Crypto Wallet vs. Exchange: Who Holds Your Keys, What Protects Your Coins, and How It Affects Your Taxes
Whether you leave your cryptocurrency on an exchange or move it to a self-custody wallet is one of the most consequential decisions you will make as a crypto holder — and it is not purely a security decision anymore. Since 2026, that choice directly shapes your tax paperwork, your cost basis reporting, and your exposure to custodial risk. This guide covers the full picture: who controls the private keys, what legal protections actually exist, how much it costs to move coins, and what the IRS now expects from both exchange holders and self-custody wallet owners.
Quick Answer
Crypto held on an exchange is in the custody of that exchange, not yours. If the platform is hacked, shuts down, or files for bankruptcy, you may lose access to your funds — a risk the SEC explicitly warned retail investors about in its December 2025 investor bulletin. Moving coins to a self-custody wallet eliminates custodial risk but transfers the entire burden of security to you: lose your private key or seed phrase, and the coins are permanently gone with no recourse.
Neither arrangement is covered by FDIC deposit insurance. SIPC does not protect crypto that does not qualify as a security. For tax purposes, exchanges issue Form 1099-DA with cost basis data for qualifying coins; self-custody wallets do not generate any form, leaving the record-keeping obligation entirely with the owner.
Key Takeaways
Private key control is the core distinction: exchanges hold keys on your behalf; self-custody wallets put them in your hands alone — and that single difference determines who can lose access to the coins and under what circumstances
No government safety net for crypto: the FDIC confirms its deposit insurance does not cover crypto assets or the failure of non-bank crypto firms; SIPC similarly excludes crypto that is not a qualifying security
Withdrawal fees vary by platform: Coinbase charges a network-cost-based fee; River offers one free bitcoin send per month; Fidelity Crypto imposes a $2,000 daily withdrawal limit by default with a 2–3 business day activation period for new addresses
Form 1099-DA coverage is conditional: brokers only report cost basis for digital assets purchased in a custodial account after 2025 and never transferred out; coins moved in from a wallet are classified as "noncovered," leaving the owner to supply the basis independently
Transferring between your own wallets is not a taxable event under IRS FAQ 81, except for any digital assets consumed as transaction fees
Exchange risk is real and documented: the FTX collapse resulted in more than $8 billion in customer losses and a 25-year prison sentence for its founder, illustrating the consequences of custodial mismanagement at scale
What Changed in 2026: The New Tax Landscape for Crypto Holders
The year 2026 marked a significant shift in how U.S. crypto tax reporting works, and the wallet-versus-exchange decision now has direct tax consequences that did not exist in prior years.
Starting with sales occurring in 2026, U.S. digital asset brokers are required to report cost basis on Form 1099-DA for "covered" digital assets. The IRS instructions updated on April 30, 2026 define a covered digital asset as one that was "acquired in an account for which the broker provided custodial services" and held in that account through the point of sale. Any digital asset purchased before 2026, or transferred into an exchange account from an external wallet, is classified as a "noncovered" asset — meaning no cost basis is reported to the IRS on the taxpayer's behalf.
The practical implication is significant. If you buy Bitcoin on an exchange in 2026 and sell it from that same account, the exchange reports both the proceeds and the cost basis on your 1099-DA — the same way a stock broker would handle a standard equity sale. However, if you withdraw that same Bitcoin to a self-custody wallet and later transfer it back to sell, the exchange's 1099-DA will show your proceeds but not your basis. You are then responsible for supplying your purchase records to calculate and document your gain or loss.
This is not a minor administrative detail. Undocumented cost basis defaults to zero in many situations, which would result in the IRS treating the entire sale price as taxable gain. The choice between keeping coins on an exchange and moving them to self-custody now has a direct and measurable impact on your tax filing complexity.
On the regulatory front, the SEC's Office of Investor Education and Assistance published a dedicated plain-language guide — "Crypto Asset Custody Basics for Retail Investors" — on December 12, 2025. The bulletin outlines the trade-offs between self-custody and third-party custody arrangements and includes a checklist of questions investors should ask any custodian before depositing funds.
