On January 10, 2023, approximately $120 million worth of Bitcoin was withdrawn from centralized crypto exchanges, according to on-chain data from Glassnode. Roughly $50 million flowed out of Binance and another $30 million from Coinbase, continuing a trend that has defined the post-FTX landscape. With Bitcoin trading around $17,446 and Ethereum near $1,336, these withdrawals represent more than just capital movement — they signal a fundamental reevaluation of how crypto users approach asset security.
The Threat Landscape
The collapse of FTX in November 2022 shattered whatever trust remained in centralized crypto custodians. The exchange, once valued at $32 billion, imploded overnight when it was revealed that customer funds had been commingled with the trading firm Alameda Research. In the immediate aftermath, Binance experienced over $600 million in Bitcoin withdrawals in a single day, while Coinbase saw roughly $3.5 billion in Bitcoin pulled from its reserves during November alone.
But the migration to self-custody has exposed its own set of vulnerabilities. A Bitcoin core developer recently lost over 216 BTC to a PGP key compromise, demonstrating that even technically sophisticated users face significant security challenges. The total Bitcoin illiquid supply — coins held in cold or hot storage wallets rather than on exchanges — has surpassed 15 million coins, meaning the vast majority of Bitcoin is now in self-custody. This shift demands a comprehensive understanding of security best practices.
The threat environment extends beyond exchange collapses. Phishing attacks targeting wallet seed phrases remain pervasive. Smart contract exploits drained over $3 billion from DeFi protocols in 2022. Social engineering attacks have become increasingly sophisticated, with attackers impersonating support staff, project developers, and even regulatory officials to extract private keys or seed phrases from victims.
Core Principles
Effective self-custody rests on three foundational principles: exclusive key control, redundancy, and operational security. Exclusive key control means that no other entity — no exchange, no custodian, no wallet provider — has access to your private keys. If a service can reset your password or recover your wallet, they have access to your funds.
Redundancy ensures that a single point of failure cannot result in permanent loss of funds. This means maintaining multiple backups of seed phrases stored in geographically separate locations. Steel backup plates resistant to fire and water damage provide superior durability compared to paper or digital storage. The goal is to survive any single disaster — fire, flood, theft — without losing access to your assets.
Operational security encompasses the daily practices that protect against social engineering and digital attacks. This includes never entering seed phrases on any internet-connected device, verifying transaction details on hardware wallet screens rather than computer displays, and maintaining strict separation between devices used for crypto management and general internet browsing.
Tooling and Setup
Hardware wallets remain the gold standard for self-custody. Devices from established manufacturers like Trezor and Ledger store private keys on secure elements that never expose them to the connected computer. When signing a transaction, the hardware wallet displays the transaction details on its own screen, preventing malware on the host computer from intercepting or modifying the destination address.
For users managing larger portfolios, multi-signature wallets add an additional layer of security. Solutions like Electrum or Sparrow Wallet enable configurations requiring multiple keys to authorize transactions. A common setup uses three keys with a 2-of-3 requirement, meaning an attacker would need to compromise two separate devices or locations to move funds.
The process of withdrawing from exchanges to self-custody deserves careful attention. Users should first send a small test transaction to verify the receiving address. They should verify the address displayed on the hardware wallet screen matches what appears on the computer screen — address replacement malware can redirect funds to an attacker’s wallet. After confirming receipt, larger transfers can proceed with confidence.
Ongoing Vigilance
Self-custody is not a one-time setup but an ongoing practice. Regular verification of backup integrity ensures that seed phrase backups remain readable and accessible. Firmware updates for hardware wallets should be applied promptly, but only when downloaded directly from the manufacturer’s official website or through the official companion application.
Users should monitor their wallet addresses periodically using block explorers, without needing to connect their hardware wallet. This allows verification that funds remain in place without exposing keys to potential compromise. Setting up alerts for outgoing transactions through services like Blockstream or mempool.space provides real-time notification if unauthorized transfers occur.
The $120 million in exchange outflows on January 10 reflects a growing awareness that self-custody, while demanding, offers the strongest guarantee of asset sovereignty. As Bitcoin balances on exchanges continue to decline, the security practices described here become not optional but essential for anyone holding cryptocurrency.
Final Takeaway
The crypto industry is in the midst of a generational shift from trust-based custodial systems to verification-based self-custody. The FTX collapse was the catalyst, but the underlying lesson applies regardless of which institution fails next: if you do not hold your private keys, you do not hold your coins. The tools and practices for secure self-custody exist and are accessible. The question is whether users will adopt them before the next crisis makes the choice for them.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals for personalized guidance.
50M out of binance in one day post FTX. coinbase losing 30M more. the market is voting with its withdrawals and centralized custodians are losing
coinbase 30M outflow looks tiny next to the 120M total. most of that just rotated to other exchanges tho
216 BTC lost because a PGP key got compromised. that guy was probably using the same machine for signing emails and managing wallets. opsec is a lifestyle not a checklist
216 BTC lost to a PGP key compromise. that developer probably had better opsec than 99% of us and still got wrecked
216 BTC lost because someone compromised an email to get a PGP key. hardware wallets are great until your operational security outside of them is garbage
exactly, which is the real takeaway here. self custody just shifts the attack surface, it doesnt eliminate it
216 BTC lost and the attacker just needed to compromise an email account to get the PGP key. hardware wallets exist for a reason
216 BTC lost because a PGP key got compromised. this is why hardware wallets exist. if your signing mechanism touches a general purpose computer you are one phishing link away from zero
Tariq O. the irony is the dev was probably more technically sophisticated than 99% of holders. if it can happen to a core dev it can happen to anyone
tariq is right, if your signing mechanism touches a general purpose computer youre one phishing link away from zero. hardware wallet + airgapped signing is the only way
opsec_fail_ 216 BTC gone because someone got into a PGP key via email compromise. a bitcoin core dev with better opsec than 99% of us still got wrecked. humbling
opsec_fail_ a bitcoin core dev getting popped via PGP key compromise is the most ironic thing. the people building the security tools got hit by basic email opsec
$120M in a single day sounds big until you realize exchanges were still processing billions in volume. the self-custody migration was always going to be a trickle not a flood
$120M leaving exchanges in one day and people act surprised. After FTX stole customer funds, what did everyone expect?
the irony is most of that $120M probably went to other exchanges, not cold storage. chain data showed binance outflows landing on kraken and coinbase
the outflows landing on other exchanges is the part nobody wants to hear. its not self custody, its musical chairs with custodians
Raj P. nailed it. outflows from Binance landing on Coinbase is not self custody. its just rotating risk between custodians. glassnode data showed this clearly
musical_chairs_ exactly right. 120M left binance and landed on coinbase. different custodian same risk profile. people confused moving with protecting
musical_chairs_ binance to coinbase is not self custody. its just picking a different landlord who promises better locks on the door
a Bitcoin core dev losing 216 BTC to a compromised PGP key is the most terrifying part of this. if the people building the tech cant secure their own keys what hope do normies have
pgp_rot_ $120M pulled from exchanges in one day post FTX. the real number that matters is how much never went back. self custody working until you lose your own keys
a core dev losing 216 BTC to a PGP compromise is the most humbling thing in crypto. if they can get popped anyone can
216 BTC gone because of a PGP key compromise and people still keep funds on exchange. the lesson writes itself
a core dev losing 216 BTC to a PGP key compromise should be on a poster above every hardware wallet manufacturers headquarters
120M leaving exchanges sounds big until you realize most of it rotated to other exchanges. Glassnode inflow data tells the other half of the story