How custody works across exchanges, ETFs and self-custody, and what you give up at each step

Buy one bitcoin on Coinbase, one share of a spot bitcoin ETF, and hold one bitcoin in your own wallet, and you own three different things with three different risk profiles, even though the price on screen is identical. The question that matters isn't "do I own bitcoin" but "who can move it, freeze it, or lose it, and under what circumstances."

Who actually holds the keys on an exchange

When you buy on Binance, Coinbase, or Kraken, the exchange generates and controls the private keys for a pool of wallets. Your account balance is an entry in their database, a liability they owe you, not a specific coin with your name on it. This is why the collapse of FTX mattered so much: customers saw balances in their app right up until withdrawals froze, because the coins backing those balances had already moved elsewhere. The FTX bankruptcy examiner's report documented commingling between FTX and Alameda Research that made "your balance" a legal claim in a bankruptcy line, not a bearer asset.

Reputable exchanges now publish proof-of-reserves attestations and some, like Kraken, have offered cryptographic proof-of-reserves audits since 2014. That helps, but it's a snapshot, not a guarantee, and it doesn't change the legal structure: you're an unsecured creditor if the exchange fails. The tradeoff is convenience for counterparty risk. You get instant trading, fiat rails, and no seed phrase to lose, in exchange for trusting a company's solvency and internal controls.

What changes when it's wrapped in an ETF

Spot bitcoin ETFs like BlackRock's IBIT or Fidelity's FBTC solve a different problem. The fund itself holds the bitcoin, custodied almost entirely through Coinbase Custody Trust Company, a qualified custodian regulated under New York's trust charter. When you buy IBIT shares in a brokerage account, you own shares of a trust, and the trust owns the bitcoin. The SEC's approval order for spot bitcoin ETPs required daily disclosure of holdings and specific custody arrangements as a condition of listing.

This adds a layer of institutional oversight, SEC reporting, and the legal protections of a regulated trust structure, plus the ability to hold crypto exposure inside an IRA or brokerage account without touching a wallet. What you give up is direct ownership. You can't withdraw actual bitcoin from an ETF, you're exposed to a single custodian concentration (most spot ETFs use Coinbase Custody), and you pay an ongoing expense ratio, typically 0.19% to 0.25% annually, for the privilege. If the custodian has an operational failure, or if the SEC or an insolvency court disputes trust assets in a stressed scenario, you're relying on the fund structure's legal segregation, not a set of keys you control.

What self-custody actually removes and what it adds back

Move the bitcoin to a hardware wallet like a Coldcard or Ledger, and you eliminate counterparty risk almost entirely. Nobody can freeze your funds, no exchange bankruptcy touches you, no custodian's balance sheet matters. The bitcoin moves on the network with a signature only you can produce, transaction data anyone can verify on a block explorer.

What you take on instead is full operational responsibility. Lose your seed phrase and the funds are gone, permanently, with no support line to call. Bitcoin's own protocol has no reversal mechanism and no password reset, which is the entire point but also the entire risk. Estimates from Chainalysis and other blockchain analytics firms have put permanently lost bitcoin (inaccessible keys, forgotten passwords) in the millions of coins over the network's history. Self-custody also means you're now responsible for physical security, backup redundancy, and knowing how to verify a receiving address instead of trusting an app's autocomplete.

So which one should you actually use

There's no universally correct answer, only a match between the tool and the job. Exchanges make sense for active trading and small amounts you're comfortable losing to platform risk. ETFs make sense for retirement accounts, tax-advantaged wrappers, or anyone who wants price exposure without operational responsibility. Self-custody makes sense for holdings you'd genuinely be devastated to lose to a third party's failure, provided you're willing to learn the mechanics of seed phrases and cold storage.

Before moving any meaningful amount, check three things: what specific entity holds the private keys, what legal claim you have if that entity fails, and whether the withdrawal process actually works by testing it with a small amount first. The answer to "do I own this" is really a question about who has to do what for you to get your coins back, and how many people can say no along the way.