01 /
Wallet or exchange: who really holds your keys
When you buy bitcoin on an exchange and leave it there, what you see in the app is a balance: in practice, a debt the exchange owes you. The private keys that move those bitcoins are controlled by the platform. If it goes bust, gets hacked or freezes your account, you depend on it to get your money back. With a wallet of your own, what's known as self-custody, the keys are yours and no middleman can freeze anything. Then again, there's nobody to call if you lose them.
Hence the most repeated saying in Bitcoin: “not your keys, not your coins.” It doesn't mean exchanges are the enemy; it means custody is a risk and you should know who's carrying it. History has no shortage of examples. Mt. Gox, which in early 2014 handled more than 70% of all bitcoin transactions, suspended trading in February of that year and filed for bankruptcy with hundreds of thousands of bitcoins missing. FTX collapsed in November 2022, when a rush of withdrawals exposed a hole of about $8 billion, and its customers were left unable to get their money out.
In “Wallet vs Exchange” I explain it clearly and without the mess: which one is safer, when to use each and how to protect your money so nobody can take it from you.
02 /
The seed phrase: dos and don'ts
The seed phrase, or recovery phrase, is usually 12 or 24 words taken from a standard list of 2,048 (the BIP-39 standard allows anything from 12 to 24). Every key in your wallet is derived from it. Whoever has those words has your funds, from any device in the world, without needing your phone or your password. And if you lose it and your device breaks too, there's no way back. The EU supervisory authorities say it bluntly: losing your private keys results in the permanent and irreversible loss of access to your crypto-assets and of their ownership.
Do
- Write it by hand on paper or stamp it into metal, in the exact order, checking every word.
- Keep two copies in different places, away from water, fire and prying eyes.
- Run a test: restore the wallet from the phrase and send a small amount before moving the real money.
- Consider an extra passphrase for serious amounts, knowing that if you forget it there's no way back either.
Don't
- No photos, no screenshots, no phone notes, no cloud, no email and no browser password manager.
- Never type it into a website, form or app that asks for it “to verify” or “to sync” anything.
- Never give it to anyone: no legitimate support team, from any manufacturer or any exchange, will ever ask for it.
- Don't use a phrase that comes pre-written inside the device's box.
Never enter or share your recovery phrase (seed phrase) in any app, on any website or with anyone.
My MetaMask tutorial has a whole chapter on storing the seed phrase without messing it up, plus how to create the wallet step by step and how to move funds from the exchange to MetaMask and back again to sell. One detail I repeat in the description: download it only from its official website.
Chapters (5)
03 /
Cold or hot wallet: which one you actually need
A hot wallet keeps the keys on an internet-connected device: a phone app or a browser extension. It's free and convenient, perfect for everyday use. A cold wallet keeps the keys on a device that signs transactions without exposing them to the internet. It's less convenient and costs money, but it shrinks the attack surface enormously. There's no single best option for everyone: there's a best one for you, depending on how much money you have and how you use it.
Chapters (7)
If you already know which type you want, I have two rankings: the five best hot wallets of 2026 (the free, everyday ones) and the five best cold wallets, with their real drawbacks and their prices. One rule I repeat in both: buy the device only from the manufacturer's official website, never second-hand or from third parties. To go deeper, the hot vs cold wallet guide covers it at a slower pace.
The two 2026 rankings: hot wallets and cold wallets
Las 5 MEJORES wallets calientes para tus criptos en 2026 (cuál elegir sin liarte)
· 2,929 views
Las 5 MEJORES wallets frías para proteger tus criptos en 2026 (máxima seguridad)
· 718 views
A split that works for a lot of people: on the exchange, only what you're going to trade; in the hot wallet, what you'll spend or move during the month; in the cold wallet, your savings. It's a habit, not a rule, but it forces you to think about each pocket separately.
04 /
The Coldcard case: it wasn't the chip, it was the seed
In late July 2026, Coinkite, the maker of Coldcard, published a security advisory. A firmware build error caused several models to generate seeds with a weak software random number generator instead of the intended hardware one. On the affected Mk4, Mk5 and Q, seeds had about 72 bits of entropy instead of the expected 128, and on the Mk2 and Mk3 running firmware 4.0.1 to 4.1.9 the problem was even worse. With so little randomness, an attacker can brute-force the keys without ever touching the device. According to blockchain analytics firm TRM Labs, by early August about 1,816 BTC, more than $100 million, had been drained from more than 5,200 addresses.
