Exchange custody vs hardware wallet: comparison table
“Exchange” here means a custodial account such as Coinbase or Kraken, where the company holds the keys. “Hardware wallet” means a device such as a Ledger or Trezor, where you hold them. Numbers in brackets refer to the numbered sources at the bottom of the page.
| Exchange (Coinbase, Kraken) | Hardware wallet (Ledger, Trezor) | |
|---|---|---|
| Who holds the private keys | The exchange. Coinbase says it keeps control of the private keys for the addresses that hold your balance; Kraken says it may keep customer ETH on shared addresses it controls [1][2]. | You. Keys are created and kept on the device, and your recovery phrase (or Multi-share Backup) is the master copy [11][12]. |
| If the company fails | A court decides. Terms say title stays with you, but Kraken’s own terms add that “a court may disagree,” and Coinbase’s 2022 10-Q said customers “could be treated as our general unsecured creditors” [2][3]. | Your ETH is on Ethereum, not at the device maker. If the maker disappears, your recovery phrase still restores the accounts on another compatible device. |
| Main threat and track record | Platform-level failures: Mt. Gox (2014), Celsius and FTX (2022), and the ~$1.5 billion Bybit theft the FBI attributed to North Korea (Feb 21, 2025) [6][7][8][10]. | Attacks on the user: fake apps and phishing for the phrase, and tricking you into signing a draining transaction. Ledger’s 2020 data leak and 2023 Connect Kit incident hit users this way [21][22][23][24]. |
| If you lose access | Reset your password and verify your ID with the company. | Only your recovery phrase brings it back. Optional paid backup: Ledger Recover $99.99/year. Trezor offers Multi-share Backup built in [14][20]. |
| Upfront cost | $0 to open an account. | Ledger $69–$399 and Trezor $59–$249, from official US price data on Oct 18, 2026, before tax and shipping [13][15][16][17]. |
| Ongoing and transfer costs | Trading fees or spreads, plus a fee to withdraw to your own wallet. | An Ethereum network fee every time you send (a plain ETH transfer uses 21,000 gas). No subscription required. |
| Convenience | Highest: instant buy and sell, bank rails, password recovery and support. | Every send needs the device and PIN. To sell for dollars you first send ETH back to an exchange. |
| Staking | One tap, but standard Coinbase staking keeps 35% of rewards [29]. | Possible from your own wallet through liquid staking such as Lido (10% fee), which adds smart-contract risk [30]. |
| Taxes and records | U.S. brokers send Form 1099-DA: gross proceeds for 2025 sales, plus cost basis for covered assets from 2026 [26][27]. | No 1099-DA for self-custody activity, so you keep the records. Moving ETH between wallets you own is not a taxable event [28]. |
| Inheritance | An executor claims the account with a death certificate and probate documents. Coinbase cannot name a beneficiary on individual accounts [25]. | Heirs need the phrase (or enough Multi-share shares) and clear instructions. There is no company to claim from. |
| Insurance | Not FDIC- or SIPC-insured. Coinbase’s crime insurance covers a portion of assets in its own storage, not losses from your compromised login [4][5]. | None. Security depends on how you guard the phrase and what you sign. |
| Most common user mistake | Treating the balance like a bank deposit, or trusting a fake “support” call. | Photographing or typing the phrase into a website, or withdrawing on the wrong network. |
Bottom line: an exchange concentrates the risk in the company; a hardware wallet concentrates it in you. Choose the risk you can manage better, or split your ETH between both. Custody is only one of the risks; price, regulation and smart-contract risk are covered in is Ethereum a safe investment?
What Coinbase and Kraken terms actually say about your ETH
Both big U.S. exchanges promise in writing that customer crypto is yours. Coinbase’s user agreement (July 22, 2026) says title to supported digital assets “shall at all times remain with you,” and that assets held for Digital Asset Wallets “are not property of Coinbase, and are not subject to claims of Coinbase’s creditors.” The same agreement says Coinbase keeps the private keys in online and offline storage, and has no obligation to create a segregated blockchain address for your assets [1].
Kraken’s Global Terms (October 6, 2026) say the same thing about title, then add a sentence every holder should read: “However, a court may disagree with our treatment of your Digital Assets and subject them to claims of our creditors.” Kraken may also hold customer ETH on shared addresses it controls, including on layer-2 networks [2].
“…in the event of a bankruptcy, the crypto assets we hold in custody on behalf of our customers could be subject to bankruptcy proceedings and such customers could be treated as our general unsecured creditors.”
That sentence appeared in the same filing that discussed new SEC accounting guidance on safeguarding customer crypto (SAB 121). It describes a legal risk, not a prediction that Coinbase will fail, and it is still the clearest statement of the point: until a court rules, custody terms are a promise, not a guarantee. Insurance does not change that. Crypto is not covered by the FDIC or SIPC, and Coinbase says its crime insurance covers only a portion of assets in its own storage and not losses from a breach of your personal login [4][5]. For a deeper look at hosted custody and insurance, read what happens to your ETH if your exchange fails.
