To store crypto safely, keep almost all of it in cold storage on a hardware wallet, treat the seed phrase as the real asset and back it up on metal in more than one place, and make sure no single mistake, theft, or dead device can end the whole story. Here is the exact setup I actually run, and why each piece is there.
There is a saying in crypto: not your keys, not your coins. It is true, and it is also a warning most people do not read all the way to the end. The moment you actually hold your own keys, you become the bank, the vault, and the one person who can lose everything with a single mistake. Self-custody is freedom and a loaded gun in the same hand.
I learned the hard way that crypto punishes carelessness. So I hold it the same way I think about any critical system. Assume any single piece will fail, and make sure that failure is survivable.
Should you store crypto on an exchange?
An exchange is a place to trade, not a place to keep anything. If it holds your coins, you are trusting that company to stay solvent, stay honest, and stay unhacked. We have all watched what happens when one of those turns out to be false. Keep on an exchange only what you are actively trading. Everything else comes off.
Cold storage is the base layer
The bulk of it lives in cold storage, on hardware wallets, keys that never touch an internet-connected machine. I use two hardware wallets from different makers, on purpose, so a flaw or a failure in one does not take the whole thing down. Same logic as everything else here: do not trust one of anything.
A hardware wallet keeps the private key on the device and signs transactions without ever exposing it. Malware on your laptop cannot pull a key that never leaves the hardware. That is the whole point of the thing.
The seed phrase is the actual asset
Here is what people get wrong. The device is not the valuable part. The seed phrase, that list of words, is. Anyone with the seed has the money, and losing the seed loses the money, even if the device is fine. So the seed is what you actually protect.
A few rules I hold to:
Never digital. The seed never gets typed, photographed, screenshotted, or stored in a file. The instant it touches an internet-connected device, treat it as compromised.
Metal, not paper. Paper burns, floods, and fades. The backup goes on steel, so a house fire is not also a financial event.
Separate the copies. More than one backup, in more than one location. One in a fire that also took the only copy is the exact single point of failure this whole approach exists to kill.
Consider a passphrase. The optional extra word, the 25th word, means that even someone who finds your seed does not have everything. Powerful, and dangerous in its own way, because if you forget it, it is gone too. Only use it if you have a real plan for remembering it.
How do you know your seed phrase backup actually works?
A backup you have never restored is a guess. At least once, wipe or use a spare device and recover from the seed. If it works, you know the backup is real. If it does not, you just found out while it was still safe to find out. An untested recovery plan is not a plan, it is a hope.
How much security does your crypto actually need?
Not everything needs the same fortress. A small hot wallet for actually using onchain apps, with only pocket-money balances. Cold storage for the real holdings. And past a certain size, multisig, where it takes more than one key to move funds, so a single compromised device still cannot drain you. Scale the security to what is actually at stake.
The one rule underneath all of it
This is the same principle from how I think about two-factor and account recovery: no single point of failure. One device, one backup, one location, one vendor, one mistake. Any setup where a single event ends everything is not secure, it is a countdown. Add the second of everything, test that it works, and self-custody stops being terrifying and starts being just careful.
Common questions
What is the safest way to store crypto?
Keep almost all of it in cold storage on a hardware wallet, with the keys never touching an internet-connected machine. Keep only what you are actively trading on an exchange. Protect the seed phrase as the real asset, back it up on metal in more than one location, and make sure no single mistake, theft, or dead device can end the whole thing.
Where should you keep crypto: a hardware wallet or an exchange?
An exchange is a place to trade, not a place to keep anything. If it holds your coins, you are trusting that company to stay solvent, honest, and unhacked. Keep only active trading balances there and move everything else to a hardware wallet, where the private key stays on the device and signs transactions without ever being exposed to malware on your computer.
What is a seed phrase and how should you back it up?
The seed phrase is the list of words that controls your crypto. It, not the device, is the actual asset: anyone with the seed has the money, and losing the seed loses the money even if the device is fine. Never store it digitally, back it up on steel rather than paper, and keep more than one copy in more than one location so a single fire or flood is not also a financial event.
Should you use a passphrase, the 25th word?
A passphrase means that even someone who finds your seed does not have everything, which is powerful. It is also dangerous: if you forget it, the funds are gone too. Only use it if you have a real, durable plan for remembering it. Match the whole setup to the amount at stake, and past a certain size move to multisig, where it takes more than one key to move funds.
How do you know a crypto backup actually works?
Test it. A backup you have never restored is a guess. At least once, wipe or use a spare device and recover from the seed. If it works, you know the backup is real; if it does not, you found out while it was still safe to find out. An untested recovery plan is not a plan, it is a hope.
