It feels like owning crypto. Mechanically it is an IOU from a company. The difference only matters on the days it matters enormously.
An exchange balance is a database entry representing a claim on the company, not coins you control. Most of the time this is indistinguishable from ownership. In an insolvency it becomes very distinguishable, and you find out you are an unsecured creditor.
If you buy bitcoin on a large exchange and leave it there, your account shows a balance. It goes up and down with the market. You can sell it, send it, or watch it. In every practical sense it behaves like owning bitcoin.
Underneath, something different is happening. The exchange holds a large pool of crypto across its own wallets. Your balance is a row in its ledger saying you are owed that amount. When you trade, rows update. Frequently no blockchain transaction occurs at all.
This is not a scandal. It is how exchanges achieve speed and low fees, and it is roughly how a bank works. It is worth understanding because the difference is invisible right up until it is the only thing that matters.
You own a claim against a company. Your protection is that company's solvency, its internal controls, its honesty about reserves, and whatever legal regime it operates under. If the company fails, you join the queue of creditors, and history says that queue moves slowly and rarely pays in full.
You own the ability to sign transactions moving specific coins recorded on a public ledger. No company sits between you and them. If every company in crypto vanished, the coins would still be there and your key would still move them.
That is the entire distinction. Not where funds are "stored", which is a confusing frame, since coins are never in a wallet in any physical sense. It is who holds the key that authorises movement.
"Not your keys, not your coins" sounds like slogan-thinking until you notice it is a compressed description of several real bankruptcies where customers with visible balances discovered those balances were unsecured claims.
The pattern repeats with variations. A firm takes deposits. It uses those assets for something the depositors are unaware of, or simply loses them. Withdrawals get paused, which is the only visible symptom. By the time anyone outside knows, the assets are gone and the account balance is a number in a defunct database.
Users in those cases had not been reckless. They had used the largest, most reputable, most heavily advertised venue available. That is the uncomfortable lesson: reputation is not a mechanism, and it fails exactly when you need it.
After enough failures, exchanges began publishing proof of reserves, cryptographic evidence that they hold assets matching customer balances.
It is a real improvement and it is incomplete. Reserves prove assets exist at a moment. They do not prove those assets are unencumbered, that they were not borrowed for the snapshot, or that liabilities elsewhere do not exceed them. A full picture needs liabilities too, audited, continuously. Very few provide that.
Treat proof of reserves as one input, not as a resolution.
Self-custody absolutism is bad advice, so here is the honest other side.
Exchanges are good at converting ordinary money into crypto and back, which self-custody cannot do at all. They are convenient for active trading, where moving assets on-chain for every trade is slow and expensive. And for a genuinely small amount, the risk of a company failing may well be lower than the risk of you losing your own key.
A reasonable default that most experienced people converge on: use an exchange as a doorway, not a warehouse. Buy there, then move meaningful amounts somewhere you control. Keep only what you are actively trading or genuinely willing to lose.
The choice is usually presented as a binary: hand your coins to a company, or take on the full burden of self-custody with a phrase you must never lose.
Smart contract wallets sit between the two, and are the reason managed self-custody is now possible at all. Your funds sit in a contract you own. You can grant a narrowly scoped permission to someone else, letting them do a specific job without the ability to move funds out. You can revoke it yourself.
That means "someone manages this for me" and "nobody can take it" stopped being mutually exclusive. It is worth knowing that option exists, because most people still believe they have to pick a side. Our guides on what non-custodial actually means and how a bot can trade but never withdraw cover how that is enforced in practice.
Whatever you use, one question does most of the work: if this company disappeared overnight, what would happen to my money?
If the answer involves a legal process, a support ticket, or waiting to see, you are a creditor. That can be an acceptable position, taken deliberately and sized accordingly. It should just never be a position you are in by accident.