Intro
If we keep paying in euros, dollars or pounds instead of Bitcoin, Ether or Solana, there must be a reason. In fact, there are quite a few. One is that today wallets — which, roughly speaking, we can think of as cryptocurrency purses — are rather inconvenient to use, and in many cases extremely inconvenient, for example because of transaction times on the order of minutes rather than the seconds we are used to from the POS terminals we use every day.
Another reason is security. If we keep our cryptocurrencies in personal wallets we face the problem of secure key management; if we keep them on exchanges we take on the security problems of the operators, which always exist even though they ought to be handled professionally by dedicated structures.
And that is exactly where we start this week, taking our cue from two incidents, a short time apart, that involved two exchanges. In early September Liquid, the parallel Bitcoin circuit run by Blockstream, suffered an anomalous withdrawal of about 4,000 bitcoin — almost 320 million dollars. They did not steal a password. A software bug made the system accept an operation that should never have gone through, and real bitcoin left the guarantee deposit. Whoever carried out the hit returned 3,400 of them; about 600 remain. On 24 September it was Bitget’s turn, one of the major exchanges. Someone got into the internal systems and had exits executed that looked authorised. The hole is about 387 million dollars. The exchange says the most protected keys were not touched and that an insurance fund of over 464 million covers the loss. Customer withdrawals, meanwhile, have been suspended.
Two different stories, same ending: for a while, the cryptocurrencies cannot be withdrawn.
The balance you see is not really yours
When you buy on an exchange, the coins do not sit in a wallet with your name on it. They sit in a common deposit, and you are credited with a balance. It is the same mechanism as a bank, with one difference: a bank is regulated, supervised, and in Europe deposits have a public safety net (up to €100k). An exchange does not — or at least not in the same way. As long as everything runs smoothly, the difference does not show. It shows when the site closes withdrawals, when an internal control fails, or when — as has already happened in the past — the books do not add up. Bitget is not the case of a failed platform: here the stated problem is an intrusion, and there is a fund that should make good the loss. Liquid is not even an exchange, and it was still almost entirely emptied by a software bug.
Does it still make sense to leave them there? Yes, but not all of them
To buy, sell, get in and out quickly, the Exchange remains the most practical solution. It has the prices, the orders, the path from euros (or other fiat currency) to crypto, someone to write to if something does not add up. No personal wallet does these things with the same simplicity. The point is how much to leave there. What you need to operate in the coming days can stay there. What you want to hold for months, no. An exchange must keep part of the funds always ready to leave, otherwise it cannot pay withdrawals. It is precisely that part — the most exposed — that gets hit in incidents. «There is a fund that covers it» is insurance, not ownership. Insurance pays if the money is there and if the company is still standing to honour it. Meanwhile the market moves and you watch.
Alternatives exist, and there is more than one ….
The clearest path is to keep the coins in a wallet of your own, where moving anything requires a confirmation that only you can give. The phone or computer proposes the operation; a small device offline from the internet, similar to a USB stick, signs it. No internal office can authorise it in your place. It is not the only road. Some prefer a specialised, regulated custodian that keeps the funds separate from its own and has its accounts checked. Some split control: to move money out, several signatures are needed, and one of them is yours. None of these choices is free in effort. All of them reduce the same risk — waking up and reading that withdrawals are suspended.
… but it is not for everyone
A personal wallet demands attention. The keys or the wallet seed phrase (usually at least a dozen English words) must be kept jealously and strictly offline. They must be stored where a loss, a theft or a fire will not make them unusable together with the phone. Before loading an important sum onto it, it is worth trying to recover the wallet from scratch with a small amount. Anyone who gets this step wrong has no customer service: the coins are gone (forever!). Better then to take it one step at a time.
A good rule of thumb for managing cryptocurrencies is the following:
- On the exchange, keep only what you expect to use in the short term;
- On a smartphone wallet app (Metamask, Atomic etc.), an amount you are willing to manage;
- On the external device, the bulk of the holdings, when the sum held justifies the cost of the device — usually around a hundred euros (Trezor, Ledger Nano etc.) — and an afternoon of tests. Anyone who does not feel up to it has chosen the risk that someone else loses their money, instead of the risk of losing it alone. The real mistake is not knowing which of the two risks you are running.
