Six ways to hold bitcoin
Owning bitcoin really means controlling the keys that can move it. Here are the six common ways people do that, from easiest to most secure, and what each one trades away.
Bitcoin doesn’t sit in an account. It sits on a public ledger, and whoever controls the matching private key can move it. Every way of holding bitcoin is really a decision about who holds that key, where it lives and what happens if the person holding it can’t act.
The usual backup for a key is a seed phrase: 12 or 24 ordinary words in a set order. Anyone with those words can take the coins. Keep that in mind through everything below.
| Model | Who holds the key | Ease of use | Main risk | Typical use |
|---|---|---|---|---|
| 1. Exchange account | The company | Easiest | The company fails or freezes you | Buying, learning |
| 2. Phone or desktop app | You, online | Easy | Malware, a lost phone | Spending money |
| 3. Hardware wallet | You, on a device | Moderate | Losing the device and backup | Savings you may need soon |
| 4. Air-gapped cold storage | You, fully offline | Hard | Forgetting how to use it | Long-term savings |
| 5. Multisignature | Several keys, any 2 of 3 | Hard | Losing the setup file | Large holdings |
| 6. Collaborative custody | You hold 2 of 3, a firm holds 1 | Moderate | Less privacy | Inheritance planning |
1. An exchange account
You buy bitcoin on an exchange and leave it there. You don’t hold any bitcoin directly. You hold a claim on the company, and the balance in the app is a number in its database.
What it solves. It is the easiest start: a username, a password and a “forgot password” link. You can learn how bitcoin behaves before taking on any technical responsibility.
The risk. You are trusting the company to stay solvent, keep hackers out and keep your account open. If it fails, there is no deposit insurance like the FDIC, and depending on its terms of service your coins may be treated as its property. When Celsius went bankrupt in 2022, a court ruled that coins in its interest-earning accounts belonged to the company, leaving those customers as unsecured creditors. Exchanges also collect your identity, address and tax details, which links your name to your holdings.
The common mistake. Treating an exchange as a savings account. It is a marketplace. Keeping a large share of your savings on one platform is the risk most people take without noticing.
2. A phone or desktop app (a “hot wallet”)
An app on your phone or computer holds the keys. This is the first step where you control them, so no company can freeze or block a payment.
What it solves. It removes the middleman. You can send bitcoin any time by scanning a QR code. Some apps now split the key between your phone and an encrypted cloud backup, so no single piece of paper can be stolen or lost.
The risk. The device is always online, so malware and phishing can reach the keys. If the phone is lost and there is no backup, the coins are gone for good. Most apps also check your balance through the provider’s servers, which can reveal your IP address.
The common mistake. Photographing the seed phrase, or keeping more in the app than you would carry in a wallet.
3. A hardware wallet
A small dedicated device creates and stores the keys and signs transactions inside itself. When you send bitcoin, your computer prepares the transaction, the device signs it, and the key never leaves the device. Many use a tamper-resistant secure chip.
What it solves. Your computer can be infected and your bitcoin is still safe, because the computer never sees the key. Many hardware wallets also work with independent software such as Sparrow or Electrum, so the manufacturer doesn’t need your name or email.
The risk. The risks become physical: a device tampered with before it reaches you (buy only from the maker), losing the device and the backup together, and the fact that owning one can mark you as a target.
The common mistake. Thinking the bitcoin is inside the device. It is on the ledger. If the device breaks, the seed phrase restores everything on a new one. If the seed phrase is lost, the device is the only copy.
4. Air-gapped cold storage
A signing device that never connects to anything by cable, Bluetooth or Wi-Fi. Transactions move in and out by scanning QR codes or swapping a microSD card, so the only path to the key is physical.
What it solves. It closes the last digital door: a flaw in how a device talks to a computer can’t be used if it never talks to one. The slow, manual process also makes it hard to sell in a panic.
The risk. Because you rarely touch it, you can forget the PIN or the steps. Devices also age. The seed phrase should be stamped in metal rather than written on paper, and it is worth practicing a recovery once in a while to prove it still works.
The common mistake. Building a setup so complicated, or hiding it so well, that you or your family can’t use it years later.
5. Multisignature (“multisig”)
The coins need more than one key to move. In the common 2-of-3 setup there are three keys, kept in different places or by different people, and any two can sign.
What it solves. One stolen key can’t move the funds, and one lost key doesn’t lose them: the other two can move everything to a new setup. A robber or a con artist would need two separate keys in two separate places.
The risk. It is more complex. Each wallet has a small setup file, sometimes called the descriptor, that records how the keys fit together. Without it, recovery is much harder. Keeping all three keys in one safe defeats the purpose. Most multisig setups in use today are also visible as multisig on the public ledger.
The common mistake. Over-engineering it (5-of-7 for a modest amount), or not backing up the setup file alongside the keys.
6. Collaborative custody
A 2-of-3 multisig where you hold two keys and a specialist firm holds the third. You can move the coins without the firm. The firm can’t move them without you.
What it solves. The biggest threat to self-custody is the owner being the only person who understands it. A firm holding one key can help heirs recover the coins through a documented process, which fits into an estate plan or a trust.
The risk. Privacy. The firm knows who you are and what you hold. You are also relying on it to still exist, and to follow its process, when your heirs need it.
The common mistake. Assuming the family will figure it out. Whatever the setup, write down what exists, where the pieces are and who to call, in instructions someone non-technical can follow.
How people usually combine them
Most careful owners don’t pick one. They keep a small amount in an app for spending, savings on a hardware wallet or in cold storage, and, as the amount grows, move the core holding into multisig. Whatever the mix, the test is the same: if you were gone tomorrow, could the right person recover it, and could the wrong person not?
Adapted from a six-part series I wrote for the Kingdom Bitcoin newsletter in February 2026, rewritten here as a plain guide. Product names are examples, not endorsements. Nothing here is investment, legal or tax advice.
Questions about holding bitcoin? Email me at jlraney99@gmail.com.