Cold Wallet, Paper Wallet, or Exchange Custody: Comparing Three Ways to Hold Crypto

Written by Julia Fischer, Digital Finance Writer. Reviewed by Kenji Tanaka, Cryptocurrency Security Engineer. Updated August 26, 2026.

There are several ways to hold crypto, and they are not equally private or equally safe. This guide compares three of the most common: a Trezor cold wallet, a paper wallet, and leaving funds in the custody of an exchange. The goal is a clear, neutral view of how each one treats your keys.

What separates a cold wallet, a paper wallet, and exchange custody?

The difference comes down to who holds the private keys and where they are exposed. A cold wallet keeps keys on a device and signs offline. A paper wallet prints keys onto paper. Exchange custody hands the keys to a company that holds them for you.

Each of these is really an answer to one question: where does the secret that controls your funds live, and who can reach it. That single distinction drives everything else, from how convenient the option feels day to day to what happens if something goes wrong. The rest of this guide looks at each in turn.

None of the three makes your coins live inside it. The coins remain on the blockchain in every case. What changes is control of the key that authorizes moving them, and whether that key is ever placed somewhere the internet or another party can see it.

How does a Trezor cold wallet hold your keys?

A Trezor cold wallet generates the private keys inside the device and never lets them leave. Transactions are signed on the hardware and confirmed physically on its screen, so the keys stay offline even during use. A PIN guards the device and a recovery seed backs it up offline.

Trezor, made by SatoshiLabs, produced the first hardware wallet in 2014, and the current lineup includes the Model One, Model T, Safe 3, Safe 5, and the newer Safe 7. The devices are open-source, so their security design can be examined publicly rather than simply trusted.

What makes this approach cold is that the secret never appears in a place software can read. You connect the device to Trezor Suite to see balances and broadcast signed transactions, but the signing itself happens inside sealed hardware. There is no cloud account behind it, so access means holding the device and knowing its PIN.

What is a paper wallet, and where does it fall short?

A paper wallet is a printed copy of a private key and its matching address, generated once and stored on paper. It keeps the key offline while it sits unused, but it exposes that key whenever it is created and again whenever the funds are spent, which is its main weakness.

The exposure is easy to overlook. To generate the key you usually rely on a tool running on a computer, and to spend the funds you typically import the key into software that then knows it in full. At both moments the secret leaves the paper and can be captured by malware, a printer memory, or a bystander.

Paper is also fragile in ordinary ways. It can fade, tear, burn, or be misplaced, and there is no PIN protecting it if someone finds it. A hardware cold wallet addresses these gaps by keeping the key inside a chip, requiring a PIN, and signing without ever printing or importing the secret.

What does leaving crypto in exchange custody mean?

Leaving crypto in exchange custody means a company holds the private keys on your behalf while you hold an account balance. It is convenient for trading and requires no device, but you depend entirely on that platform’s security and solvency, and it can restrict or lose access to your funds.

This is the model most people meet first, because buying crypto often happens on an exchange. Keeping a small amount there for active trading is common and reasonable. The concern is scale and time: the more you hold, and the longer you hold it, the more your funds depend on a single company staying secure and solvent.

History has shown that custodial platforms can be hacked, can freeze withdrawals, or can fail outright, after which users rely on whatever recovery process follows. Because the platform holds the keys, an account password is not the same as control. Self-custody through a cold wallet removes that dependence entirely.

Cold wallet, paper wallet, and exchange custody compared

The table below lines up the three approaches across the factors that matter most: who holds the keys, whether the secret is ever exposed, how the funds are protected, and what recovery looks like. Reading across each row shows why the cold wallet keeps the key hidden throughout.

Factor	Trezor cold wallet	Paper wallet	Exchange custody
Who holds the keys	You, on the device	You, on paper	The exchange
Key exposure	Never leaves the device	Exposed at creation and spending	Held by the platform
Access protection	PIN and optional passphrase	None on the paper itself	Account login on a server
Backup and recovery	Offline recovery seed	The paper itself is the backup	Depends on the platform
Best suited to	Long-term self-custody	An older, static store	Active trading

The comparison is not about one option winning outright but about matching the method to the need. The pattern is that a cold wallet is the only one of the three where the key is neither exposed in use nor handed to someone else.

How do you move from an exchange or paper wallet to a cold wallet?

You move funds by setting up the cold wallet first, verifying a receiving address on the device, sending a small test amount, moving the rest once it arrives, and retiring any emptied paper wallet. Each step keeps the destination address trustworthy and the keys unexposed.

Step 1: Finish setting up the cold wallet

Complete your Trezor cold wallet setup first, so its keys and recovery seed already exist before any funds move toward it. Moving crypto to a wallet that is not yet fully backed up risks sending it somewhere you cannot reliably recover, so the destination should be finished and safe before anything arrives.

Step 2: Generate and verify a receiving address

Create a receiving address in Trezor Suite and confirm the same address on the device screen before you use it. Checking the address on the hardware guards against malware that might swap a copied address, since the device screen shows the genuine destination that the sealed keys actually control.

Step 3: Send a small test amount

Move a small test amount from the exchange or paper wallet first and wait for it to arrive at the cold wallet. A test transfer confirms that the address, the network, and the withdrawal all work as expected before you commit the full balance, turning a possible large mistake into a tiny one.

Step 4: Move the remaining balance

Once the test arrives correctly, transfer the rest of the balance to the same verified cold wallet address. Reusing the address you already confirmed avoids introducing a new chance for error, and seeing the earlier test land gives you confidence that the larger amount will follow the same path.

Step 5: Retire the old paper wallet

Treat any emptied paper wallet as spent and do not reuse it, since its key may have been exposed when it was created or handled. Sending fresh funds back to a key that has already been imported into software reintroduces exactly the exposure you moved away from, so leave the old paper behind for good.

Frequently asked questions

Why is a paper wallet often considered riskier than a hardware cold wallet?

A paper wallet exposes its private key at the moment it is created and again whenever it is used, since spending usually means importing the key into software. A hardware cold wallet signs inside the device and never reveals the key, so the secret is not handled in the open.

If an exchange holds my keys, do I really own my crypto?

You own a claim against the exchange rather than direct control of the coins. The platform holds the keys, so you depend on its security and solvency. With a cold wallet you hold the keys yourself, which is what self-custody means and why no company can freeze or lose them for you.

Can I use all three approaches at the same time?

Yes, and many people do. An exchange is handy for active trading, a cold wallet suits long-term holdings, and a paper wallet is an older method some still keep. The common practice is to keep only what you actively use on an exchange and move the rest into cold storage.

Does moving to a cold wallet mean I can never sell?

No. A cold wallet still lets you send funds whenever you choose, and Trezor Suite can also buy, sell, and swap for supported assets. Holding your own keys changes who controls access, not whether you can act on your crypto when you decide to.