Keep Your Assets on an Exchange, or Self-Custody Them? A Beginner's First On-Chain Decision

If the asset amount isn't large (say, just a few hundred dollars), is it still worth spending time learning self-custody?

This depends on your actual priority between convenience and control, not simply the size of the amount. When the amount is small, even if an exchange risk event causes a loss, the actual financial impact is relatively limited, and in this case, investing time into learning skills like hardware wallet operation and properly storing a private key backup may offer a lower return than spending that same time learning other more foundational knowledge (like reading the various on-chain indicators covered earlier on this site).

But if your consideration isn't just the size of the financial impact, but wanting to build the self-custody habit you'll need long-term early on (since this skill becomes more important as your asset amount grows), then starting to practice early is a reasonable choice even with a small amount now — practicing the self-custody process with a smaller-value asset is itself a relatively low-risk way to learn, so by the time you genuinely need to store a larger amount, you'll have already built up real hands-on experience, rather than learning on the fly in a higher-stakes situation.

Self-custody hardware wallets can also have vulnerabilities (like the Coldcard incident) — does that mean self-custody isn't actually safer than an exchange?

This is a question worth confronting honestly, and the answer isn't a simple "safer" or "less safe" — the nature of the risk is different. Exchange risk is concentrated: once an exchange runs into trouble, every user's assets held at that exchange can potentially be affected simultaneously. Hardware wallet vulnerability risk is relatively distributed: unless you happen to be using the specific affected model, other users aren't dragged in by that vulnerability — the blast radius is generally confined to a specific product line.

But this doesn't mean self-custody carries zero systemic risk at all — this site's Coldcard incident news piece also noted that a supply-chain-level technical risk (a firmware flaw that could lie dormant for years before discovery) is equally real. A more accurate way to put it: self-custody exposes you to a specific vendor's technical risk, while exchange custody exposes you to a specific institution's operational risk — neither risk is zero, and the difference lies in where the risk comes from and how far its impact reaches. This is also why diversification (part on an exchange, part in self-custody, even spread across different hardware wallet vendors) is often regarded as a reasonable way to lower the impact of any single risk source.

If you've decided to self-custody, how should you choose between a software wallet and a hardware wallet? What's the trade-off?

A software wallet (an app installed on your phone or computer) has the advantage of a low entry barrier, convenient operation, and is generally free — suited to smaller amounts and situations requiring frequent interaction (like regularly participating in DeFi applications); the drawback is that the private key is stored on an internet-connected device, and if that device gets compromised by malware, the private key carries a risk of theft, making security relatively lower.

A hardware wallet (a standalone physical device, where the private key stays stored on the device and only needs to connect when signing a transaction) has the advantage that the private key never gets directly exposed to an internet-connected environment — it stays relatively safe even if your computer gets infected — suited to larger amounts, infrequent trading, primarily long-term holding; the drawback is needing to purchase an additional device (generally at some cost), a relatively more cumbersome operating process, and as shown by the Coldcard incident, the hardware itself can also carry a firmware-level vulnerability. In practice, many users adopt a tiered strategy: a software wallet for everyday small-value interactions, moving larger long-term holdings to a hardware wallet, choosing the appropriate storage method based on each asset's purpose and amount.

If someone chooses self-custody, what's the most common beginner mistake, and how can it be avoided?

The most common and most serious beginner mistake is improperly backing up a private key or recovery phrase — such as only taking a photo saved on your phone (easily exposed if the device is lost or hacked), or only writing it on a single piece of paper kept somewhere easily found or destroyed (a fire or flood could cause an irrecoverable loss). Once a private key or recovery phrase is lost or exposed, as this site noted earlier, no customer support can help you recover the asset — a completely different situation from an exchange account where you can appeal to recover a forgotten password, and beginners often underestimate this difference.

A more robust backup practice is using a physical backup (like a metal recovery-phrase storage tool that can withstand fire and water damage) and storing it across at least two different physical locations, avoiding a single incident (a house fire, a burglary) causing a total loss of the backup. Another common mistake is transferring a large amount of assets all at once into a newly set-up self-custody wallet before you're familiar with the process — a more robust workflow is first testing a small transfer in and out to confirm everything runs smoothly, fully understanding the steps involved, and only then gradually moving larger amounts, avoiding an irrecoverable loss caused by an operational error (like a mistyped address).