Self-custody: how to hold your own crypto

• Self-custody means your coins are secured by a key only you hold. No exchange failure, freeze or hack can touch them, and nobody can reset the key if you lose it.
• Cheapest respected hardware wallets: Trezor Safe 3 and Ledger Nano S Plus, both $59. Prices checked September 2026.
• UK rules: moving coins between your own wallets is not a taxable event, FSCS protection never covers crypto, and exchanges must ask who owns a wallet before you withdraw to it.

Self-custody means holding your own crypto instead of leaving it with an exchange. When your coins sit on Coinbase, Kraken or Robinhood, what you actually own is a promise from a company: their systems say those coins are yours, and you trust them to honour it. Self-custody replaces that promise with a key that only you hold. No company failure, freeze or hack can touch coins secured by a key that never left your hands.

The price of that independence is responsibility. There is no password reset, no fraud department and nobody to ring. Lose the key and the coins are gone in a way almost nothing else in modern life is gone. The crypto world compresses this into a slogan, “not your keys, not your coins”, and tends to skip the second half: your keys, your problem.

This guide explains how self-custody actually works, how to decide whether it is right for you, how to do it safely if it is, and the specific rules that apply in the UK. It is education, not advice, and we sell nothing on this page.

Should you actually do this?

Honest answer: not everyone should, and anyone who tells you otherwise is selling something.

Self-custody does not remove risk. It moves risk from the exchange to you. On an exchange, the dangers are theirs: hacks, collapses, frozen withdrawals. In self-custody, the dangers are yours: lost backups, house fires, phishing, and plain human error. Which set of risks is smaller depends on you, honestly assessed.

Keeping coins on a large FCA-registered exchange is a reasonable choice when the amount is money you actively trade, when it is small enough that losing it would sting rather than hurt, or when you know yourself well enough to doubt you would keep a piece of paper safe for ten years. Exchange failures are real, and we report them when they happen, but so is losing a seed phrase in a house move.

Self-custody starts to make sense when the amount has become meaningful to you, when you are holding for years rather than trading, and when you are willing to spend an hour setting things up properly and an evening a year checking they still work. As a rough rule of thumb, when the value of the crypto is many multiples of the cost of a hardware wallet, the wallet has stopped being an expense and become insurance.

The words that are the money

Everything in self-custody comes down to one thing: the seed phrase. When you set up a wallet, it generates a list of 12 or 24 ordinary English words. Those words are not a password to your account. They are the account. Anyone who has them can rebuild your wallet on any device, anywhere in the world, and take everything in it. Anyone who does not have them cannot, including you.

The device, whether it is an app or a piece of hardware, is just a keyring. It can break, be lost, be stolen or die of old age, and none of that matters as long as the words survive: buy a new device, enter the words, and your coins reappear. This is the single most misunderstood thing in crypto. People guard the gadget and photograph the words, when it should be exactly the other way round.

The rules for the words never change, and every scam in the final section of this guide is an attempt to talk you out of one of them. Write them by hand, on paper or stamped into steel. Never photograph them. Never type them into a phone, computer or website. Never read them to anyone, and know that no legitimate company will ever ask, not the wallet maker, not an exchange, not “support”. There are no exceptions.

Paper is free and most people should start there. The case for steel is narrow but real: paper chars at around 230°C and a house fire runs far hotter than that, and paper does not survive a flood either. A steel plate is a one-off purchase that makes the words outlive the house. If what you are holding is small, paper kept in two separate places is a perfectly reasonable answer.

Hot wallets and cold wallets

A hot wallet is an app on your phone or computer. It is free, quick to set up and fine for small amounts, the crypto equivalent of the cash in your pocket. But because it lives on an internet-connected device, it shares that device’s exposure: malware, a compromised app store, or a bad link can reach it.

A cold wallet, usually a hardware wallet, is a small device that keeps your keys on a chip that never touches the internet. When you send coins, the transaction is prepared on your computer, signed inside the device, and only the signature comes out. Even a thoroughly infected computer cannot extract the keys. For savings you intend to hold, this is the standard the industry has settled on, and devices cost less than most people’s monthly phone bill.

