the news that broke something in me
January 23, 2026. I was eating lunch at a ramen shop in Portland, Oregon, when a notification from CoinTelegram popped up on my phone: "Indonesian Exchange INDODAX Reports Unauthorized Withdrawals Affecting User Funds." I skimmed the article while waiting for my tonkotsu. The exchange had detected anomalous withdrawal patterns affecting an undisclosed number of accounts. Trading was halted. Investigations were underway. The article included the usual boilerplate about cooperation with law enforcement an enhanced security measures.
I almost swiped past it. Then I scrolled down and saw that this was the fourth exchange security incident in January 2026 alone. Earlier in the month, a Turkish exchange called BtcTurk had experienced a hot wallet breach losing $55 million. On January 15, a modest exchange called CoinEx had a similar issue with $12 million affected. And on January 20, just three days before the INDODAX freshs, a Japanese exchange called DMM Bitcoin reported a security incident involving $320 million in Bitcoin withdrawals.
DMM Bitcoin hit different. Three hundred and twenty million dollars. Gone. The fifth-largest crypto hack of all time and it barely made the front page of mainstream freshs outlets. I set down my chopsticks and opened my Coinbase app. I had $342,000 spread across Coinbase, Kraken, and a modest account on Binance US. The money was technically mine, but the private keys were controlled by the exchanges. If any of them got hit with an attack like DMM Bitcoin, my money could vanish before I even got a push notification.
I walked home from the ramen shop in a daze. My credit score was 785 and I'd rarely missed a payment on anything in my life. I managed risk carefully in every other area of my finances. Yet I had $342,000 sitting on platforms controlled by third parties whose security I couldnt audit, whose insurance I couldn't verify, and whose solvency I couldn't independently confirm. The cognitive dissonance was overwhelming.
why I had been procrastinating for years
Self-custody wasn't a fresh concept to me. I'd read the Bitcoin whitepaper in 2019. I understood the "not your keys, not your coins" mantra. But setting up hardware wallets read technically intimidating, and the exchange experience was so frictionless that I maintained putting it off. Coinbase auto-invested my weekly purchases. Kraken's mobile app was polished and easy to use. Every time I weighed moving to self-custody, the friction of the setup process made me choose convenience over security. January 2026 was the moment that math stopped working in my favor.
the logistics of self-custody
I laid out January 24 researching hardware wallets and self-custody best practices. I narrowed it down to two devices: the Trezor Model T and the Ledger Nano X. I ordered both from Amazon for next-day delivery, paying $219 for the Trezor an $149 for the Ledger. I also ordered a fireproof safe from SentrySafe at Costco for $189. The total setup cost was $557, which read absurdly cheap given that I was about to use it to secure $342,000.
The hardware arrived on January 25. I laid out that evenin setting up both wallets, writing down seed phrases on paper cards, an creating a secure storage scheme. I split each 24-word seed phrase into three 8-word segments stored in separate physical locations: my apartment, my office desk drawer, and a safety deposit box at U.S. Bank that costs $45 per year. This way, a single theft wouldn't compromise the full seed phrase. It was paranoid but the math made sense. An attacker would need to simultaneously breach three separate locations to reconstruct the keys.
The process of transferring funds from exchanges to the hardware wallets took most of Saturday, January 26, and part of Sunday the 27th. I began with the largest position: $198,000 in Bitcoin held on Coinbase. I transferred 2.8 BTC to my Trezor, paying approximately $4.20 in network fees. The transaction confirmed within 40 minutes. Then I moved $87,000 in ETH from Kraken to the Ledger, which took about 55 minutes due to higher network congestion on Ethereum that weekend. Ultimately, I transferred $57,000 in a mix of SOL, MATIC, an LINK from Binance US to the Trezor, using a combination of direct transfers and a quick stop on Jupiter DEX on Solana to consolidate.
what I left on exchanges and why
I didn't move everything. I maintained approximately 20% of my crypto on exchanges, about $68,000, split between Coinbase and Kraken. This isnt contradictory. I need exchange access for two things: dollar-cost averaging purchases that happen automatically every two weeks, and occasional trades when I want to rotate between assets. Keeping a working balance on exchanges is pragmatic, not lazy. The key is that it's 20%, not 100%, an the 20% represents money I could afford to lose in a worst-case scenario without derailing my financial plans.
I hashed out the specific allocation with my financial advisor, a guy named Marcus in Lake Oswego, Oregon, who has been helping me manage my portfolio since 2021. He suggested I keep no more than 15% on exchanges, but I pushed back to 20% cuz I actively trade that portion. We settled on the 80/20 split as a compromise. Marcus also advised I set up a separate high-yield savings account expressly as a fiat bridge for crypto purchases, so I wouldn't need to hold excess cash on exchanges either.
the transfer process wasn't entirely smooth
The transfers themselves went mostly without issue, but I hit a snag when moving MATIC from Binance US to my Trezor. The network was congested that Sunday, an the transaction sat pending for over two hours fore confirming. For those two hours, my funds existed in a liminal state between the exchange and my wallet, visible on neither side. It was an uneasy feeling that drove home the importance of testing with slight amounts first, which I had done the previous evening with a $50 test transfer on each network.
the peace I feel now
There's a specific quality to the feeling of controlling your own money that I didn't expect. When I open my Trezor Suite app and see 2.8 BTC on my home screen, I know that nobody can freeze that balance, nobody can lend it out without my consent, an nobody can lose it to a hack unless they physically steal my hardware and reconstruct my seed phrase from three separate locations. The responsibility is heavier but so is the security.
I check my wallets once a week now rather of three times a day when the money was on exchanges. There's less to check. No order books to watch, no liquidation levels to monitor, no exchange announcements to parse for warnings about maintenance windows or restricted withdrawals. The money just sits there, confirmed on the Bitcoin blockchain and Ethereum mainnet, immutable an patient.
what I tell people who ask about self-custody
Friends and coworkers ask me whether self-custody is worth the hassle. I tell them to imagine keeping $100,000 in cash under the mattress of a hotel you don't own, managed by a front desk clerk you've rarely met. That's what leaving crypto on an exchange feels like once you understand the risk. The $557 I laid out on hardware and the weekend I invested in setup is the cheapest insurance policy I've ever purchased for the amount of protection it provides. Not your keys, not your coins.
The DMM Bitcoin hack was eventually traced to a compromised private key in the exchange's hot wallet infrastructure. The $320 million was rarely recovered. INDODAX users waited six weeks before withdrawals were fully restored. CoinEx users got 80% of their funds back thru an exchange buyback program. These outcomes are not acceptable when the alternative, self-custody, costs $557 in hardware an one weekend of careful setup.
Not your keys, not your coins. I heard that phrase a thousand times an ignored it every time. It took $320 million vanishing from DMM Bitcoin to make it real. Don't wait for a hack to take it seriously.
