Crypto Custody & Security for Australians: Exchange vs Hot Wallet vs Cold Storage

The short answer

How you store crypto matters as much as what you buy. The best portfolio in the world is worth nothing if you lose access to it, and in crypto there's usually no helpline, no chargeback, and no password reset. Custody sits on a spectrum from most convenient to most secure:

• Exchange custody, your crypto stays on a platform like an Australian exchange. Easiest to use, but the exchange controls the keys, so you're trusting it not to fail, freeze, or get hacked.
• Hot wallet, a self-custody wallet (app or browser extension) where you hold the keys, but the wallet is connected to the internet. More control, more exposure.
• Cold storage, a hardware wallet or other offline setup where your keys never touch an internet-connected device. Most secure, least convenient.

The right answer isn't "always cold storage." It's matching your security to your situation: how much you hold, how often you transact, and how much complexity you can realistically manage without making a mistake. A $500 starter position and a $500,000 portfolio call for very different setups.

Important: This is general educational information, not personal financial or security advice. Crypto security mistakes are usually irreversible, so when in doubt, move slowly and verify.

---

The custody spectrum, explained

Exchange custody

When you buy crypto on an exchange and leave it there, the exchange holds the private keys. You have an account balance, a promise, rather than direct control of the coins on-chain. This is custodial storage.

The appeal is obvious: it's simple, you can trade instantly, and if you forget your password you can reset it. For a beginner with a small balance, an AUSTRAC-registered Australian exchange is a perfectly reasonable place to start.

The risk is equally real. You're trusting the platform's solvency and security. History is littered with exchanges that were hacked, mismanaged, or collapsed, taking customer funds with them. The crypto adage "not your keys, not your coins" captures it: if you don't control the keys, you don't fully control the asset. You're a creditor of the exchange, and if it fails, you join the queue.

Hot wallets

A hot wallet is self-custody, you hold the keys, but it lives on an internet-connected device: a mobile app, a desktop program, or a browser extension. You control your crypto directly on-chain, and you can interact with decentralised apps, DeFi, and on-chain markets.

The trade-off is exposure. Because the wallet is online, it's reachable by malware, phishing sites, malicious transaction approvals, and fake apps. Hot wallets are excellent for smaller, "spending" amounts and active on-chain activity, think of one as the cash in your pocket, not your life savings.

Cold storage

Cold storage keeps your private keys offline, most commonly on a dedicated hardware wallet. To move funds, you physically confirm the transaction on the device, so even if your computer is compromised, your keys are never exposed to it. This is the gold standard for holding meaningful amounts long-term.

The downsides are friction and responsibility. Hardware wallets cost money, add steps to every transaction, and put the full weight of backup and recovery on you. Lose the device and the backup, and the crypto is gone. Cold storage is the safe in the wall, not the wallet you carry.

---

"Not your keys, not your coins", and the balance it ignores

The phrase is true, but it's often weaponised into "always self-custody everything," which is its own kind of bad advice. Self-custody transfers risk; it doesn't eliminate it. On an exchange, the main risk is the platform. In self-custody, the main risk is you, your backups, your discipline, your ability to avoid a single catastrophic mistake.

Plenty of people have lost more crypto to their own errors, lost seed phrases, mistyped addresses, approved scams, than they ever would have to a reputable exchange. The mature position isn't tribal. It's: use custodial convenience for small, active balances where ease matters, and use self-custody (ideally cold) for the long-term core you can't afford to lose. The bigger the stake, the more the balance should tilt toward keys you control offline.

---

How much security do you actually need?

Security is a function of what you're protecting and how you behave. Use this rough framework rather than a one-size rule.

Small balance, just starting (say, under a few thousand dollars). A reputable AUSTRAC-registered exchange with strong account security (covered below) is reasonable. The convenience-to-risk trade-off is acceptable while you learn, provided you're not leaving life-changing sums there.

Growing portfolio, occasional transactions (mid-size). This is the point to get a hardware wallet for your core holdings and keep only a working balance on the exchange or in a hot wallet. The cost of a device is trivial against what you're protecting.

Large portfolio, long-term holder (significant sums). Serious cold storage, carefully backed up, with genuine thought given to redundancy and inheritance. At this level, consider a multi-signature setup (where more than one key is required to move funds, so no single point of failure can drain you) and professional guidance. The threat model changes: you're now a target.

Active on-chain user / DeFi. Separate wallets for separate purposes, a "vault" cold wallet that rarely transacts, and a smaller hot wallet for day-to-day on-chain activity. Never connect your main holdings to unfamiliar apps.