What didn't happen matters just as much. Coinkite made it clear the devices weren't hacked or controlled remotely, and Bitcoin's cryptography is intact: the flaw was in the moment the seed was created. That's why updating the firmware fixes nothing if your seed was already generated with an affected version; you have to create a new one and move the funds. Seeds generated with at least 50 dice rolls of your own aren't affected.
Chapters (6)
In the short I boiled it down to four steps for checking whether your wallet is affected:
- 01
Check which firmware you used to create it
What matters is the version you generated the seed with, not the one you run today.
- 02
Read Coinkite's official advisory
It lists the affected versions. Type the address yourself: in situations like this, fake sites pop up that imitate the real one.
- 03
If you're on the list, migrate now
Create a new wallet with independent entropy, for example with dice, and move the funds.
- 04
Add another layer
A passphrase or a multisignature (multisig) setup means a single seed is no longer enough to empty your wallet.
The lesson goes beyond one brand: a cold wallet isn't infallible, it's only as secure as the seed it generates. And here's one people tend to forget: in the short I mention that Galaxy Research spotted a wave of sweeps aimed at small balances. Thinking “I have too little for anyone to come after me” doesn't protect you.
05 /
MiCA in plain English
MiCA is Regulation (EU) 2023/1114, the EU's law on crypto-assets. The rules on stablecoins have applied since June 30, 2024, and the rest, including those for exchanges and custodians, since December 30, 2024. Its core idea is simple: to provide crypto-asset services in the EU (custody, buying and selling, exchanging one asset for another) you need authorization as a crypto-asset service provider, a CASP in the jargon. With that authorization, a firm can also serve customers in other EU countries after notifying its home regulator, the so-called European passport.
For you as a customer, the most useful part concerns custody. An authorized provider must keep your crypto separate from its own, so its creditors can't claim it if it goes bust; it is liable for losses attributable to it, up to the market value of what was lost; and it must send you a statement of your positions at least every three months. What MiCA doesn't give you: an investor compensation scheme like the ones behind other financial products, or any protection at all against the price collapsing.
There was a transition period. Firms already operating legally under national rules before December 30, 2024 could carry on until July 1, 2026 at the latest, and each country could shorten that window. Spain chose the full 18 months, with the CNMV, Spain's securities regulator, as the competent authority. The Netherlands, by contrast, settled on 6. In April 2026 ESMA put it in writing: since July 1, 2026, anyone providing crypto-asset services to EU customers without a MiCA license is in breach of EU law and must stop.
Jul 1, 2026
end of MiCA's transitional period in Spain (18 months)
359
authorized providers in ESMA's interim register as of Sep 30, 2026
15
of them authorized by Spain's CNMV
€1,000
above this amount, the exchange must check that your wallet is yours
06 /
Binance and July 1, 2026
The case that made the most noise was Binance. In June 2026 it withdrew the MiCA license application it had filed in Greece and emailed its European users, including those in Spain, to say it was restricting services. From July 1 it paused its crypto services for EU customers, with no new sign-ups or deposits, although funds remained available for withdrawal, and said it was confident of securing a license in the following months. As of September 30, 2026, Binance did not appear in ESMA's interim register.
I published the video on June 30, right before the deadline: what MiCA is and why it exists, the Binance case and what was happening on July 1, how to protect your crypto in three steps and the detail about Hacienda, Spain's tax agency, that nobody tells you.
Chapters (5)
In June 2026 ESMA spelled out what platforms left without a license must do: stop taking on new customers and limit themselves to letting you sell, withdraw or close positions, holding your crypto only for as long as strictly necessary for an orderly exit. Their customers, moreover, don't get MiCA's protections. If you have a balance on a platform like that, the official advice is to move it to an authorized provider or to a wallet of your own. Do it calmly but don't let it slide: rushing is when people paste the wrong address.
When you withdraw to your wallet you may be asked to prove it's yours. It isn't a whim: Regulation (EU) 2023/1113, applicable since December 30, 2024, requires providers to check that a self-hosted address belongs to their customer when a transfer exceeds €1,000.
07 /
How to check whether an exchange is authorized
Five minutes of checking will spare you a lot of grief. The golden rule: look up the company, not the brand. The same brand can operate through several companies in different countries, and only the one listed in the register is authorized.
- 01
Find the legal entity
The platform's terms and conditions name the company providing the service and its country.
- 02
Look it up in ESMA's register
ESMA's interim MiCA register publishes a file every week with the providers authorized in the EU: name, authority, date, services and the countries where it offers them.
