Lesson 9.3 · 3 of 5 · Crypto without illusions
Where to keep crypto: exchange or wallet, private keys and FTX
On an exchange, the company holds your crypto for you; in your own wallet, you control it through the private key and the recovery phrase. On an exchange you risk the firm going bust or committing fraud, as at FTX in November 2022. In your own wallet you risk losing the keys, and then nobody can give your coins back.
Terms in this lesson
- Private key
- The secret code that proves the coins are yours. Whoever has it can move them.
- Crypto wallet
- The app or device that holds the keys you use to control your coins.
- Crypto exchange
- The website or app where you buy and sell crypto with dollars, euros or other currencies.
Custody: on an exchange or in your own wallet
On an exchangethe firm holds the keys
- Easy: an account, a password, recovery through the firm
- You buy and sell directly with ordinary money
- If the firm goes bust or steals, you can lose everything
- The firm can freeze withdrawals
Your own walletyou hold the keys
- No firm can freeze or lose your coins
- The wallet provider does not have custody of your funds
- Lose the keys and the coins are gone for good
- Mistakes and thefts are yours alone to deal with
Definition
What are a private key and a recovery phrase?
The private key lets you move the coins. The recovery phrase is a list of 12-24 words from which the wallet can be rebuilt.
The standard most wallets use (BIP39) turns the keys into a list of 12, 15, 18, 21 or 24 words that are easy to write down. Ethereum.org says the phrase is the only way to recover your wallet, so write it down somewhere safe and do not keep it on a computer. Whoever has the phrase has the coins. The European supervisors warn that losing private keys means a permanent and irreversible loss of access.
The rest of this lesson is in the subscription
The subscription unlocks every chapter of Intermediate, Trading school, Investor psychology and Advanced, with their exercises and unlimited reviews.
Create a free accountExchange risk: the collapse of FTX in November 2022
The real case
FTX: $8 billion of customers’ money
FTX was a crypto trading platform. On 11 November 2022 it filed for bankruptcy. Its founder, Sam Bankman-Fried, was found guilty on 2 November 2023 of charges including wire fraud and conspiracy to commit wire fraud. The US Department of Justice says he stole more than $8 billion of his customers’ money. On 28 March 2024 he was sentenced to 25 years in prison and ordered to pay $11 billion in forfeiture.
Customers did get much of their money back, but not in crypto. The bankruptcy plan approved on 7 October 2024 says 98% of creditors, by number, receive about 119% of their allowed claim. But each claim is set in dollars, at its value on the day of the bankruptcy, 11 November 2022, when prices were very low.
Crypto rules in the UK and the EU: FCA, MiCA and the ESMA register
- MiCA authorisationSince 30 December 2024, firms offering crypto services in the EU have needed a MiCA authorisation. The transition period for firms working under national rules ended across the EU on 1 July 2026.
- The ESMA registerESMA, the EU’s markets authority, keeps the register of authorised firms (the ESMA Interim MiCA Register). Check it before sending money, and check which services the firm is allowed to offer.
- The exact firmESMA stresses that MiCA protections apply only to the authorised EU firm, not to other companies in the same group or outside the EU, even under the same brand.
- No compensation schemeEven with an authorised firm, the October 2025 warning from ESMA, the EBA and EIOPA is clear: you will not benefit from compensation schemes.
“Not your keys, not your coins”: the risks on both sides
The saying is true: Celsius shut its platform and BlockFi froze withdrawals, leaving customers with coins stuck inside bankrupt firms. But the reverse is also true: once you hold the keys, you alone are responsible. A lost phone with no written phrase, a phrase photographed and stolen, or a wrong address means coins gone, with nobody to complain to.
- Keeping the phrase as a photo on your phonePhones get lost, break or are hacked. Ethereum.org advises against storing the phrase on a computer.
- Only one copy of the phraseOne fire or one house move and access is gone for ever.
- Sending the whole amount at onceA wrong address cannot be corrected. A small test amount shows you everything works.
Lessons are educational. They are not a recommendation to buy or sell. Investing involves risk and you can lose money. Sources: BIP39 (github.com/bitcoin/bips); ethereum.org, the page on wallets; ESMA, EBA and EIOPA, joint warning on crypto-assets and press release of 6 October 2025; ESMA, statement of 17 April 2026 on the end of the MiCA transitional periods and its MiCA page; FCA, “Cryptoassets” for consumers (updated 29 January 2026) “A new regime for cryptoasset regulation” (updated 30 September 2026) and “Cryptoasset firms: Registration under the MLRs ahead of the new FSMA regime”; US Department of Justice, releases of 2 November 2023 and 28 March 2024 on Samuel Bankman-Fried; Bloomberg (11 January 2024) on the FTX filing date and how claims are valued; FTX release of 7 October 2024 on plan confirmation; SEC release of 13 July 2023 on Celsius; Reuters (8 May 2025) on Celsius’s bankruptcy; Celsius release of 31 January 2024; Axios (28 November 2022) on BlockFi; Coinbase bitcoin closing prices, with our calculations.