Custodial or non-custodial wallet: where to withdraw your crypto from an exchange in 2027

What is a custodial wallet? A plain-English explanation

A custodial wallet (from "custody", meaning safekeeping or guardianship) is an account where someone else holds the keys to your coins: an exchange, an app or a service. You see a balance and tap "Withdraw", but the coins themselves sit at the company's addresses, and the company makes the transfer — whenever it sees fit.

Typical examples are an account on a crypto exchange (Binance, Bybit, OKX, Bitget, Coinbase) and Wallet in Telegram, the @wallet bot. You log in with a username and password, and if you lose access, support helps you after verifying your identity.

What is a non-custodial wallet?

A non-custodial wallet (also known as self-custody) is an app or device where the private key is generated and stored on your side. The key's backup is a 12- or 24-word seed phrase. Nobody except whoever holds that phrase can move the coins or freeze the wallet.

The flip side: without the seed phrase, access can't be restored. There's no support team to reset your password: lose the phrase, lose the coins. So decide in advance how to store your seed phrase so it isn't stolen or lost.

Examples: Trust Wallet, MetaMask, Exodus, Keeper (formerly Tonkeeper), Cake Wallet, and the Ledger and Trezor hardware wallets.

Not your keys, not your coins: what it means

This saying is crypto's number one rule. Whoever holds the private key controls the coins. A balance on an exchange is the exchange's promise to give you coins, not the coins themselves. While everything is calm, you can't see the difference. It becomes obvious the day the exchange closes withdrawals.

Key differences between custodial and non-custodial wallets

One caveat: stablecoin issuers can block an address holding USDT or USDC even in a personal wallet. Tether does this with addresses linked to thefts and sanctions.

What happens when a crypto exchange won't let you withdraw

• Bitget, September 24, 2026. According to the exchange's CEO, an attacker hacked the internal wallet system, spoofed transaction data and drained $387.5 million from hot and "warm" wallets. Cold wallets weren't affected, and trading and deposits are working, but withdrawals are closed — they reopen coin by coin from September 28 to October 2. The loss is covered by a $464 million user protection fund.
• Blink, September 19, 2026. An attacker drained a few dozen custodial accounts at the Lightning wallet Blink, and the service went down for several hours. Non-custodial accounts weren't affected, and the victims were promised a full refund.
• Bybit, February 21, 2025. About $1.46 billion was stolen straight from a cold wallet holding ether: the signers approved a spoofed transaction. The FBI attributed the attack to a North Korean hacking group. The exchange covered the loss itself.
• WazirX, July 2024. After a $234.9 million hack, withdrawals stayed frozen for about 15 months, and customers ultimately received about 85% of the value of their claims.
• FTX, November 2022. Withdrawals were halted on November 8, and three days later came bankruptcy with an $8 billion hole. Claims were valued in dollars as of the bankruptcy date, when bitcoin was worth $16,871 — so customers got none of the price growth that followed.
• Mt. Gox, 2014. The largest exchange of its time lost about 850,000 BTC. Repayments to creditors only began in 2024, ten years later, and have been extended to October 31, 2026.

The bottom line: even when an exchange honestly covers the loss, your money is out of reach for days, months and sometimes years. With your own wallet, that scenario simply doesn't exist. And to swap one coin for another, you don't need to keep it on an exchange: an instant crypto exchange works without an account and sends the coins straight to your wallet.

Are non-custodial wallets safe? The risks of self-custody

An honest look at the downsides, so you don't trade one set of problems for another:

• Losing your seed phrase. No phrase, no money — and nobody can get it back.
• Fake support. In January 2026, one person lost about $282 million by handing their seed phrase to a scammer posing as Trezor support. Real support never asks for your seed phrase.
• Address poisoning. A scammer sends you a tiny transfer from an address that looks like yours. Copy the address from your history, and you'll send your money to them. In December 2025, $50 million in USDT was lost this way.
• Fake apps. In April 2026, Kaspersky found 26 fake crypto wallet apps on the App Store that stole seed phrases.
• Device bugs. Starting July 30, 2026, attackers drained Coldcard wallets: because of a bug in 2021 firmware, seed phrases generated on some devices turned out to be predictable. TRM Labs puts the damage at about $116 million.

Simple habits protect you from all of these risks: your seed phrase on paper and offline, apps only from official websites, and the address always from your wallet, not from your transfer history.

Which crypto wallets are custodial and which are non-custodial

In hybrid, or MPC, wallets the private key is split into parts, and signing takes two of the three. There's no seed phrase and recovering access is easier, but the company keeps one part. It's a trade-off between convenience and full control.

Hot wallet vs cold wallet: what's the difference?

A hot wallet is an app on your phone or computer that's connected to the internet. It's convenient for everyday payments and transfers.

A cold wallet is a hardware device or another way of keeping the key offline. Transactions are signed inside the device, so malware on your computer can't steal the key.

A handy setup: savings on a cold wallet, spending money in an app, and on the exchange only what you're trading right now.