When exchanges failed: what customers actually went through
These are court and law-enforcement records, not predictions about any exchange operating today. They show what “not your keys” can mean in practice: frozen withdrawals, years-long claims and, in the worst cases, customer funds that were never there.
Mt. Gox (2014 → still paying)
The bitcoin exchange applied for civil rehabilitation in Tokyo on February 28, 2014, went through bankruptcy and was put back into civil rehabilitation on June 22, 2018. On October 16, 2026 the trustee moved the repayment deadline again, from October 31, 2026 to October 31, 2027, because many creditors still have not been paid. [8][9]
Celsius (2022)
Celsius marketed itself as the “safest place for your crypto,” then halted withdrawals on June 12, 2022, when hundreds of thousands of customers had $4.7 billion in inaccessible assets. It filed for bankruptcy on July 13, 2022. Founder Alex Mashinsky was sentenced to 12 years on May 8, 2025. [7]
FTX (2022)
Federal prosecutors said founder Samuel Bankman-Fried misappropriated billions of dollars of customer funds deposited with FTX and had the exchange’s code altered so Alameda Research could withdraw effectively unlimited amounts. He was sentenced to 25 years on March 28, 2024. [6]
Bybit (2025)
On or about February 21, 2025, about $1.5 billion in virtual assets was stolen from the Bybit exchange. The FBI attributed the theft to North Korean “TraderTraitor” actors. A hack at a large venue is a risk no customer password can prevent. [10]
What a hardware wallet protects, and what it doesn’t
A hardware wallet keeps your private keys offline and signs transactions inside the device, so malware on your computer cannot read the keys [12]. It also shows the real receive address and transaction details on its own screen, which your computer cannot fake [18]. Your ETH stays on Ethereum the whole time; the device only holds the keys. ethereum.org puts the trade-off plainly: with a centralized exchange you trust the company with custody, and “if the exchange has financial trouble, your funds would be at risk” [11].
What it does not do is protect you from yourself. Anyone with your recovery phrase can take everything, and the device will sign whatever you approve. Ledger’s own incidents show how attacks reach hardware wallet users: the July 2020 e-commerce database breach exposed customers’ email and postal addresses and was followed by phishing, and the December 14, 2023 Connect Kit attack injected malicious code into apps that tricked users into signing draining transactions [23][24]. Neither required breaking the device; both relied on the user.
Official device prices (US, checked Oct 18, 2026)
| Device | Price | Notable |
|---|---|---|
| Ledger Nano S Plus | $69 | Buttons, USB [13] |
| Ledger Nano X | $99 | Buttons, Bluetooth [13] |
| Ledger Nano Gen5 | $179 | Touchscreen, Bluetooth, NFC [13] |
| Ledger Flex | $249 | Touchscreen, Bluetooth, NFC [13] |
| Ledger Stax | $399 | Curved touchscreen, wireless charging [13] |
| Trezor Safe 3 | $59 | Buttons, secure element [15] |
| Trezor Safe 5 | $129 | Color touchscreen, haptics [16] |
| Trezor Safe 7 | $249 | Color touchscreen, wireless [17] |
Prices before tax and shipping, from Ledger’s comparison page and Trezor’s product data. Optional extras: Ledger Recovery Key $39 (included with new touchscreen devices) and the identity-based Ledger Recover subscription at $99.99 a year [14]. Trezor devices support Multi-share Backup, which splits the backup into several shares so one stolen or lost share is not enough [20]. Which device fits you? See our Ledger vs Trezor review.
There is also a third route if you only want ETH’s price exposure: a spot Ethereum ETF in a brokerage account or IRA. You never hold keys, but you pay a yearly fee (0.14% to 2.50% across the 11 U.S. funds as of October 19, 2026) and cannot send or use the ETH. Compare the funds and run an ETF vs self-custody cost calculator in Spot Ethereum ETFs compared.
Which is right for you? A 60-second decision helper
Answer six quick questions. Nothing is stored or sent anywhere; the score is computed in your browser.
0 of 6 answered
Your recommendation appears after the last answer.
How it scores: each answer adds points toward self-custody (bigger balances, long holding, confidence with a recovery phrase, low tolerance for a freeze) or toward an exchange (small balances, frequent trading, low confidence with a phrase). −2 or lower suggests an exchange, +5 or higher a hardware wallet, anything between a split. It is a rule of thumb from the trade-offs on this page, not financial advice.