The usual arrangement is both: a hot wallet with spending money, a hardware wallet with savings. The same split you already run with a current account and a savings account.

Choosing a hardware wallet

Four names dominate serious conversations, but the table below covers the wider field too, including the air-gapped devices explained further down. If you just want an answer, start here: Official manufacturer prices are in dollars because that is how they sell worldwide; a UK checkout converts at your card’s rate, and UK retail typically lands between roughly £60 and £200 depending on the model. Prices checked August 2026.

One honest complication belongs in any guide that mentions Ledger. In 2023 the company introduced Ledger Recover, an optional subscription that can back up an encrypted copy of your seed through the device firmware. It is off by default and entirely opt-in, but its existence proved the firmware is capable of exporting seed material, which contradicted years of marketing and caused the largest backlash in hardware wallet history. Because Ledger’s firmware is partly closed, users cannot independently verify the conditions under which that path operates. Three years on, the row has never fully died. Ledger devices remain popular and no theft has been attributed to Recover, but if the idea bothers you, that instinct is what the fully open-source rows in the table are for.

Whatever you choose, buy it directly from the manufacturer or a reseller the manufacturer lists. Never buy a hardware wallet second-hand or from a marketplace listing, however sealed it looks. A tampered device can hand its “randomly generated” words straight to a thief, and this is not a theoretical attack.

Also worth knowing

Four names dominate the conversation, but they are not the only devices worth your money, and some of the alternatives do something the table above does not. An air-gapped wallet never connects to anything at all: no cable, no Bluetooth, no wifi. It talks to your phone by showing QR codes on its own screen. That closes off an entire category of attack, at the cost of a slower and fiddlier process every time you send.

Blockstream’s Jade is here for a different reason. At well under half the price of anything in the table, fully open source and Bitcoin-only, it is the cheapest honest way to get coins off an exchange, and the price is low enough that cost stops being a reason to leave them there. All five are in the table above, alongside the mainstream picks.

Setting it up safely

1. Check the packaging. Manufacturers describe their tamper seals and factory state on their websites. A device that arrives asking you to use a seed phrase from a card in the box, rather than generating one itself, is compromised. Genuine devices always generate the words on their own screen.
2. Update the firmware first. Do this through the manufacturer’s official app, downloaded from the address printed in the packaging, not from a search result. Search ads impersonating wallet software are one of the oldest tricks in the book.
3. Write the words by hand. On the card provided or better. If the amounts justify it, stamp them into a steel backup plate, which survives fire and water in a way paper does not. Two copies in two places beats one copy anywhere.
4. Test the recovery before trusting it. Most devices can verify your written words against what they generated. Do it. Finding a transcription error now costs a minute; finding it after the device dies costs everything.
5. Send a test amount first. Move a small amount from your exchange, confirm it arrives, then send it back. Only after the round trip works should meaningful money follow.
6. Verify addresses on the device screen. When you receive, the address your computer shows must match the one on the device’s own screen. The device screen is the one a hacked computer cannot fake, which is half the reason the screen exists.

There is an advanced option called a passphrase, sometimes described as a 25th word, which creates hidden wallets behind your seed. It is genuinely powerful and genuinely dangerous: forget the passphrase and the coins are unrecoverable even with the seed. Leave it until self-custody feels routine, and research it separately before touching it.

Living with it

Day to day, self-custody is quieter than people expect. Receiving costs nothing and does not need the device plugged in; coins arrive at your addresses on the blockchain whether the hardware is in a drawer or a safe. Most manufacturer apps offer a watch-only mode that shows balances without the device, so checking on your coins does not mean fetching it. Sending is the only ceremony: plug in or scan, review the transaction on the device screen, approve it there.

Firmware updates arrive a few times a year and are worth taking, through the official app only. The seed phrase never needs updating, never expires and never needs re-entering unless you are recovering onto a new device. If anything, whether software, a website or a person, ever asks you to “re-validate”, “sync” or “verify” your seed phrase, you are being robbed.

The UK bits

Withdrawing to your own wallet is legal and normal, but do not be surprised if the exchange asks questions. UK money-laundering rules bring transfers to and from private wallets into scope, and exchanges take a risk-based approach: they may ask you to confirm the destination wallet is yours, and in some cases to prove it, either with a small test transaction or by signing a message with the wallet. Irritating, but routine, and we covered Ireland proposing stricter versions of the same idea. It is regulation of the pipes, not a ban on holding your own keys.