- 03
Check it with the CNMV
If it operates from Spain, the CNMV keeps its own register of crypto-asset service providers, linked from its MiCA page (in Spanish).
- 04
See which services it's authorized for
It may be authorized for custody and exchange, but not for everything the app offers you.
- 05
Review the warnings
ESMA also publishes a list of non-compliant entities, and the CNMV publishes its warnings about unauthorized firms.
- 06
Always type the address yourself
No links from ads, messages or search engines: cloned sites exist for exactly that.
Before MiCA, Spain had another list: the Banco de España register of virtual currency exchange and custody providers. It was an anti-money-laundering register, not a license to operate, and it has accepted no new entries since December 30, 2024. If a website shows you that register as if it were a MiCA license, be suspicious.
If you're shopping for a platform, in “Los 3 MEJORES Exchanges de criptomonedas en 2026 (con licencia MiCA)” (the 3 best crypto exchanges of 2026, with a MiCA license) I compare three with a confirmed MiCA license: which is the safest, which suits you best if you're based in Spain and which has the lowest fees, with their pros and cons. And in the OKX tutorial I walk through the whole process with euros, from signing up and verification to buying, selling and sending, plus what MiCA means for you. The legal background is covered in more depth in the exchanges and MiCA guide.
Exchanges with a MiCA license: comparison and step-by-step tutorial
Los 3 MEJORES Exchanges de criptomonedas en 2026 (con licencia MiCA)
· 1,171 views
OKX Tutorial 2026: Cómo Registrarse, Comprar y Vender con Euros | Ley MiCA
· 566 views
08 /
The scams that empty the most wallets
Most thefts don't break any cryptography. They trick you into doing the work yourself: typing the seed phrase where you shouldn't, signing what you shouldn't or sending to the wrong address. These are the patterns that come up again and again.
- Fake apps
- In April 2026, a fake “Ledger Live” app for Mac showed up in Apple's App Store and, by asking for the recovery phrase, stole about $9.5 million from roughly 50 people, according to BleepingComputer. Ledger only distributes its Mac app from its official website.
- Phishing and cloned sites
- Emails, texts and ads that imitate your exchange or your wallet so you log in or “verify” your account. Spain's national cybersecurity institute, INCIBE, recommends always turning on two-factor authentication (2FA) and downloading apps only from official sources.
- Fake support
- Someone messages you on Telegram, Discord or X “to help” with a problem you never reported. They ask for your seed phrase or want you to install a remote-access app. Real support doesn't do that.
- Address poisoning
- You receive a tiny transaction from an address almost identical to one you use, with the same beginning and end, so that you'll copy it from your history. A 2025 study counted 270 million attempts and at least $83.8 million lost on Ethereum and BNB Smart Chain.
- Miracle investments
- High returns “with no risk,” pressure to get in fast and celebrities who never said any of it. Those are the first red flags INCIBE points to.
- Recovery room
- After a scam, someone shows up promising to recover your money in exchange for an upfront payment. That's the second scam. The CNMV reminds people that it never contacts victims to recover their losses.
In the shorts you'll find three quick warnings: the fake Ledger app, why anonymity and greed make the perfect storm for scammers, and how the mixers used to hide the trail of Bitcoin transactions work. They make tracing harder, but they aren't foolproof, so reporting always makes sense.
Three minutes that could save you a nasty surprise
Una app falsa de Ledger llegó a la App Store. Descubre cómo evitar esta estafa. #Shorts #cripto
· 317 views
Estafas Cripto: ¡No seas la próxima víctima! #shorts
· 376 views
Cómo Los Mixers Hacen Invisibles Tus Transacciones Bitcoin #shorts
· 791 views
09 /
Checklist before you move a single euro
- Check the specific company you're going to deal with in ESMA's register or the CNMV's.
- Turn on two-factor authentication with an authenticator app and use a unique password for the exchange.
- Leave on the exchange only what you're going to trade; the rest goes in your wallet.
- Write the seed phrase by hand, keep two copies and test the restore with a small amount.
- Buy your cold wallet only from the manufacturer's official website.
- Before a large transfer, send a test amount and check the whole address, not just the beginning and the end.
- Never share your seed phrase or install remote-access apps because someone asks you to.
- If an offer promises a lot, fast and with no risk, you already know the answer.
If you're just starting out, the guide on how to start in crypto puts the first steps in order, the glossary translates the jargon and the videos for beginners cover the rest of the basics.
FAQ /