"Never leave coins on an exchange" no longer applies to everyone

The shelf life of a sentence

"Not your keys, not your coins" is a sentence about the bankruptcy risk of centralised exchanges — coins you deposit at an exchange are, stripped of decoration, an IOU the exchange has written you, and when the exchange sinks the IOU is worthless. In that context the sentence was entirely correct.

But several things since then have changed the range in which it applies:

1. Several of the largest exchanges began publishing their own Proof of Reserves (PoR) on a regular basis.
2. On-chain phishing became tooling. Approval phishing, Permit2 signature abuse and drainer kits all target users who hold their own keys.
3. dApp front ends became an attack surface too. In the December 2023 Ledger Connect Kit incident, what was compromised was a front-end library integrated by dApps; the hardware wallets themselves were not breached, yet users could still end up confirming a malicious transaction on the device.
4. The operational complexity an ordinary user faces on-chain now far exceeds the early years. Back then there were mostly just transfers; now there is staking, bridges, AMMs, perpetuals, airdrop signatures — every one of them a new attack surface.

The result: in recent years phishing approvals, signature fraud and contract vulnerabilities have become reasons ordinary users lose coins that can no longer be ignored — exchange failures are not the only way.

This lesson is not against self-custody. What it is against is applying an old sentence regardless of circumstances.

I. How the rule came to be written

The history of "Not your keys, not your coins" runs like this:

• 2014, Mt.Gox falls. Users begin to realise that an exchange balance is only an IOU.
• 2016, Bitfinex is hacked for 120,000 BTC. All user balances were written down by about 36% and compensated through the "BFX token." The event showed that even when a venue stays in business, a hack can leave users sharing the loss.
• January 2019, QuadrigaCX announces that founder Gerald Cotten died in India in December 2018; the platform ceases operations in February. The review published by Ontario Securities Commission staff in June 2020 concluded that most of the at least CAD$169 million clients lost resulted from Cotten's fraudulent conduct, not from lost keys (OSC report; see Shipwreck Annals · Volume Four). That event added a new risk dimension: one person in sole control of an entire exchange.
• October 2020, OKEx suspends withdrawals. The suspension began on October 16, as the founder cooperated with a police investigation; on November 19 the exchange announced withdrawals would resume on or before November 27 (Wikipedia · OKX).

From 2014 to 2020, the large-scale losses listed above all happened at centralised exchanges. So "Not your keys, not your coins" served well throughout that stretch: with your coins off the exchange, none of these events could reach you.

The turning point came around 2021. After DeFi took off, ordinary users went from "only ever using an exchange" to doing much of what they do inside a wallet, and the wallet became the easier place to attack.

II. Four new "non-CEX risks" since 2021

Phishing approvals and Permit2 abuse

The attack logic: a user connects a wallet to a dApp that looks perfectly normal, the dApp raises a signature request, and what the signature actually does is authorise some address to move a token in the wallet. Users often do not read the signature content carefully — and hardware wallet screens sometimes display only a hash rather than human-readable text. They sign, and the other side has its allowance.

Permit2 is a token-approval contract from Uniswap: the user first gives the Permit2 contract a one-time approval for a token, and afterwards grants individual applications allowances by signature, each with a spender, an amount and an expiration (Uniswap · Permit2 documentation). It was meant to improve the user experience, but it also gave phishers an opening: trick the user into signing a message that grants a large allowance with a long expiration to the phisher's address, and those tokens can be moved out before it expires.

A hijacked dApp front-end library (Ledger Connect Kit)

On December 14, 2023, a former Ledger employee was phished, and the attacker used that access to publish on npm a malicious version of Ledger Connect Kit — a wallet-connection library integrated by many dApps (versions 1.1.5, 1.1.6 and 1.1.7 were affected). The malicious code tricked EVM users of those dApps into signing transactions that sent their assets to the attacker. According to Ledger's incident report, the attacker never had access to any Ledger infrastructure; about five hours passed between the npm package being compromised and the issue being fully resolved, and the window in which assets were actually being drained was less than two hours in total (Ledger incident report).

What the incident shows is this: the hardware wallet kept the private key safe, but if the transaction the front end hands you is itself malicious and you press confirm on the device, the money still goes. In the same report Ledger says it will keep pushing Clear Signing (showing transaction content in readable form) and move towards removing blind signing.