Crypto Wallet vs. Exchange: What Is the Actual Difference?
The fundamental distinction between a crypto exchange account and a self-custody wallet is not about the interface you use, the coins you hold, or the platform's brand — it is about who controls the private keys.
Private keys are the cryptographic codes that authorize the movement of cryptocurrency on the blockchain. Whoever holds the private keys controls the coins. As the SEC bulletin states, in self-custody arrangements "you control your crypto assets and are responsible for managing the private keys." With a third-party custodian such as a centralized exchange, the platform holds those keys on your behalf.
When you hold crypto on an exchange, your account balance represents a liability the exchange owes you — a claim on the platform rather than direct ownership of the underlying asset. Withdrawing those coins requires the exchange to process your request. The company, not the blockchain, sits between you and your assets.
A self-custody wallet, by contrast, signs transactions directly on the blockchain without any intermediary. This is both its primary security advantage and its primary vulnerability: there is no company to call if you make a mistake, send coins to the wrong address, or lose access to your keys.
The Terminology Confusion: Exchange Wallets Are Not Self-Custody
One of the most common sources of confusion in crypto is the exchange's own "wallet" feature. Many centralized platforms refer to your on-platform holdings as being stored in a wallet — and technically, they are stored in a wallet operated by the exchange. But the exchange holds the private keys to that wallet, not you. The exchange controls those coins, not you.
A wallet is only truly self-custodied if you personally hold the private keys or possess the seed phrase — the human-readable list of words (typically 12 or 24) that can regenerate your private keys and restore access to your funds on any compatible wallet application. If you have neither, you are using a custodial arrangement regardless of what the platform calls it.
Hot Wallets vs. Cold Wallets: The Two Forms of Self-Custody
Self-custody wallets divide into two categories based on their internet connectivity, and the trade-off between them is essentially a trade-off between convenience and security.
A hot wallet is a crypto wallet that remains connected to the internet. This includes mobile apps, desktop applications, and browser extensions. Hot wallets make it easy to access and move your crypto quickly, which is valuable for active traders and DeFi participants who need to interact with decentralized applications regularly. The SEC bulletin defines a hot wallet as one that is "connected to the internet" and notes the elevated exposure to cyberattacks that connectivity introduces. Malware, phishing attacks, and remote exploits are the primary threat vectors.
A cold wallet — also called cold storage — is a device or method that keeps your private keys entirely offline. Hardware wallets (physical devices that store keys and sign transactions without exposing keys to an internet-connected environment) are the most common form. Air-gapped computers and metal seed phrase backups are also used for maximum security. The SEC bulletin notes that while cold wallets are much harder to attack remotely, the physical device itself can be lost, damaged, or stolen, and the seed phrase is the only recovery mechanism in all of these scenarios.
The bulletin's guidance on seed phrase security is unambiguous: "store your seed phrase in a secure place and do not share it with anyone." Exposing a seed phrase to any digital environment — photographing it, storing it in a cloud service, emailing it to yourself — effectively transforms your cold storage into something much more vulnerable.
Who Holds the Private Keys — and What Happens When They Are Lost?
The private key question is not abstract. It has determined whether thousands of crypto holders recovered their assets after exchange failures — and whether millions in Bitcoin moved to self-custody remain permanently locked away.
In a self-custody wallet, losing the private key or seed phrase is permanent and irreversible. The SEC bulletin is clear: "If you lose your private key, you permanently lose access to the crypto assets in your wallet." There is no password reset, no customer service escalation, and no legal mechanism to recover access. The coins remain on the blockchain, visible to anyone, but inaccessible forever.
On an exchange, the platform manages key security on your behalf. This removes the personal key-loss risk but introduces a distinct set of custodial risks that the SEC bulletin explicitly enumerates:
Hacking: The exchange's systems may be compromised, resulting in customer funds being stolen
Shutdown or insolvency: The exchange may cease operations, voluntarily or through bankruptcy, potentially locking customers out of their funds
Rehypothecation: Some custodians "use deposited crypto assets as collateral for their own purposes" — a practice that means your coins may be actively deployed in ways you never authorized or consented to
Commingling: Some platforms pool customer assets together rather than holding each customer's coins in segregated accounts, which can complicate recovery in the event of insolvency
Understanding these risks is not theoretical. The FTX case — discussed in the section on exchange protections below — demonstrates precisely what the worst-case custodial failure looks like in practice.
