Buying crypto is easy; storing it safely is a separate task. The key idea is simple: whoever holds the private keys controls the funds. Below: how an exchange, a hot wallet and a cold wallet differ, what a seed phrase is, how to store it, and what protection settings exchanges offer. Data checked on 19 October 2026.
Important. This material is for information only and is not investment advice. As of 19 October 2026, the Law of Ukraine on Virtual Assets No. 2074-IX has the status “Not yet in force” (law card), so its provisions do not yet apply. Responsibility for the keys and for the choice of service mostly rests with you.
Who Holds the Keys: the Exchange or You
According to Binance Academy (updated 14 May 2026), wallets are either custodial or non-custodial. A custodial wallet is managed by a third party, such as an exchange: it holds the keys for you. This is simpler and access is easier to recover, but you have to trust the operator’s security and reliability. In a non-custodial wallet, the keys and the seed phrase are yours. You have full control, but if the keys are lost or compromised, recovery is impossible.
| Type | Where the keys are | Internet connection | What the sources say |
|---|---|---|---|
| Exchange (custodial) | With the exchange | Depends on the exchange | Easy login and access recovery, but you have to trust the operator |
| Hot wallet (app, extension) | With you | Connected | Convenient for frequent transactions, but the most exposed to phishing, malware and hacking |
| Cold wallet (hardware, offline) | With you | Works offline | Strong protection against online attacks, but less convenient, and quick access is harder |
Binance Academy advises splitting funds by purpose: keep small amounts for everyday transactions in a hot wallet and move larger reserves to cold storage. This is a principle of spreading risk, not advice on an amount: you decide the proportions yourself.
What a Seed Phrase Is
A seed phrase, or mnemonic phrase, is a set of words from which a wallet restores all of its keys. The BIP-39 standard describes phrases of 12, 15, 18, 21 or 24 words. It also provides for an optional password (passphrase): if one is set, both the words and the password are needed for recovery. The practical conclusion: whoever knows the phrase can control your funds from any device, and without a backup, losing it means losing access.
Risk. No support service asks for a seed phrase. Binance writes that its employees never ask for confidential data and never ask you to transfer money. The Cyberpolice advises never giving a seed phrase to third parties and never entering it on unverified resources, and among the signs of fraud it names a “job” where a phrase is requested for “registration.”
How to Store a Seed Phrase
- Offline only. Binance Academy advises writing the phrase on paper and keeping it in a secure physical place, such as a fireproof safe or a bank safe-deposit box, and never storing it on a device connected to the internet. Do not photograph it or put it in the cloud, notes or a messenger.
- More than one copy. Binance Academy advises keeping backups in a separate safe place. A single copy in one place is a risk: a fire or a loss would leave you without access.
- Do not show it to anyone or read it out. Whoever has the phrase can take the funds. Do not respond to requests to “verify your wallet,” even if “support” is writing.
- Write it down exactly. The words are stored in a specific order. Copy the phrase carefully and check every word right after creating the wallet, while access is still open.
- Think about a passphrase. It adds protection, but it must be stored too: a forgotten password means the wallet cannot be restored from the phrase alone.
If you decide to buy a hardware wallet, Binance Academy advises buying it only from the manufacturer and checking that the packaging has not been opened. Such devices carry risks too: firmware, physical loss, tampering in the supply chain.
Protecting Your Exchange Account
If part of your funds sits on an exchange, protecting the account becomes the first line of defense. Binance Academy advises using an authenticator app or a hardware key instead of SMS, because SMS can be intercepted through a SIM swap. WhiteBIT’s security help page lists its tools: 2FA, passkey, an anti-phishing code, a whitelist of withdrawal addresses, automatic logout on inactivity and device management.
- A unique password and two-factor authentication via an app or passkey, not SMS.
- An anti-phishing code. It is added to the exchange’s emails, so an email without your code should be treated as suspicious (WhiteBIT help center).
- A whitelist of withdrawal addresses, if the exchange offers one: withdrawals will then go only to addresses you added to the list yourself.
- Logging in only through the official website or app, not through links in emails and messages. Binance advises checking that the site’s certificate is issued to *.binance.com or *.binance.net.
- Regularly reviewing active devices and sessions: end the ones you do not need.
- Do not give your 2FA backup keys to anyone or enter them on third-party sites.
Common Mistakes
- A screenshot or photo of the seed phrase, a copy in the cloud or in notes.
- Entering the phrase on a site “for verification” or “recovery”: the Cyberpolice advises never giving seed phrases or private keys to anyone.
- Quickly connecting a wallet to a new site for the sake of a “giveaway”: WhiteBIT advises not to rush into connecting to new or unverified platforms.
- A single copy of the phrase in one place, or buying a hardware wallet secondhand.
- Sending to the wrong network: see the material USDT Networks: TRC20, ERC20 or BEP20 for details.
If You Suspect Your Access Has Been Exposed
- For your own wallet. If the seed phrase has been seen by someone or you entered it in the wrong place, treat the wallet as compromised: create a new wallet with a new phrase and move the funds while you still have access. Do not use the old phrase again.
- For an exchange account. Change the password, end all sessions on devices you do not need (WhiteBIT offers this option) and contact support only through the exchange’s official channels, not in messengers: fake support is a well-known scheme.
- Record the details. Save addresses, amounts, times and screenshots of conversations. The Cyberpolice advises contacting law enforcement right away if you suspect fraud; a complaint can be filed on the Cyberpolice website.
Frequently Asked Questions
Which is better: keeping crypto on an exchange or in your own wallet?
There is no universal answer. On an exchange it is simpler and access can be recovered, but you have to trust the operator. In your own wallet you have full control, but lost keys cannot be fixed. Many people combine the approaches: a small amount in a hot wallet and a larger one in a cold wallet.
What should I do if I lost my seed phrase?
If the wallet is non-custodial and there is no copy, access cannot be restored. If the wallet is still open on a device, move the funds to a new wallet with a new phrase while you still have access. For an exchange account the path is different: WhiteBIT writes that after passing KYC you can recover the account if you lose the 2FA code.
Can I store a seed phrase as a photo or in notes on my phone?
No. Binance Academy advises not storing it on a device connected to the internet, and the Cyberpolice advises not entering it on unverified resources and not giving it to anyone.
Do I need a hardware wallet?
It depends on the amount and how often you make transactions. It protects well against online attacks, but is less convenient and not free of risks: firmware, physical loss, tampering during delivery. Buy only from the manufacturer.
Is it safe to keep crypto on an exchange?
An exchange is custodial storage, so you trust its security. You can cover your own part with settings: 2FA, an anti-phishing code, an address whitelist. The rest of the risk is decided by your choice of service: see the material How to Choose a Crypto Exchange: 8 Criteria.
