How to Store Crypto Safely: A Self-Custody Checklist for Beginners

Last updated: 2026-10-28

Short answer: To store crypto safely, decide what stays on an exchange and what moves to self-custody, set up a wallet from an official source, write the seed phrase down offline with two backups, and send a small test transaction before moving real money. Then secure your accounts with 2FA and review token approvals.

You bought your first coins. Cool. Now the boring question nobody films a TikTok about: where do they actually live, and who can take them away from you?

Most beginners lose money not on a bad trade, but on a bad setup: a seed phrase in a Notes app, a "support agent" in their DMs, a wrong network on a withdrawal. This article is the checklist I wish I had on day one. No price predictions, no "next 100x". Just a process you can run once, properly, and then stop worrying about.

Risk note: This is educational content, not financial advice. Crypto is volatile and you can lose money, including through mistakes you can't reverse.

Custodial or self-custody: which should you choose?

When your coins sit on an exchange, the exchange holds the keys. You hold a login. That's custodial storage. It's convenient, and for small amounts you trade often it can be reasonable, but you depend on the platform's security, solvency and rules (including account freezes and withdrawal limits).

Self-custody means you hold the private keys yourself, usually through a seed phrase (12 or 24 words) that can regenerate your wallet. Nobody can freeze it. Nobody can recover it for you either.

A simple rule of thumb:

• Money you trade this week → can stay on a reputable exchange, with strong account security.
• Money you plan to hold for months → consider moving it to self-custody.

There's no shame in using both. The mistake is not deciding at all.

Step 1: Pick your wallet type

Software (hot) wallet

An app on your phone or a browser extension. Free, fast, good for learning and small amounts. The risk: it lives on a device that is online and full of other apps.

Hardware (cold) wallet

A small device that keeps keys offline and signs transactions inside the device. It costs money, but it removes a whole class of attacks (malware stealing keys from your laptop).

What to check before buying a hardware wallet

• Buy only from the manufacturer's official store or an authorised reseller listed on the official site. Not a marketplace "deal".
• The package should never come with a pre-filled seed phrase. If there is a card with words already written on it — that wallet is compromised. Don't use it.
• Check that the wallet supports the networks you actually use.

Step 2: Set up the wallet the right way

Do this in a quiet place, with no screen recording, no cameras pointed at your desk, and no rush.

1. Download the wallet app only from the official website or the official app store listing. Type the URL yourself; don't click ads.
2. Create a new wallet. The device or app will generate the seed phrase.
3. Write the words down on paper (or a metal backup plate) in the exact order, with numbers.
4. Confirm the phrase when the app asks you to.
5. Set a strong PIN on the device or app.

The seed phrase rules (non-negotiable)

• Never type it into a website, chat, form or "wallet validator".
• Never photograph it, never store it in cloud notes, email drafts or a password-protected PDF on your laptop.
• Nobody legit will ever ask for it. Not support, not an exchange, not "HASH from Phoebus Lab".

If someone has your seed phrase, they have your coins. Full stop.

Step 3: Back up for real life, not for a perfect world

Paper burns, floods happen, people move flats. Think about failure scenarios:

Two copies in two different secure places is a sensible starting point for most beginners.

Step 4: Do a test transaction before moving real money

This is where people skip steps and cry later.

1. Copy your wallet's receive address.
2. From the exchange, send a small test amount.
3. Double-check the network (for example, the same token can exist on several blockchains — the sending and receiving network must match).
4. Wait for it to arrive. Check it in the wallet.
5. Only then send the rest.

Illustrative example

Say you want to move the equivalent of €500. You first send €10 as a test. The network fee is, say, €1 (illustrative — fees vary a lot by network and time). You "waste" about €1 on the test, and in exchange you confirm the address and network work. Compare that with the risk of sending €500 to the wrong network. That's the trade-off.

Also: after pasting an address, compare the first and last 4–6 characters with the original. Some malware swaps addresses in your clipboard.

Step 5: Lock down everything around the wallet

Your wallet is only as safe as the accounts around it.

• Exchange accounts: use an authenticator app for 2FA rather than SMS where the platform allows it. Turn on withdrawal address whitelisting if available.
• Email: the email linked to your exchange needs its own strong, unique password and 2FA. It's the master key to password resets.
• Password manager: use one. Unique password per site.
• Devices: keep your OS and wallet app updated. Don't install random "airdrop claim" tools.

Step 6: Which crypto scams should you recognise?

Most theft is social engineering, not hacking. Red flags:

• Someone in your DMs offering "support" after you posted a question in a public chat.
• A site asking you to "connect wallet to validate" or "sync" it.
• An airdrop that requires you to sign an unclear transaction.
• Anyone promising guaranteed returns or "doubling" your coins.
• Pressure: "do it in 10 minutes or you lose access".

Token approvals

When you use decentralised apps, you often give a smart contract permission to spend your tokens. Unlimited approvals left open on apps you no longer use are a risk. Periodically review and revoke approvals you don't need using a reputable approval-checker tool for your network.

Your one-page self-custody checklist

• Decided what stays on an exchange and what goes to self-custody
• Wallet bought/downloaded from official source only
• Seed phrase written offline, in order, never digital
• Two backups in two places
• PIN set; device and app updated
• Test transaction sent and received; network checked
• 2FA via authenticator on exchange and email
• Unused token approvals reviewed

Print it. Tick it. Done.

Where to go from here

Storage is step zero. The Phoebus Lab Crypto course on wallet security and risk management starts from the same place: a vault and a separate work wallet, then risk management and security, testnet farming, and record-keeping with taxes. It is education, not a promise of profit, and it is not a trading course.

Related reading: Dollar-Cost Averaging Crypto: Build a DCA Plan and a Tracking Spreadsheet · Wallet, seed, 2FA: the loop that must exist before any farm

— HASH