The principle: the amount you can't afford to lose belongs offline, and the amount you transact with belongs somewhere convenient, and those should be different wallets.

---

The seed phrase is the whole game

Almost every self-custody wallet boils down to one thing: a seed phrase (also called a recovery phrase), typically 12 or 24 words generated when you set up the wallet. That phrase is your crypto. Anyone who has it can take everything; if you lose it with no backup, everything is gone. The hardware device, the app, the password, all replaceable. The seed phrase is not.

So the single most important security task is protecting that phrase:

• Write it on paper or steel, never digitally. Don't photograph it, don't store it in cloud notes, email, or a password manager, and don't type it into anything except your wallet during a genuine recovery. A screenshot in your camera roll is a screenshot a hacker can find.
• Store backups in more than one secure physical location. A single copy can be lost to fire, flood, or theft. Two or three geographically separated copies protect against that.
• Consider a metal backup for fire and water resistance if you hold meaningful amounts.
• Never share it with anyone. No legitimate exchange, wallet provider, support agent, or "recovery service" will ever need your seed phrase. Anyone asking for it is stealing from you. Full stop.

If you take nothing else from this article, take this: guard the seed phrase obsessively, and never, ever enter it anywhere online.

---

The threats that actually drain wallets

Australians reported over $2.18 billion in scam losses in 2025, and crypto sits at the centre of many of them. Understanding how funds are actually stolen lets you defend the right things. The biggest threats are rarely sophisticated "hacks", they're tricks that get you to hand over access.

• Phishing. Fake websites, emails, and ads that imitate real exchanges or wallets to harvest your login, or trick you into entering your seed phrase. Crypto impersonation scams helped drive $19.5 million in phishing losses in 2025 alone. Always reach your exchange or wallet by typing the address yourself or using a saved bookmark, never a link from an email, ad, or search result.
• Fake wallet and exchange apps. Malicious apps in app stores and fake browser extensions that look identical to the real thing and steal whatever you enter. Download only from official sources, and verify the developer.
• SIM-swap attacks. Criminals hijack your phone number to intercept SMS codes and reset your accounts. This is why SMS-based two-factor is weak, use an authenticator app or hardware key instead.
• Malicious transaction approvals. In DeFi, connecting your wallet to a scam site and approving a transaction can grant it permission to drain your tokens. Read what you're signing, and regularly review and revoke token approvals.
• Address poisoning and clipboard malware. Scams that get you to send funds to a lookalike address, or malware that swaps the address you copied. Always verify the first and last characters of any address before sending, and send a tiny test amount first for large transfers.
• "Recovery" scams. After a loss, fraudsters posing as recovery agents promise to get your money back, for a fee, and steal again. No one can reverse a blockchain transaction. Treat every recovery offer as a second scam.
• Crypto ATM scams. AUSTRAC found crypto ATMs in Australia ballooned from 23 in 2019 to over 1,800 in 2025, with a large share of the roughly $275 million flowing through them suspected to be scam-related. Regulators have since imposed a $5,000 cash cap and mandatory scam warnings. If anyone instructs you to deposit cash into a crypto ATM, it is a scam.

Notice the pattern: most losses come from social engineering, not code-breaking. The defence is procedural, slow down, verify independently, and never act on urgency or unsolicited contact.

---

Setting it up properly

Whether you're on an exchange or running cold storage, these habits do most of the work:

On exchanges:

• Use a long, unique password stored in a reputable password manager, never reused from another site.
• Turn on app-based or hardware two-factor authentication, not SMS.
• Add a withdrawal address allowlist if the exchange offers it, so funds can only be sent to addresses you've pre-approved.
• Be alert to anti-phishing features (some exchanges let you set a code that appears in their genuine emails).
• Don't keep more on the exchange than you're willing to lose to a platform failure.

For self-custody:

• Buy hardware wallets directly from the manufacturer, never second-hand or from a marketplace reseller, tampered devices are a known attack.
• Generate the seed phrase on the device itself, and confirm it was never pre-printed or pre-filled (a real device never comes with a seed phrase in the box).
• Back up the seed phrase to physical media, in multiple secure locations, before moving any meaningful funds.
• Test recovery with a small amount before trusting the setup with the bulk of your holdings.
• Keep a small hot wallet separate from your cold "vault," and never connect the vault to unfamiliar dApps.