Legal Protections on an Exchange: What Applies and What Does Not
This section may be the most important in the entire article for crypto holders who assume exchange-held assets carry protections similar to a bank account or brokerage account. They do not.
FDIC Insurance: Does Not Cover Crypto
The Federal Deposit Insurance Corporation (FDIC) insures deposits at member banks up to $250,000 per depositor. Crypto assets are not deposits, and crypto exchanges are not banks. The FDIC addressed this directly on July 29, 2022, stating that "deposit insurance does not apply upon the failure of a non-bank, such as a crypto company," and that crypto assets are non-deposit products that the FDIC does not insure.
Some exchanges, including Coinbase, do hold customers' U.S. dollar cash balances at FDIC-insured banks. This means the fiat currency in your account may be covered up to the applicable limit if the underlying bank fails — but the coverage applies to the cash, not to any cryptocurrency.
SIPC Protection: Generally Excluded
The Securities Investor Protection Corporation (SIPC) protects customers of failed SIPC-member brokerage firms up to $500,000, including up to $250,000 in cash claims. However, SIPC has stated explicitly that it "does not protect any digital or crypto asset that does not qualify as a 'security.'" Furthermore, SIPC excludes digital asset securities that are unregistered investment contracts "even if held by a SIPC-member brokerage firm."
In practice, the vast majority of cryptocurrencies — including Bitcoin and Ethereum — are not considered securities under current regulatory interpretations, meaning SIPC protection does not extend to them even at regulated brokerage firms that offer crypto products.
What Exchanges Do Offer: Contractual Protections
In the absence of statutory insurance, exchanges rely on contractual arrangements and operational practices to protect customer assets. The quality and enforceability of these arrangements varies significantly between platforms.
Coinbase provides one of the more detailed public disclosures. In its Form 10-K for 2025, filed with the SEC on February 12, 2026, Coinbase states that its user and custody agreements apply Article 8 of the Uniform Commercial Code (UCC), under which financial assets it holds in the United States for customers "are not property of Coinbase" and are "not subject to claims of our general creditors." This is a meaningful legal distinction — it means Coinbase customer crypto should, in theory, be treated as customer property rather than exchange property in a bankruptcy proceeding.
However, the same filing acknowledges that "crypto assets are not insured or guaranteed by any government or government agency." Coinbase's UCC Article 8 protections are only as reliable as the exchange's actual conduct and the bankruptcy court's willingness to enforce those contractual arrangements.
The FTX Warning: When Custodial Protections Fail
No discussion of exchange custodial risk is complete without examining the FTX collapse, which remains the defining cautionary tale of the cryptocurrency era.
The SEC's complaint against FTX, announced December 13, 2022, alleged the "undisclosed diversion of FTX customers' funds to Alameda Research," with commingled customer funds used to finance venture investments, real estate acquisitions, and political contributions — all without customer knowledge or consent. FTX founder Samuel Bankman-Fried was subsequently convicted and sentenced to 25 years in prison on March 28, 2024, for "stealing over $8 billion of his customers' money," according to the U.S. Attorney's Office for the Southern District of New York.
FTX published user agreements and terms of service that purportedly protected customer assets. Those documents were meaningless in the face of systematic misappropriation. The FTX case demonstrates that contractual protections on an exchange are only as strong as the exchange's actual operational integrity — which is impossible to verify with certainty from the outside.
How Much Does It Cost to Move Coins Off an Exchange?
Moving Bitcoin from an exchange to a self-custody wallet involves paying a network fee — the payment to miners or validators who process and confirm the transaction on the Bitcoin blockchain. Some exchanges layer additional fees or operational restrictions on top of the baseline network fee.
