Another option for storing your cryptocurrency is a custodial storage solution, such as an online wallet provider like Coinbase or Gemini. This outsources the decisions and effort that are required to secure and backup your crypto balances to a third-party company. Reputable custodial services with good security records are a reasonable option for people with small cryptocurrency holdings for whom it doesn’t make sense to invest much time and money into a sovereign storage system.
The cryptocurrency community has a saying “not your keys, not your coins”. Many wrongly assume that because a network of third-party custodial banks was the best security solution for the older fiat system, this third party custody model will also work best for cryptocurrencies. But cryptocurrencies have substantially different properties than fiat. In our opinion, the risk of holding coins with a trusted third party is unacceptably high for large crypto balances. Here are some reasons to avoid them:
A history of loss. Many online services have suffered from hacks and internal theft that resulted in lost funds. This includes well-known and widely-used services. Sometimes, the company has gone out of business and been unable to reimburse their customers for the loss. At the time of the second Mt. Gox hack in 2014, it was the most widely-used crypto exchange. 650,000 bitcoin were lost. Although security practices have improved over time, hacks of market-leading service providers still happen regularly.
A big target. Online services run network-connected machines responsible for holding millions or even billions of dollars worth of crypto. They are under constant attack by clever attackers from all over the world. These attacks come not only from individual hackers, but directly from nation states.
Phishing risks. Users of well-known online services are prime targets for phishing attacks. Attackers send official looking messages to users asking them to login, but redirecting them to a fake webpage instead of the real thing. These fake websites harvest credentials so that attackers can log-in to their real accounts and drain them. Attacks like this were used to steal 7,000 bitcoin from Binance users in 2019.
Identity spoofing. Since the administrators of a web wallet service have control over customer accounts, they are a target for social engineering attacks where an attacker convinces the service that they are you. Even reputable exchanges with no publicly-reported security leaks have had users lose funds due to identity spoofing attacks.
Account freezes and seizure. A custodial storage service has the ability to deny you access to your funds. This might happen for several reasons. Your account could get flagged by automated fraud prevention algorithms. Government agents could choose to confiscate your funds. This might sound farfetched, but precedents exist, such as when Cypress conducted a bank deposit seizure in 2010 or the 1933 seizure of monetary gold in the United States. In times of economic turmoil, seizing cryptocurrency deposits could become appealing to legal authorities.
Unpredictable fork support. In the case that a contentious blockchain fork occurs, the custodian may only provide you with access to the assets on one branch of the fork if they deem supporting the other branch to be not worth the effort. You will only have full control to redeem and use forks if you have full control of your Bitcoin keys.