet maker will ever ask for it. Anyone who asks is the attack. Never keep it in a photo, a cloud note or an email. Don't click links in direct messages, and don't trust a support account that contacts you first. If someone offers to send back double whatever you send, or promises “guaranteed” returns, it is a scam, every time. And don't sign a transaction you do not understand. A signature can give away more than the screen seems to say.
It helps to know the common attacks by name. Phishing: a fake site or message that looks like the real one and asks you to type in your words or sign something. Address poisoning: a tiny payment from a look-alike address, planted in your history so you copy the wrong one next time. Fake airdrops: free tokens that lead to a site that drains your wallet when you try to claim them. SIM swaps: your phone number moved to a criminal's phone, so your text codes go to them. And impersonators: fake support staff, fake founders, fake friends. Every one of these attacks needs you to act. Slowing down is a defence.
If you do hold through a company, here is how to judge one. This channel recommends none, on purpose. These are signals to look for, not picks. Proof of reserves shows what a company holds. Ask for its debts too. Assets without liabilities prove very little, and a snapshot on one day can be dressed up for that day. In December 2022, the accounting firm Mazars paused its proof-of-reserves work for crypto companies. Is it licensed where you live? Are customer assets kept separate, or lent out? A company that lends your deposits cannot hand everyone's back at once. Is it audited, or only given an attestation that checks a few items on one date? What does its insurance actually cover? Often a hack, not the company failing. How did withdrawals behave when markets were under stress? And do the terms say what happens to your coins if it goes bankrupt?
So which is better? This channel won't say, because it depends on you. Self-custody gives you full control and full responsibility. Nobody can stop your withdrawal, and nobody can undo your mistake. A custodian gives you convenience and a help desk, and in exchange, you carry the risk that the company fails or freezes. Some people use both, for different amounts and different purposes. What matters is knowing which risk you are carrying.
A few honest limits. This is general safety education. It is not security advice for your situation, and it is not financial advice. Rules and protections differ by country, and they change. No product is named here, by design. And no setup is perfectly safe. Each habit lowers the odds. None of them makes them zero.
So here's what to take away. If a company holds your keys, ask: Who can move your coins without you? If you're locked out, how do you get back in, and who else could use that door? And if withdrawals stopped tomorrow, would you be an owner, or a creditor? If you hold them yourself, check: Do you know where your seed phrase is, and is it written down offline? Is your two-factor on an app or a security key, not text messages? Do you open your wallet or exchange from your own bookmark? Every way of holding crypto carries a risk. The question is which one you're carrying.
This was safety education, not advice for your situation, and no product, wallet or exchange was recommended. Slow down, check twice, and keep your words to yourself. Stay safe out there.