The table below summarizes the current fee structures and withdrawal conditions at three major platforms:
Platform Fee to Send Bitcoin to an External Wallet Limits and Wait Times Coinbase Fee "based on our estimate" of network costs, displayed at time of send; sends between Coinbase users' primary balances are free Not specified on the fees page River 1 free bitcoin send per month; subsequent sends cost the network fee, which "is not collected by River" but paid to miners Fee shown before confirming the transaction Fidelity Crypto A fee "consistent with current network pricing" $2,000 per day standard limit; up to $25,000 with the advanced limit; new withdrawal addresses require 2–3 business days to activate; Crypto IRAs cannot transfer crypto
Sources: River help article "How do I send bitcoin?" (updated September 24, 2026); Fidelity Crypto "Withdrawing crypto" help page (checked October 23, 2026); Coinbase fees help page (checked October 19, 2026).
Practical Example: Moving $5,000 of Bitcoin from Fidelity Crypto
A Fidelity Crypto customer withdrawing $5,000 in Bitcoin to a new self-custody address under the standard $2,000 daily limit would need to:
Register the new external address and wait 2–3 business days for activation
Execute three separate withdrawals over three days: $2,000, $2,000, and $1,000
Pay the applicable network fee on each of the three transactions
By upgrading to Fidelity's advanced withdrawal limit of $25,000 per day, the same transfer could be completed in a single transaction once the address is activated, reducing both the time involved and the cumulative network fee burden.
It is also worth noting that the fees described above apply to the withdrawal itself. Fees and spreads charged on the original coin purchase are a separate cost that varies by platform.
How Tax Records Differ: Exchange Coins vs. Self-Custody Wallet Coins
The tax treatment of a crypto sale does not depend on whether you held coins on an exchange or in a self-custody wallet — all taxable disposals must be reported. The critical difference is in the reporting infrastructure surrounding the sale and the burden of record-keeping.
Form 1099-DA: What Exchanges Report
U.S. digital asset brokers, including centralized exchanges, are required to file Form 1099-DA for customers' digital asset sales. For "covered" assets — those purchased in a custodial account after 2025 and held there until sale — the exchange reports both the gross proceeds and the cost basis to both the IRS and the customer. This mirrors how stock brokers report equity trades.
For "noncovered" assets — coins bought before 2026, or coins transferred into the exchange account from an external wallet — the exchange reports proceeds but no cost basis. The customer must independently supply the basis using their own purchase records.
Self-Custody Wallets: No Form, Full Responsibility
Self-custody wallet providers — software or hardware providers that simply give you the tools to control your own private keys — are not classified as "reporting middlemen" under the IRS instructions and therefore have no obligation to file Form 1099-DA. This does not mean wallet transactions are exempt from tax; it means the entire reporting burden falls on the individual.
Under IRS FAQ 108, taxable activity from self-custody wallets must be reported for the year in which it occurs, whether or not any tax form is issued. Without a 1099-DA, the IRS has no automatic visibility into self-custody wallet activity — but that does not reduce the taxpayer's legal obligation to report it accurately.
Transfers Between Your Own Wallets: Not a Taxable Event
One of the most frequently misunderstood aspects of crypto taxation is the treatment of transfers between wallets or exchange accounts owned by the same person. Under IRS FAQ 81 (updated June 29, 2026), such transfers are "a non-taxable event, except to the extent of any digital assets you use, or are withheld" to pay transaction fees. Sending Bitcoin from your Coinbase account to your Ledger hardware wallet — or between two wallets you own — does not trigger a taxable disposal.
However, this non-taxable status does not eliminate the record-keeping obligation. Moving coins from an exchange to a self-custody wallet means those coins lose their covered status if sent back to the exchange later. Maintaining clear purchase records — including date acquired, amount paid, and platform — is essential for calculating accurate basis when you eventually sell.
Record-Keeping Rules Under IRS Guidance
IRS FAQ 95 requires taxpayers to maintain records "sufficient to establish the positions taken" on tax returns related to digital asset transactions. Without specific identification of which units are being disposed of, the default accounting method under FAQ 86 and 87 is first-in, first-out (FIFO) — applied wallet by wallet and account by account, not across your entire holdings as a whole. This means the accounting treatment can differ significantly depending on how your coins are distributed across platforms and wallets.
