Is It Safe to Keep Bitcoin on an Exchange?
Keeping bitcoin on an exchange means the provider, not you, normally controls the private keys. A well-run exchange can offer convenient account recovery and security controls, but you remain exposed to provider failure, account restrictions, cyber incidents, and withdrawal delays. Self-custody removes those custodian risks only by transferring key and recovery responsibility to you.
Key points
- An exchange balance is a claim on a provider-controlled custody system.
- Account protections do not eliminate insolvency or withdrawal risk.
- Self-custody replaces counterparty risk with operational responsibility.
- A staged withdrawal test is safer than changing custody models all at once.
What risks remain when an exchange holds my bitcoin?
This page evaluates the custody model, not individual brands
It provides a due-diligence framework for exchange custody and explains the residual risks. It does not rank exchanges, promise that a platform is safe, or provide trading or tax advice.
Covered in a specialist guide instead
- Exchange rankings
- Trading recommendations
- Detailed hardware-wallet setup
What you control when bitcoin stays on an exchange
Most exchange customers control account credentials and withdrawal requests, while the provider controls the blockchain keys. The balance shown in the account is therefore not the same thing as a wallet whose keys you possess. The provider must honor the request and have systems and assets available to complete it.
This arrangement may be practical for purchases, sales, or small working balances. It is still third-party custody, even when the account uses strong passwords, passkeys, or hardware security keys.
Four exchange failure modes to evaluate separately
- Account takeover: An attacker gains access through phishing, email compromise, SIM swapping, weak recovery, or reused credentials.
- Custodian compromise: Attackers exploit the provider’s hot wallets, key management, software, employees, or vendors.
- Operational restriction: Withdrawals are delayed or blocked by outages, reviews, policy, jurisdiction, or liquidity constraints.
- Business failure: Insolvency, fraud, poor recordkeeping, or legal proceedings can separate customers from assets for an uncertain period.
Controls that improve account security
- 1
Use a unique password and protected email account
The recovery email deserves controls at least as strong as the exchange login.
- 2
Prefer phishing-resistant authentication
Use a passkey or hardware security key when the provider supports it, and keep a tested backup method.
- 3
Enable withdrawal safeguards
Review address allowlists, time delays, login alerts, and device-session controls before relying on them.
- 4
Test a small withdrawal
Confirm that the account, destination, network, and review process work before an urgent or large transfer.
Questions to ask before relying on an exchange
- Custody terms: Who legally owns or controls deposited assets, and what do the terms say during insolvency?
- Withdrawal policy: Which limits, review holds, supported networks, and identity checks can delay access?
- Security disclosure: Does the provider explain authentication, asset segregation, incident response, and key controls without vague guarantees?
- Jurisdiction: Which regulator, legal entity, and dispute process apply to your account?
Choose a custody plan by consequence
There is no universal balance threshold at which exchange custody becomes wrong. Consider how long the bitcoin will stay there, how damaging delayed access would be, whether you can operate a self-custody backup, and whether the amount is needed for near-term activity.
If you move to self-custody, learn with a small amount, verify the receiving address on the signing device, make a test payment, and prove the recovery path before transferring a material balance.
Frequently asked questions
Is bitcoin on an exchange insured like a bank deposit?
Do not assume so. Insurance and deposit-protection rules vary, and U.S. agencies have warned that deposit insurance does not protect crypto assets simply because a bank may provide services to a crypto company.
Does proof of reserves make exchange custody safe?
It may provide evidence about selected on-chain assets at a point in time, but it does not by itself establish all liabilities, legal ownership, internal controls, or future withdrawal availability.
Should I withdraw all bitcoin immediately?
Not without a working alternative. Self-custody mistakes can also cause permanent loss. Learn, test recovery, and move in stages if you decide the change fits your risks and abilities.
Sources and methodology
Claims that can change are checked against the sources below. Product pages report documented features and disclosures; they do not claim hands-on testing unless a test method and evidence are published on the page.
Continue from this risk to the next practical decision
Use the broad safety map when you need context, or open the closest specialist guide for the next action.
Start with the complete Bitcoin safety map
Separate network, price, custody, scam, transaction, backup, and inheritance risk before choosing a control.
Compare self-custody with exchange custody
Decide where counterparty risk and recovery responsibility should sit in a setup you can operate.
Understand what a self-custody wallet requires
Learn how key control changes backup, recovery, software, and transaction responsibilities.
Check the complete setup, not one product feature.
Use the local safety audit to review backups, device access, recovery testing, firmware habits, and inheritance without sharing a seed phrase or private key.