Self-custody vs exchange custody: the real tradeoff most guides skip
Both options have real risks. The wrong question is which is safer. The right question is which failure modes you are equipped to handle.
12/05/2026 · 12 min de leitura · Custody · Security · Self-custody
Two failure modes, not one
When people debate self-custody versus exchange custody, they usually frame it as "is your money safer with you or with them." That is the wrong frame. Both options have real failure modes; the question is which set you can survive.
Exchange failure modes: counterparty insolvency (FTX, Celsius, BlockFi), regulatory seizure, hack of the exchange wallet, exit scam, prolonged withdrawal freeze. The user loses funds because the exchange loses funds or refuses to send them.
Self-custody failure modes: lost seed phrase, dead-and-no-heir scenario, phishing-induced signing, malware on the signing computer, fire/flood destroying backup, theft of the hardware device with the PIN exposed. The user loses funds because they made a mistake or were targeted.
Which failure mode is more common
Self-custody mistakes happen to more people, but in smaller dollar amounts on average. The classic case is losing $500 worth of BTC because you wiped the laptop and forgot you had a wallet on it.
Exchange failures happen less often, but when they hit, they hit hard. FTX customers lost an aggregate $8B; Celsius customers got back 30 cents on the dollar after a multi-year bankruptcy. The number of victims per event is enormous.
On an expected-value basis, exchange risk and self-custody risk are roughly comparable for sophisticated users. For users who do not back up properly, self-custody is more dangerous. For users who use 5 exchanges with $50k each, exchange risk dominates.
What actually mitigates each risk
Exchange risk mitigation: use exchanges with segregated custody (OFFCODE uses AWS KMS for hot wallet keys), don't store balances larger than your trading needs, withdraw to self-custody periodically, prefer exchanges that publish proof of reserves.
Self-custody risk mitigation: hardware wallet (Ledger, Trezor, Coldcard, Keystone), seed phrase split into 2-3 pieces stored in 2-3 locations, metal backup (steel plate) instead of paper, test your recovery on a small amount before scaling up, never type seed into any device that touched the internet.
Both: 2FA on email, password manager for unique passwords, separate device for signing if possible, sober head when DMs from "support" appear.
The 90-10 default for most people
For non-professional users, our standard advice is 90% in self-custody, 10% on the exchange you trade with. The 10% covers the working capital you actively buy/sell/convert. The 90% sits in cold storage where you can't accidentally rage-trade it.
If you're not actively trading, the split moves toward 95-5 or even 100-0 (everything off the exchange except during a trade cycle). For active traders, the split inverts: 30% on exchange might be reasonable if you trade daily.
The mistake is leaving 100% on one exchange because it's convenient. The 2022 cohort that did that with FTX is a permanent example.
When exchanges are actually appropriate
Active trading. If you're moving in and out of positions weekly or daily, paying network fees to deposit and withdraw constantly erodes alpha. Keep the working capital on-platform.
Yield products you understand. Staking ETH or stablecoin yield can pay 3-10% APR. If you understand the smart contract risk and the issuer risk, this is reasonable. If you don't, you're learning a lesson on someone's borrowed time.
Small balances. If you have $200 in BTC, self-custody overhead is not worth the time. Hold it on a reputable exchange, learn the trading workflow, graduate to self-custody when the balance gets material.
When self-custody is mandatory
Balances above 1 BTC (or equivalent). At that point, exchange counterparty risk starts to be the dominant uncertainty in your portfolio. Self-custody removes one big variable.
Long-term holdings. If you're not going to touch the position for 5+ years, the convenience of having it on an exchange is worth nothing. The convenience of not worrying about an exchange failure is worth a lot.
Jurisdictional risk. If you operate in a country where exchanges have been frozen or capital controls are a concern, self-custody is your only durable option.
The hard part of self-custody
Inheritance. If you die without a recoverable seed phrase, your BTC is gone forever. Solving this is the hardest unsolved problem in personal crypto. Multi-sig (Casa, Unchained), Shamir backup, lawyer-mediated escrow are all partial answers; none is perfect.
Operational security. Reading a 24-word phrase from your phone screen in a coffee shop is a security incident. The bar for self-custody discipline is high, and you only need to mess up once.
Tax record-keeping. Every wallet movement you do is potentially a taxable event in some jurisdictions. Keep clean records: dated CSVs, transaction hashes, USD value at time of transfer. The IRS does not accept "I forgot."
What OFFCODE custody looks like
Our hot wallets are signed by AWS KMS keys that are not on any of our servers; signing requires a per-request KMS API call. There is no master seed sitting in environment variables somewhere. Each hot wallet has a defined min/max balance and is monitored for drift.
Withdrawal flow requires email OTP for amounts above a threshold, 2FA step-up for sensitive operations, and admin manual approval for large or new addresses. This is not a substitute for cold storage of long-term funds, but it is genuine separation of trading custody from operational risk.
If you want to verify any of this, our /seguranca page lists the operational model. We are deliberate about what we share and what we don't (specific KMS ARNs, IP allowlists, etc. stay private for security reasons).
Bottom line
Decide what fraction of your stack you want exposed to each risk. Default to 90-10 (cold-warm) for non-traders, adjust for your actual usage. Treat the exchange you trade with as a counterparty, not a vault.
Both custody models have real risks. The mistake is pretending one of them is risk-free.