Wallet vs. Exchange: Side-by-Side Comparison
Exchange (Custodial) Self-Custody Wallet Who holds the private keys The exchange The owner FDIC deposit insurance No for crypto; cash may sit at an FDIC-insured bank No SIPC protection No for crypto that is not a qualifying security No Primary risk of losing access Custodian is hacked, shuts down, or goes bankrupt Key or seed phrase is lost, stolen, or compromised Can the custodian lend or pool your coins Some do, per the SEC bulletin; always check the user agreement No custodian involved Cost to withdraw Bitcoin Network fee set by platform; some offer free monthly sends Network fee paid directly to miners Form 1099-DA issued Yes; cost basis reported only for coins bought in the account after 2025 and never transferred out No Records the owner must maintain Basis for coins moved in from external wallets, or purchased before 2026 Complete records of every acquisition, transfer, and disposal
Sources: SEC investor bulletin (December 12, 2025); FDIC (July 29, 2022); SIPC; IRS Instructions for Form 1099-DA and digital asset FAQs; Coinbase Form 10-K for 2025; platform help pages listed above.
When to Keep Coins on an Exchange — and When to Move Them
The SEC bulletin frames the core trade-off as control versus convenience. Self-custody puts private key responsibility with the owner and eliminates custodial risk; a managed custodian handles security but introduces the possibility that the custodian itself becomes the point of failure. Neither approach is universally superior — the better choice depends on your holdings, habits, and risk tolerance.
Cases Where an Exchange May Be the Right Choice
Small balances where the cost of a hardware wallet and the complexity of seed phrase management outweigh the custodial risk
Active traders who need rapid access to funds for frequent buys, sells, and transfers without incurring withdrawal fees on every move
Holders who are not prepared to securely store a seed phrase and recognize that the greater danger is personal key mismanagement rather than exchange failure
Tax simplicity: coins purchased on an exchange after 2025 and kept there come with automatic Form 1099-DA basis reporting, reducing the burden of manual record-keeping
Cases Where Self-Custody Is the Better Option
Significant or long-term holdings where a custodian's insolvency, rehypothecation, or commingling of assets would represent a material financial risk
Investors who have studied and can reliably execute secure seed phrase storage — including offline, redundant backups in geographically separate locations
Holders who want to participate in decentralized finance (DeFi), on-chain staking, or NFT platforms that require direct wallet connectivity and cannot operate through a centralized exchange interface
Privacy-conscious investors who prefer to minimize how much on-chain transaction data flows through centralized, regulated platforms with KYC and AML obligations
Splitting Holdings Between Both: A Hybrid Approach
Many experienced crypto holders maintain both an exchange account and one or more self-custody wallets, allocating holdings based on their intended use. Trading liquidity and recently purchased coins stay on the exchange for reporting convenience; long-term holdings move to cold storage. This hybrid approach is entirely viable under current tax rules, but it requires careful record-keeping: the IRS applies its basis-tracking and FIFO rules wallet by wallet and account by account, so every transfer between the two environments must be documented with dates, amounts, and acquisition costs.
Common Mistakes That Cost Coins or Create Tax Problems
Understanding the risks intellectually is different from avoiding the mistakes in practice. These are the most consequential errors made by exchange and self-custody users:
Treating an exchange "wallet" as self-custody. If the exchange holds the private keys, the coins carry all custodial risks — regardless of what the platform calls the storage feature. Genuine self-custody requires that you personally hold the keys or seed phrase.
Assuming FDIC or SIPC insurance covers your crypto. Both agencies have publicly clarified that crypto assets are outside their protection frameworks. Planning your security strategy around a safety net that does not exist is a serious risk management error.
Storing a seed phrase in any digital format. Photographing your seed phrase, typing it into a note-taking app, saving it in cloud storage, or emailing it to yourself exposes it to the same attack vectors as a hot wallet. Physical, offline storage — ideally in multiple secure locations — is the standard recommendation.
Sending coins to an exchange without keeping purchase records. Coins transferred into an exchange account from a self-custody wallet will appear as "noncovered" on your 1099-DA. Without your original purchase records, you cannot document your cost basis, which may result in overpaying capital gains taxes.
