Wallets and Custody: Keeping What You Bought

There is a phrase in this industry — "not your keys, not your coins" — that gets repeated as dogma and understood by almost nobody. Here is what it actually means. When you buy Bitcoin on an exchange, you own a database entry saying the exchange owes you Bitcoin. When you hold it in a wallet you control, you own the cryptographic key that moves the coin itself. Both are real forms of ownership. They fail in completely different ways.

Exchange balances fail when the exchange fails, freezes, or decides your account needs a compliance review the week you need money. Self-custody fails when you lose the recovery phrase, get phished, or die without telling anyone where the backup is. Choosing between them is really choosing which failure mode you would rather be responsible for.

The three tiers of storage

Almost everyone ends up using more than one. The sensible structure looks less like a single choice and more like a bank account, a wallet in your pocket, and a safe.

Our rule of thumb for readers: keep on an exchange what you would keep in a checking account, keep in a hot wallet what you would carry in a physical wallet, and put everything else behind hardware. The dollar thresholds are personal, but the shape of the decision is not.

What "recovery phrase" really means

When you create a non-custodial wallet it generates twelve or twenty-four words. Those words are not a password — they are a mathematical seed from which every private key in that wallet is derived. Anyone with the words has the coins, from anywhere in the world, forever. Nobody without the words can help you, including the wallet's developers.

This has consequences that surprise people coming from a Wells Fargo or Fairwinds relationship. There is no fraud department. There is no reversal. If a phishing site captures your phrase, the theft is complete and final in seconds. If your house floods and the paper dissolves, the money is gone even though nobody stole it.

The Florida problem nobody writes about

Most custody advice on the internet was written by people in places where the worst thing that happens to a desk drawer is dust. Central Florida is not that place. Hurricane season runs 1 June to 30 November, Orange County sits far enough inland to avoid storm surge but nowhere near far enough to avoid wind, water intrusion and multi-day power loss, and roof failures in this metro are routine after a major system passes.

A paper recovery phrase in a bedside drawer is a single point of failure that a Category 3 can eliminate in an afternoon. So the storage plan for a Florida holder has to be different from the generic advice.

1. Use a medium that survives water

   At minimum, paper inside a sealed bag inside a fireproof, water-resistant document box. Better: a stamped or engraved metal seed plate, which costs around $30 and survives essentially anything short of a smelter.

2. Keep a second copy off your property

   A bank safe deposit box in Orlando works. A trusted relative's home in Ocala or Atlanta works better, because it is outside the same weather event. Two copies in one house is one copy.

3. Split the risk, not the phrase

   Resist the temptation to store half the words in two places unless you deeply understand what you are doing — people lock themselves out this way constantly. Full copies in separate secure locations is the safer pattern for most households.

4. Have a pre-storm routine

   When a named system enters the cone, the same trip that gets you water and batteries should confirm you know where both copies are. If you are evacuating, one copy travels with you.

5. Write the instructions down

   A sealed letter with your estate documents saying what exists and where — not the words themselves — means your family is not locked out permanently if something happens to you.

How wallet types compare

The scams that target wallets specifically

Custody attacks are different from investment scams, and the tell is always the same: somebody wants your recovery phrase or wants you to approve a transaction you did not initiate.

Fake support is the most common. You post a problem in a public forum or Discord and within minutes someone with an official-looking name messages you privately offering help, then asks you to "validate" your wallet by entering the phrase on a site. Real support never operates this way. Fake wallet apps are second — search results and even app stores occasionally carry cloned wallets that transmit your phrase on setup, so navigate to the developer's official domain instead of searching. Then there are clipboard hijackers, malware that silently replaces a copied crypto address with the attacker's; always verify the first and last four characters of an address after pasting. Finally, approval phishing: a site asks you to sign a transaction that grants unlimited spending permission on your tokens. Read what you are signing.

A practical setup for most Orlando readers

If you want a concrete plan rather than a menu: keep a verified account on one licensed exchange for buying, selling and small balances. Install one reputable mobile wallet and keep spending money there. When your holdings pass the point where losing them would genuinely hurt, buy a hardware wallet directly from the manufacturer, generate the phrase yourself, engrave or write two copies, store one at home in a sealed fireproof container and one outside the county. Test the restore process once with a trivial amount so you know it works. Then leave it alone.

That setup costs under $250 all in and eliminates the overwhelming majority of ways people lose crypto. It is also, notably, more security than most people apply to considerably larger amounts of money sitting in their brokerage accounts.

Frequently asked questions

Reviewed 21 August 2026 by the Orlando Crypto editorial team · Security guidance is general and not a substitute for professional advice on your own circumstances.