How to move ETH from an exchange to a hardware wallet safely
Ethereum transfers cannot be reversed, so the goal is to verify everything before the big transfer, not after. Budget 20–30 minutes the first time. Pick the Ethereum network on the exchange’s withdrawal screen; if a withdrawal already went out on another network, see what to do if you sent crypto to the wrong network.
- 1
Buy the device only from the maker
Order from shop.ledger.com or trezor.io (or an authorized reseller they list). Ledger warns about devices that arrive “pre-seeded” or with a pre-filled recovery sheet. If the box contains words already written down, do not use it. [22]
- 2
Set it up and write the phrase offline
Install the official app (Ledger Wallet, formerly Ledger Live, or Trezor Suite) from the maker’s site, never from a browser extension store. Write the recovery phrase on the paper card or a steel plate. Never photograph it, type it or store it in the cloud. [21][12]
- 3
Get your receive address and verify it on the device
Open your Ethereum account, choose Receive, and confirm the full address on the device’s own screen. Malware can change what your computer shows, but not what the device displays. [18]
- 4
Paste it into the exchange and check it again
Paste the address into the exchange’s withdrawal form and compare the first and last 6–8 characters against the device screen. Our address checker validates the format and checksum and can compare two addresses for look-alikes.
Open the address checker → - 5
Pick the right network
Ethereum and its layer-2 networks (Base, Arbitrum, Optimism) share the same address format. Withdraw on “Ethereum” unless you deliberately want an L2 and your wallet is set up to show it. The wrong network can cost you the funds. [19]
- 6
Send a small test amount first
Withdraw a small amount, wait until it appears in your wallet app, and check the transaction hash on a block explorer. Then send the rest to the same verified address. Check the gas tracker if you are paying the fee yourself. [19]
Check gas right now → - 7
Lock in the habits
Before connecting your wallet to any app, read what the device asks you to sign. Afterwards, scan for unlimited token approvals and revoke the ones you do not need.
Run the token approval checker →
Two free, read-only checks before and after your transfer: validate the receive address, then scan your new wallet for risky token approvals. No wallet connection needed.
Common mistakes and scams to avoid
Typing the recovery phrase into an app or website
Ledger says its support, and its Ledger Wallet app, will never ask for your 24 words. Fake “activate”, “firmware update” and “secure your account” pages exist only to collect them. [21][22]
Unsolicited calls from “Ledger”, “Coinbase” or police
Ledger says its employees never make unsolicited phone calls and describes fake police and Coincover callers who tell you to move funds. Hang up and contact the company from its official site. [22]
Fake exchange support on WhatsApp or Telegram
Scammers pose as exchange support and push you to send ETH to a “safe wallet.” See our fake exchange support and Coinbase scam call guides.
Clipboard swaps and address poisoning
Malware can replace a copied address, and attackers send dust from look-alike addresses so you copy the wrong one from history. Verify on the device screen every time. [18][22]
Second-hand or pre-configured devices
A device that someone else initialised, or that comes with a filled-in recovery sheet, may already be known to an attacker. Buy new from the maker and set it up yourself. [22]
Blind-signing a draining transaction
A hardware wallet signs what you approve. If a site asks for an unlimited approval or a Permit signature you do not understand, reject it. [24]
More on the support-impersonation playbook: fake exchange support scams, Coinbase support scam calls and address poisoning explained.
Frequently asked questions
Is it safe to keep my ETH on Coinbase or Kraken?
For small amounts and active trading, a large regulated exchange is a reasonable trade-off, but it is not risk-free. The exchange holds the keys, crypto is not FDIC or SIPC insured, and both Coinbase and Kraken note bankruptcy risk: Kraken’s October 6, 2026 terms say a court may disagree that customer assets are not its property, and Coinbase’s May 2022 10-Q said customers could be treated as general unsecured creditors. Keep only what you trade there.
Hardware wallet vs exchange: which is safer for ETH?
A hardware wallet removes the platform risks (hacks, frozen withdrawals, bankruptcy) because only you hold the keys. In return you take on the risk of losing or leaking your recovery phrase. For most long-term holders who can store a phrase safely, a hardware wallet is safer; for small balances and frequent traders, an exchange can be the more practical choice.
What happens to my ETH if my exchange goes bankrupt?
Withdrawals usually stop and your claim is decided in a court process that can take years. Celsius froze $4.7 billion of customer assets in June 2022, and Mt. Gox creditors from 2014 are still being repaid, with the deadline now October 31, 2027. Terms that say you keep title help, but they are not a guarantee of a full or fast recovery.
How much crypto should I have before buying a hardware wallet?
There is no official threshold. Compare the device price with what you hold: a $59–$69 entry device is about 12–14% of a $500 balance but under 1% of $10,000. If losing your exchange balance would really hurt, or you plan to hold for years, a hardware wallet is usually worth it.
What if my Ledger or Trezor breaks or gets lost?