Not verifying a recipient address before sending. Self-custody transactions are irreversible once confirmed on the blockchain. Sending to a mistyped address, a compromised address, or a smart contract you did not intend to interact with has no remedy. Always verify the full address — not just the first and last few characters — before confirming any transaction.
Ignoring the tax implications of moving coins between environments. While transfers between wallets you own are not taxable events, they do change the cost basis reporting landscape for future sales. Failing to track which coins are "covered" versus "noncovered" can create significant complications at tax time.
The Bottom Line
The decision to hold cryptocurrency on an exchange or in a self-custody wallet comes down to a single foundational question: who holds the private keys and therefore bears the risk? On an exchange, the custodian holds the keys, manages security, and files your tax basis documentation — but also introduces the possibility of hacking, insolvency, rehypothecation, or commingling, with no government insurance backstop for your crypto assets. In a self-custody wallet, you hold the keys and bear sole responsibility for their protection, with no recovery mechanism if access is lost.
Since 2026, the tax dimension of this choice has become impossible to ignore. Exchanges report cost basis only for coins purchased in a custodial account after 2025 and never transferred out; coins that enter the self-custody ecosystem lose their covered status if later returned to an exchange for sale. The record-keeping burden grows proportionally with the complexity of your holdings and the frequency of your transfers.
Neither choice is the right answer for everyone. The right answer depends on the size of your holdings, your technical comfort with private key management, your trading behavior, and your personal assessment of custodial versus self-custody risk. Reviewing the IRS Form 1099-DA instructions each tax year, and the custody terms in any exchange's user agreement whenever they are updated, should be standing items on every crypto holder's compliance checklist.
Frequently Asked Questions
Is it safer to keep crypto on an exchange or in a self-custody wallet?
Neither arrangement is inherently safer — the relevant question is which risk profile fits your circumstances better. On an exchange, your security depends on the platform not being hacked, shut down, or filing for bankruptcy. In a self-custody wallet, your security depends entirely on protecting your seed phrase; a lost or stolen seed phrase means permanent, irrecoverable loss of access to your coins.
Is cryptocurrency on an exchange covered by FDIC insurance?
No. The FDIC has stated that deposit insurance does not apply to crypto assets or to the failure of non-bank crypto companies. Some exchanges do hold customers' U.S. dollar cash balances at FDIC-insured banks, meaning the cash portion of your account may be covered up to applicable limits — but the cryptocurrency itself is not.
Does SIPC protect crypto held at a brokerage?
Generally no. SIPC has clarified that it does not protect digital or crypto assets that do not qualify as securities under U.S. law. This exclusion applies even at SIPC-member brokerage firms, and extends to digital asset securities that are unregistered investment contracts.
Is transferring crypto from an exchange to my own wallet a taxable event?
No. Under IRS FAQ 81, transferring digital assets between wallets or accounts that you own is a non-taxable event. The only exception is any cryptocurrency consumed as a transaction fee during the transfer, which may be treated as a disposal. Keep your original purchase records, because coins transferred to self-custody lose their "covered" status and will not have broker-reported basis if you later send them back to an exchange to sell.
Do self-custody wallet providers issue Form 1099-DA?
No. Under IRS instructions, entities that only provide software or hardware enabling users to control their own private keys — without performing additional custodial or brokerage functions — are not classified as reporting middlemen and have no obligation to file Form 1099-DA. You are still legally required to report all taxable disposals from a self-custody wallet on your annual tax return.
What happens to my cryptocurrency if an exchange goes bankrupt?
The outcome depends on the exchange's custody practices, its legal structure, and the decisions of the bankruptcy court overseeing the proceeding. The SEC bulletin warns that customers "may lose access" to their funds. Coinbase, for example, states in its annual filing that U.S. customer assets held under its custody agreement are not Coinbase property under UCC Article 8 and should not be subject to claims by its general creditors — but the enforceability of that protection in an actual bankruptcy has not been tested. The FTX case illustrates that contractual terms mean nothing if the exchange misappropriates customer assets before any insolvency proceeding begins.
Want to join the discussion? Login and create a profile to comment.
