Free guide · 10 min · facts checked 13 October 2026

Where your bitcoin actually is, and how people lose it

Almost every avoidable loss comes from one misunderstanding: people think a wallet contains bitcoins. It does not. Once you know what it really holds, the rest of the subject falls into place.

Your bitcoin is on a ledger, not in a wallet

Bitcoins are recorded on a public ledger, next to addresses. A wallet holds one thing only: the keys that allow those coins to be moved. Lose the wallet and keep the keys, and nothing is lost. Lose the keys and keep the wallet, and everything is.

The clearest demonstration is a British court case. On 5 August 2013, a hard drive holding the keys to 8,000 bitcoins was thrown away by mistake and ended up in a landfill in Newport, Wales. On 9 January 2025, a court dismissed its former owner’s claim to recover it or to search the site, finding that the drive belongs to the local authority. According to his claim, the bitcoins are still at their original addresses on the public ledger. The ledger is intact. Nobody can move them.

Three words people mix up

• The private key is a very large secret number. It signs a transfer. Whoever knows it can spend the funds.
• The address is derived from the key. It can be shared safely, like a bank account number: it lets people send to you, not spend from you.
• The seed phrase, also called recovery phrase, is a list of words, most often 12 or 24, drawn from a standard list of 2,048 words. It lets a wallet recompute all of its keys.

The seed phrase is the wallet. The device or app can be lost, broken or replaced; with the phrase, everything is rebuilt. Without it, nothing is. There is no “forgot my password”, no customer service and no appeal: a lost phrase makes the funds unreachable for good, and a phrase copied by someone else gives them the funds, with no way for you to stop them.

An exchange holds the key, or you do

There are two ways to hold bitcoin, and neither is risk-free. They move the risk from one place to another.

If an exchange holds the keys, you log in with a username and password you can reset. That convenience is exactly the risk: you depend on a company. Two well-documented collapses show what that means.

• Mt. Gox. On 7 February 2014, a major bitcoin exchange suspended withdrawals. On 28 February it announced that about 850,000 bitcoins were missing, of which 200,000 were later found. In October 2025 the trustee pushed the repayment deadline back again, to 31 October 2026. More than twelve years after the collapse, creditors were still waiting.
• FTX. In November 2022, one of the largest exchanges collapsed within days and filed for bankruptcy on the 11th. Its founder was sentenced to 25 years in prison in March 2024; prosecutors accused him of taking more than $8 billion from customers.

FTX also teaches a subtler lesson. According to the fund in charge of repayments, customers had received a total of 105% of their claim after the distribution of 31 July 2026. But that claim was calculated in dollars at November 2022 prices, close to a market low. A customer who had deposited one bitcoin received its value of that day. They did not get a bitcoin back.

Regulation changes part of this. In the European Union, the MiCA regulation requires authorised providers to keep customers’ assets legally separate from their own, and makes them liable for crypto-assets lost through their own fault, up to the market value at the time of the loss. That reduces the risk; it does not remove it. Crypto-assets are covered neither by deposit guarantee nor by an investor compensation scheme. Rules differ by country and they change: check your own financial regulator’s official register before using any provider.

If you hold the keys, no third party can fail on you, and in exchange every mistake is yours: a lost phrase, a stolen phrase, a transfer sent to the wrong address, physical coercion, or death without a handover plan. Which option is safer depends entirely on how organised the person is.

Choose by threat, not by brand

The useful question is never “which wallet is best?”. It is “what am I protecting against?”.

A dedicated device only helps if you read its screen before approving. The amount and address that count are the ones it shows, not the ones on the computer. On 21 February 2025, an exchange approved what it believed was a routine transfer between two of its own wallets; about $1.5 billion went elsewhere. The keys were offline. According to the analytics firm Chainalysis, the signing interface was compromised and displayed a legitimate-looking operation. The FBI attributed the theft to North Korea.

The twelve habits that matter

Security does not rest on a tool but on habits. Tick the ones you already apply; the rest is your to-do list.

1. My seed phrase is written by hand on a durable medium. It is not photographed, and not in an online service, an email or a notes app.
2. I keep two copies, in two different places.
3. I tested a full restore before depositing a significant sum.
4. I enter my phrase on no website and tell it to no one. No legitimate support asks for it.
5. I use an email address reserved for my platform accounts.
6. Each account has a unique password, kept in a password manager.
7. Two-factor authentication uses an app or a physical key, not SMS.
8. Before a withdrawal, I check the start, middle and end of the address, then send a small amount first.
9. My devices and software are up to date and downloaded from the official source, whose address I type myself.
10. When the platform allows it, only withdrawal addresses registered in advance are permitted.
11. I do not talk about my holdings, online or around me.
12. A way to pass things on exists, and the person named knows what to do.

The last two are the ones people skip. Discretion is a protective habit, not modesty: on 20 December 2020, a customer database stolen from a wallet maker was published online, with one million email addresses and, for about 272,000 customers, name, postal address and phone number. According to the maker, no device was compromised. Those customers then received very credible fake messages demanding their 24 words, and the leak also revealed who owned a wallet and where they lived. In January 2025, a co-founder of that same maker and his partner were kidnapped at their home; both were found within days after a police operation.

And the handover: a bank keeps a record of who owns an account, while bitcoin held with its own keys leaves no such record anywhere. Without the phrase nobody has access; with the phrase anybody has access. That is why a letter of instructions explains what exists and how to proceed, and never contains the phrase itself. Whatever the arrangement, test it: the person you name should be able to explain, without you, what they would do.