---

Choosing an exchange in Australia

If you're using an exchange, and most Australians sensibly do, at least for buying and selling, choose one operating inside the regulated perimeter:

• AUSTRAC registration. Legitimate Australian crypto exchanges are registered with AUSTRAC as digital currency exchange providers and perform identity checks. A platform that lets you trade significant sums with no identity verification is a serious red flag, not a convenience.
• The new licensing regime. Under Australia's Digital Assets Framework, exchanges are being brought further into the financial system and required to hold an Australian Financial Services Licence from ASIC. This raises the baseline of accountability, favour platforms moving with it, not against it.
• Track record and transparency. Look for an established operating history, clear information about how customer assets are held, and any independent proof-of-reserves or audit disclosures.
• Security features. The presence of withdrawal allowlists, strong two-factor options, and anti-phishing tools signals a platform that takes custody seriously.

Convenience is fine for the working portion of your portfolio. Just don't confuse "easy to use" with "safe to store everything on indefinitely."

---

The part almost everyone forgets: access after you're gone

A security setup good enough to keep hackers out is, by design, good enough to keep your family out too. If you're hit by a bus tomorrow, can anyone you trust actually access your crypto? For most self-custody holders, the honest answer is no, and a meaningful share of all the Bitcoin ever mined is now considered permanently lost, much of it because holders died or lost access with no way to recover it.

This is the tension at the heart of crypto custody: the same offline, single-point control that protects you also makes inheritance hard. Solving it requires deliberate planning, secure, retrievable instructions for a trusted person or executor, separated so that no single document both reveals and unlocks everything. It's important enough to deserve its own treatment, but flag it now: build your inheritance plan at the same time as your security setup, not years later.

---

Common custody mistakes

• Leaving everything on an exchange because it's convenient, then learning what counterparty risk means the hard way.
• Storing the seed phrase digitally, a photo, a note, a cloud file, turning the one unrecoverable secret into a hackable one.
• A single backup of the seed phrase, vulnerable to fire, flood, or loss.
• Using SMS two-factor, leaving accounts open to SIM-swap attacks.
• Clicking links to reach exchanges and wallets instead of typing or bookmarking them.
• Connecting the main wallet to unknown apps and approving transactions without reading them.
• Buying hardware wallets second-hand or from resellers.
• No inheritance plan, so security becomes a tomb.
• Over-engineering, building a setup so complex you can't reliably use or recover it, which is its own risk.

---

Frequently asked questions

Is it safe to keep my crypto on an Australian exchange? For smaller, actively traded amounts, a reputable AUSTRAC-registered exchange with strong account security is reasonable. The risk is that the exchange controls your keys, so a failure or hack can affect your funds. For long-term holdings or significant sums, moving the core to self-custody, ideally a hardware wallet, reduces your exposure to any single platform.

What's the difference between a hot wallet and cold storage? A hot wallet is a self-custody wallet connected to the internet (a phone app or browser extension), convenient but more exposed to online threats. Cold storage keeps your private keys offline, usually on a hardware wallet, so they're never exposed to an internet-connected device. Hot wallets suit small, active balances; cold storage suits long-term holdings.

What is a seed phrase and why does it matter so much? A seed phrase is the list of words (usually 12 or 24) that backs up your self-custody wallet. It is effectively your crypto: anyone who has it can take your funds, and if you lose it with no backup, your funds are unrecoverable. Write it on paper or steel, store multiple copies in secure locations, and never store it digitally or share it with anyone.

Should I use a hardware wallet? If you hold more than a small amount, yes. A hardware wallet keeps your keys offline so that even a compromised computer can't drain your funds, and the cost is trivial against what it protects. Buy it directly from the manufacturer, set it up yourself, back up the seed phrase before funding it, and test recovery with a small amount first.

How do I avoid getting my crypto stolen? Most theft comes from social engineering, not hacking. Reach exchanges and wallets only via typed addresses or bookmarks, never links; use app-based or hardware two-factor instead of SMS; never enter your seed phrase anywhere online; verify addresses before sending and use a test transaction for large transfers; and treat any unsolicited contact, urgent demand, or "recovery service" as a scam.

How do I know if an Australian crypto exchange is legitimate? Check that it's registered with AUSTRAC as a digital currency exchange provider, performs identity verification, and is moving toward the new ASIC licensing requirements. Look for an established track record, transparency about how customer assets are held, and strong security features. A platform that lets you trade large sums with no identity checks is a warning sign.

What happens to my crypto if I die? Without a plan, it may be lost forever, your family generally can't recover self-custodied crypto without the keys or seed phrase. Because the same security that protects you also locks others out, you need deliberate inheritance planning: secure, retrievable access instructions for a trusted person or executor, ideally arranged so no single document both reveals and unlocks your holdings.