Your ETH does not live on the device; it lives on Ethereum. Restore your recovery phrase on a new device and your accounts come back. That is why the phrase must be stored safely and separately from the device. Someone who finds a lost device still needs your PIN.
Can I stake ETH from a hardware wallet?
Yes. You can use liquid staking such as Lido or Rocket Pool from your own wallet and keep the staking token on the device. You avoid exchange custody and the 35% standard Coinbase commission, but you add smart-contract risk. Compare the options in our Lido vs Rocket Pool vs Coinbase guide.
Do I owe tax when I move ETH from an exchange to my hardware wallet?
Not in the United States, as long as both accounts are yours. The IRS virtual currency FAQ (Q38) says a transfer between wallets, addresses or accounts that belong to you is a non-taxable event, even if the exchange sends an information return. Keep your purchase records, because the exchange will no longer track cost basis for coins you withdraw.
Will Ledger, Trezor or my exchange ever ask for my recovery phrase?
No. Ledger states that Ledger Support and the Ledger Wallet app will never ask for your 24 words, and ethereum.org warns never to share a seed phrase with anyone. Any message, call, app or website that asks for it is a scam.
Should I move everything off the exchange?
Most holders do best with a split: long-term ETH on a hardware wallet and a small trading float on the exchange. Moving everything makes sense only if you rarely sell and are confident about guarding the phrase. Use the decision helper on this page to check where you land.
Sources
Every source was opened and checked on Oct 18, 2026. Terms and prices change; re-read the agreement that governs your own account before relying on a custody claim.
- [1] Coinbase — U.S. Individual User Agreement (last updated July 22, 2026)
- [2] Kraken — Global Terms of Service, “Custody and Title of Digital Assets” (last updated October 6, 2026)
- [3] Coinbase Global — Form 10-Q for Q1 2022, risk factors (SEC EDGAR, filed May 10, 2022)
- [4] Coinbase Help — How is Coinbase insured?
- [5] FDIC — Fact sheet: deposit insurance and crypto companies (July 28, 2022)
- [6] U.S. Attorney’s Office, S.D.N.Y. — Samuel Bankman-Fried sentenced to 25 years (March 28, 2024)
- [7] U.S. Attorney’s Office, S.D.N.Y. — Founder of Celsius sentenced to 12 years (May 8, 2025)
- [8] MtGox Rehabilitation Trustee — Notice concerning change of repayments deadline (October 16, 2026)
- [9] MtGox Civil Rehabilitation Trustee — Announcement of commencement of civil rehabilitation (June 22, 2018)
- [10] FBI / IC3 — PSA I-022625-PSA: North Korea responsible for $1.5 billion Bybit hack (February 26, 2025)
- [11] ethereum.org — Ethereum wallets (page updated February 24, 2026)
- [12] ethereum.org — Ethereum security and scam prevention (page updated June 6, 2026)
- [13] Ledger — Hardware wallet comparison (US prices checked Oct 18, 2026)
- [14] Ledger — Recovery solutions (Recovery Key $39; Ledger Recover $99.99/year)
- [15] Trezor — Trezor Safe 3 (USD price data $59, in stock, Oct 18, 2026)
- [16] Trezor — Trezor Safe 5 (USD price data $129, in stock, Oct 18, 2026)
- [17] Trezor — Trezor Safe 7 (USD price data $249, in stock, Oct 18, 2026)
- [18] Trezor — Trusted Display: verify every address on your device
- [19] Trezor — Choosing the right network when sending or receiving crypto (incl. test transactions)
- [20] Trezor — Multi-share Backup on Trezor
- [21] Ledger Support — Fraudulent Ledger Wallet (formerly Ledger Live) applications (updated Aug 28, 2026)
- [22] Ledger Support — Scams targeting crypto holders (updated Aug 28, 2026)
- [23] Ledger — Addressing the July 2020 e-commerce and marketing data breach
- [24] Ledger — Security incident report: Ledger Connect Kit (December 14, 2023)
- [25] Coinbase Help — Claim a decedent’s Coinbase account
- [26] IRS — Understanding your Form 1099-DA
- [27] IRS — Final regulations on broker reporting of digital asset sales (gross proceeds from 2025, basis from 2026)
- [28] IRS — Frequently asked questions on virtual currency transactions (Q38: transfers between your own wallets)
- [29] Coinbase Help — Pricing and fees disclosures (35% standard staking commission)
- [30] Lido — Protocol fee (10% of staking rewards)
Independent educational guide. GrowYourEthereum is not affiliated with Coinbase, Kraken, Ledger or Trezor, uses no referral or affiliate links on this page, and was not paid for it. Not financial, legal or tax advice. Exchange terms, device prices and legal outcomes change; the facts here were checked against the linked official pages and court records on Oct 18, 2026.