How much crypto should you keep on an exchange? Wrong question first

On forums the answer always lands the same way: not your keys, not your coins, take it all out. That is a slogan, not a plan. Before settling on an amount you need to know what you are defending against, and most people are aiming at the wrong threat.

What actually empties accounts

The picture in everyone's head is the exchange getting breached and collapsing. It happens, the sector's history is full of it. But it is almost never what hits an individual in 2026. Large licensed platforms are under constant attack and hold up.

What empties accounts is takeover of the account itself. Four scenarios come up again and again:

  • The SIM swap. Someone has your number moved to their card, receives your SMS codes and drains the account. Your SMS two-factor becomes their tool.
  • Phishing. A fake login page, often reached from a sponsored search result or a message. You type your credentials straight into the attacker's form.
  • Malware. It captures the session, or swaps the withdrawal address in your clipboard at the moment you paste it.
  • The reused password. A breach on an unrelated site, years old, replayed against your crypto account.

In all four the platform was not penetrated. Access was bypassed. That reverses the order of priorities entirely: locking down your access is worth more than moving your funds.

How much to keep on an exchange: What actually empties accounts, Lock down access before discussing amounts, The question that sets the amount, Do not depend on a single operator.
Accounts are almost always lost through access, not through the platform. The priorities follow from that.

Lock down access before discussing amounts

Four settings cover the bulk of it, and they take about twenty minutes. Do them before moving anything, otherwise you are just relocating the problem.

  1. Two-factor through an app or a hardware key, never SMS. SMS falls with a SIM swap, and that is precisely the most common scenario.
  2. Withdrawal address allowlist. A withdrawal to an unknown address becomes impossible even with your password in hand. It is the most underused and most effective setting available.
  3. A dedicated email address for that account, never published, with its own unique password. The mailbox is the back door to every account; if it falls, the rest follows.
  4. A security delay after any change to sensitive settings, wherever the platform offers it. It turns an instant theft into one you can interrupt.

The question that sets the amount

Once access is locked down, the amount gets decided without any universal percentage. The question that settles it is simple: if that balance vanished tonight, would it change your life? If the answer is yes, it is too large.

Capital used for active trading belongs on a platform, it is the tool for the job, and pulling it out would make no sense. Capital sitting untouched for three years has no reason to stay: it accumulates risk with nothing in return, since you are not using it.

A hardware wallet, for its part, is not mandatory from the first euro. It moves the risk rather than removing it: you become solely responsible for your recovery phrase, and losing it is as final as theft. Below an amount that would genuinely hurt, the effort and the chance of error outweigh the benefit. Above it, the trade flips. We covered the setup in our security guide.

Do not depend on a single operator

One last point, and it has nothing to do with platform quality. Even a licensed, well-run platform can freeze an account during a verification, go down on a volatile day, or close its service in your country. Binance did exactly that in France on 1 July 2026, affecting roughly two million users, with no security incident involved at all.

Two accounts on two different licensed entities remove that single point of failure. It is the setup we run, and it costs twenty minutes of account opening.

One account covering both needs

OKX is MiCA-licensed through OKX Europe Ltd and carries a Web3 wallet inside the same app: the trading balance stays on the platform, the held portion moves into a wallet whose keys you control, without switching tools.

Open an OKX account

Where to go next: the European regulatory framework and what it really guarantees in our MiCA scorecard, the full procedure if you need to pull funds off a platform that is closing in the exit guide, and the licensed platforms compared in the ranking.

Frequently asked

How much should you keep on an exchange?

What you actually intend to use over the coming weeks, and nothing more. The rule that works is not a universal percentage but a question: if that balance vanished tonight, would it change your life? If yes, it is too large. Capital used for active trading belongs on a platform, it is the tool for the job. Capital sitting untouched for three years has no reason to stay there, it only accumulates risk with nothing in return.

Is the real risk the exchange getting hacked?

Rarely, and this is the most expensive misconception in the space. Large licensed platforms are attacked constantly and hold up. What empties retail accounts is takeover of the account itself: SIM swaps intercepting SMS codes, phishing on a fake login page, malware capturing the session, passwords reused from an old breach. In every one of those cases the platform was not penetrated, you were bypassed. That flips the priorities: locking down access pays off more than moving funds.

How do you actually secure the account?

Four settings cover the bulk of it. One, two-factor authentication through a dedicated app or a hardware key, never SMS, because SMS falls with a SIM swap. Two, a withdrawal address allowlist, which makes a withdrawal to an unknown address impossible even with your password. Three, an email address reserved for that account, never published anywhere, with its own unique password. Four, a security delay after any change to sensitive settings, enabled wherever the platform offers it. Those four take twenty minutes and block almost every real-world scenario.

Do you need a hardware wallet straight away?

Not for two hundred euros. A personal wallet moves the risk rather than removing it: you become solely responsible for your recovery phrase, and losing it is as final as theft. Below an amount that would genuinely hurt to lose, the effort and the chance of error outweigh the benefit. Above it, the trade flips and a personal wallet becomes the right tool. The threshold is personal, but one question settles it: how much could you lose without it changing your plans?

Is it better to split across several platforms?

Yes, once the amounts get meaningful, and for a reason that has nothing to do with platform quality. Even a licensed, well-run platform can freeze an account during a verification, go down on a volatile day, or close its service in your country the way Binance did in France on 1 July 2026. Depending on a single operator means accepting that its incident becomes yours. Two accounts on two different licensed entities remove that single point of failure.

Transparency: OKX is our lead partner and the link above is an affiliate link, paying us a commission at no extra cost to you. This article describes security practices, it is not investment advice. Crypto assets can wipe out your capital.

Sources: AMF statement on the transitional period ending 1 July 2026; MFSA register for the OKX Europe authorisation.

Back to all resources