Contract vulnerabilities and abuse of upgrade rights

Smart contracts get hacked too. This has become steadily more common since 2020 — mainly because contracts themselves have become steadily more complex. In 2022 the Wormhole bridge lost $320 million and the Nomad bridge $190 million, both to contract vulnerabilities; the Ronin bridge lost $625 million the same year because its validator keys were compromised, not because of a flaw in the contract code. Users of those bridges were, strictly speaking, all "self-custodying" — but their coins were locked inside the bridge, and once the bridge was breached, however safe their private keys were, it made no difference.

Abuse of upgrade rights is another variant — the developers retain the right to upgrade the contract, and one day upgrade it so that it moves every user balance out. The only thing a user can do is find out beforehand who holds the contract's upgrade rights.

Human error (address poisoning, clipboard malware)

This category is the plainest. The logic of an address poisoning attack: the attacker uses a vanity address generator to produce a decoy address whose first and last few characters match an address you use often, then sends you $1 so that the decoy sits in your transaction history. The next time you copy an address — and many people only check the beginning and the end — you copy the wrong one. The attack costs almost nothing to run, yet it has produced single losses of enormous size.

Clipboard malware is cruder still. Once a Windows machine is infected with a clipboard hijacker, you press Ctrl+C on a BTC address and what comes out on Ctrl+V has been swapped for the attacker's address.

The four categories above have one thing in common: every victim was self-custodying and held their own private keys. But holding the key does not stop you signing coins over to the wrong counterparty, sending them to the wrong address, or locking them in an unsafe contract. This is what the sentence "Not your keys, not your coins" does not cover.

Why you cannot simply compare the two sides' losses

Lining up exchange losses and self-custody losses year by year and quoting a multiple looks intuitive, but it is very hard to do accurately. Losses on the exchange side are heavily concentrated in a handful of big events — one FTX- or Bybit-scale incident in a year is enough to drag the whole year's number up. Losses on the self-custody side are scattered across a great many phishing, approval and address-poisoning cases, and each research firm counts them differently.

So this lesson gives no multiple, only one judgement: since 2021, the losses happening on the self-custody side are no longer a small share you can ignore — holding your own private key does not mean your money is safe. That is not the same as saying an exchange is safer than self-custody; the two should be discussed tier by tier, by amount.

III. Asset layering: three amount tiers, three placements

Below is one way to layer holdings. Take it as a reference rather than a template — the thresholds should be adjusted to your total position, your trading frequency and how practised you are at on-chain operations.

IV. If you keep coins on an exchange, how to pick one that is not the next FTX

Since both the small and the middle tier put a share on an exchange, how to pick the exchange is the decisive question. Five filters help:

1. Regularly published proof of reserves (PoR) that covers what is owed to account holders and that you can check for yourself. FTX never did this. Keep the distinction clear: PoR is a reserve proof the exchange publishes itself (for example a Merkle-tree self-attestation), not an accountant's audit. A report issued by an independent third party is more credible; where there is none, all you can do is check the on-chain addresses yourself.
2. Financial licences in at least 3 mainstream jurisdictions. Each of them should be findable in the public register on the regulator's own website.
3. A publicly disclosed user insurance fund. It only counts if the amount is public and the address can be checked on chain. FTX also displayed an "insurance fund" balance on its derivatives platform, but that was not a separately held fund with a checkable address.
4. No affiliated trading firm, or sufficient proof of separation. FTX and Alameda are the counter-example. Anyone who owns both a market maker and an exchange should be able to produce a report from an independent third party showing the two are separated.
5. Public statements from the CEO that can be looked up and reconciled. Look at whether he answers a risk question with a mechanism or an adjective: a firm that can tell you who is allowed to move the money, under what conditions, and how you can verify it yourself is a different thing from one that can only say "we take security very seriously."

How to check each of the five, and how much to hold at a venue depending on how many it passes, is laid out filter by filter in Lesson Two; score venues yourself with the steps there.

In practice this lesson comes down to layering by amount: small amounts can sit on an exchange, middle amounts should start considering a hardware wallet, and large amounts must be spread. At no tier should everything ride on a single point.