How to choose a non-custodial wallet

• Match your coins. For USDT on TRON, Trust Wallet or TronLink will do; for Monero, the privacy coin, Cake Wallet or Feather; for bitcoin, any major wallet or a hardware one.
• Match the amount. A hardware wallet for large savings, an app for everyday transfers.
• Open source and reputation. The longer a wallet has been on the market and the more transparent its code, the better.
• Official website only. Get the app link from the wallet's own website, not from search results, ads or chats.

How to move crypto from an exchange to your wallet: step by step

1. Install the wallet from its official website and write the seed phrase down on paper — before any money arrives.
2. In the wallet, open "Receive", choose the coin and network, and copy the address. On a hardware wallet, check the address on the device's screen.
3. On the exchange, open "Withdraw", pick the same coin and the same network as in the wallet, and paste the address. Choose a compatible network, not the cheapest one: a network mistake can cost you the whole amount.
4. If you're withdrawing to another exchange rather than to your own wallet, enter the memo or tag whenever it's required. Details in our guide to memo and Destination Tag.
5. Turn on the address whitelist on the exchange: you can set a delay so that withdrawals to a new address only become possible after 24–72 hours. It protects you in case of an account takeover.
6. Confirm the withdrawal with two-factor authentication.
7. Send a small amount first and wait for it to arrive in your wallet. For the second transfer, copy the address from the wallet again, not from your transaction history.
8. Wait for confirmations: bitcoin produces a block every 10 minutes on average, and people usually wait for 6 confirmations; on Monero, funds become available after about 20 minutes.

Not sure which network to use for USDT? See our comparison of USDT on TRC20, ERC20, BEP20, Solana and TON.

Bitget reopens withdrawals: what to do from September 28 to October 2

• Set up your wallet in advance — before your coin reopens.
• Withdraw to your own address and start with a small amount.
• Only use links from the exchange's official website and app. Every hack is followed by fake "support teams", and no real employee will ever ask for your seed phrase.

For the full schedule, see Bitget withdrawals reopen on September 28.

How to store your seed phrase safely

• On paper or a metal plate, in two different places. Not in photos, notes, the cloud or a messaging app.
• Never show it to anyone or type it in anywhere: a wallet only asks for it during recovery.
• For large amounts, add a passphrase — a "25th word" without which the seed phrase is useless to a thief.
• Generate the seed phrase yourself, on your own device. Never use a "ready-made" phrase — whether it came in the box or was sent by "helpers".

Exchange, wallet or swap service: what each one is for

You don't always need an exchange. To swap one coin for another, you don't need an account with a balance. With VertEXchange you swap without signing up: you enter your wallet address, and the coin arrives right there, not on someone else's balance. For example, you can exchange BTC to USDT on TRC20 and receive the stablecoin straight into your TronLink or Trust Wallet.

Frequently asked questions

Is it safe to keep crypto on an exchange?

Not entirely. An exchange keeps thousands of customers' coins in one place, which makes it hackers' main target: more than $3.4 billion in crypto was stolen in 2025, and 44% of that was a single hack of the Bybit exchange. Besides hacks, an exchange can close withdrawals, freeze your account or go bankrupt — and in all three cases, your coins are out of your reach.

Is Telegram Wallet custodial?

Wallet in Telegram (the @wallet bot) is custodial: the company holds the keys, and you need to verify your identity to use it. The DeFi Account in the same app, formerly called TON Space, is non-custodial: you hold the seed phrase. And since August 31, 2026, Telegram has also been rolling out Gram Wallet right inside the app — non-custodial as well.

Is Trust Wallet custodial? What about MetaMask?

No, both are non-custodial: the keys are stored on your device, and the company can neither freeze your wallet nor recover your seed phrase.

What happens if a crypto exchange gets hacked?

It depends on the exchange. Big ones cover the loss from their own funds — as Bybit and Bitget did — but still close withdrawals for days. If the money isn't enough, as with FTX or Mt. Gox, customers become creditors and wait years for payouts.

What should I do if an exchange suspends withdrawals?

Follow only the exchange's official website and channels, and save screenshots of your balance. Never pay for "unlocking" or a "fast withdrawal" — that's always a scam. Once withdrawals reopen, move your coins to your own wallet, starting with a small amount.

Can I recover a non-custodial wallet without the seed phrase?

No. The seed phrase is the only backup of your key. The exceptions are hybrid wallets with a cloud backup of key shares, such as Binance Wallet, and paid services like Ledger Recover.

Is a hardware wallet safe?

It's the most reliable way to store savings, but not a foolproof one: the Coldcard case showed that a firmware bug can make a seed phrase guessable. Buy the device from the manufacturer, keep the firmware updated, and if in doubt, create a new seed phrase.

What is Proof of Reserves, and can you trust it?

It's a check that an exchange holds at least as many coins at its addresses as its customers have on their balances. But it's a snapshot of a single date: it doesn't show the exchange's debts and doesn't protect against hacks. Bitget published a report showing 135% coverage a week before it was hacked.

Can Tether freeze my USDT?

Yes. Your wallet itself can't, but the issuing company can: Tether blocks addresses linked to thefts and sanctions, even in non-custodial wallets. As of late July 2026, its blacklist held about 9,600 addresses.