Protection does not change in the direction people assume. Money in a UK bank is protected up to £85,000 by the FSCS. Crypto has no equivalent on an exchange, and none in self-custody either. What changes is the failure you are exposed to: the exchange’s, or your own.

Tax is friendlier than people fear, with one trap. Moving coins between wallets you own is not a disposal, so shuffling coins from an exchange to your hardware wallet triggers no Capital Gains Tax. Selling, swapping one coin for another, or spending are disposals, wherever the coins live. Keep records of what you paid, because years from now HMRC will care about the gain since purchase, not since withdrawal. The annual CGT allowance is small, £3,000 in recent tax years, so this catches more people than it used to.

Think about inheritance once, briefly. Coins nobody can find are coins nobody inherits. Write clear instructions for someone you trust, stored separately from the seed itself, saying what exists and how to reach it. Instructions in one place, words in another; together they work, apart they are useless to a thief.

The scams that actually catch people

Almost nobody loses self-custodied crypto to code being broken. They lose it to being talked into things, and the patterns repeat.

The fake support call. After wallet companies leak customer data, and they do, names and addresses included, criminals ring or email posing as support, urgently helping you “secure” your wallet by confirming your seed phrase. Real companies never contact you first about your wallet and never ask for the words. The moment a conversation heads toward your seed, it is over.

The leaked-list letter. Data leaks like the 678,000 records exposed in France tell criminals exactly who owns crypto and where they live. Expect convincing letters, texts and emails naming real services you use. The defence is boring and absolute: never act on inbound contact. Go to the service yourself, through the address you know.

The poisoned search result. Fake wallet apps and lookalike download sites buy ads against searches like “ledger live download”. Type manufacturer addresses directly, bookmark them, and never install wallet software from a search ad.

The address swap. Malware on a computer can silently replace a copied crypto address with the thief’s. This is why the device screen ritual matters: what the hardware shows is the truth, whatever the computer says.

The too-helpful stranger. Anyone in a chat group, comment section or DM offering to help you “validate”, “migrate” or “unstick” a wallet is fishing for your seed. Every one. There is no such job.

None of this should put you off. It is the same lesson as the rest of this guide: in self-custody, the human is the security system. Set things up carefully once, follow three or four boring rules forever, and you are a harder target than almost any exchange.

Common questions

What happens if my hardware wallet breaks?

Nothing happens to your coins. They live on the blockchain, not in the device. Buy a replacement, enter your seed phrase, and everything reappears. The device is a key, not a vault.

What happens if the wallet company goes bust?

Your coins are unaffected. Seed phrases follow an open standard, so a Trezor seed can be recovered on other standard-compatible wallets, and the same is true across reputable makers. You are not dependent on any company’s survival.

Can I put my seed phrase in a password manager?

We would not. A password manager is an excellent tool that lives on internet-connected devices, which is exactly where seed phrases must never be. The whole point of the words on paper or steel is that they cannot be hacked remotely. Typing them into anything connected erases that property.

Is a bank safe deposit box a good place for the backup?

It can be part of the answer, with two caveats: access is limited to bank hours, and a box is a single point of failure. The classic arrangement is two copies in two locations of different kinds, for instance one at home well hidden and one in a box.

Do I need one wallet per coin?

No. One seed phrase secures effectively unlimited addresses across many different coins on the same device. The fifteen coins we cover can all live behind a single mainstream hardware wallet, with the exception that Bitcoin-only devices like Coldcard hold only bitcoin, by design.

Should I tell anyone I hold crypto in self-custody?

Fewer people than you are tempted to. Self-custody moves the honeypot from an exchange’s servers to your house, and discretion is a genuine security layer. Pair that discretion with the inheritance instructions above so the right person can find things when it matters.

This guide is education, not financial advice, and Cryptobase is not authorised to give any. It contains no affiliate links and nobody paid to appear in it; if that ever changes, the change will be disclosed on this page in plain sight. Facts, models and prices checked August 2026; we review this page when the facts move.