Crypto Wallets and Custody: A Maryland Owner's Guide

Almost all wallet confusion comes from one misunderstanding: a wallet does not store your cryptocurrency. The coins live on a public ledger. A wallet stores the private key that proves you may move them. Whoever controls that key controls the coins, permanently and without appeal.

From there, everything follows.

The practical answer for most Maryland readers: keep on an exchange only what you are actively trading, use a software wallet for small on-chain amounts if you need one, and move long-term holdings to a hardware wallet. A hardware device costs less than a nice dinner out and eliminates the largest single category of avoidable loss.

The threshold is personal. A useful test: if the balance disappearing tomorrow would ruin your month, it belongs on hardware you control.

When you set up a self-custody wallet, it generates twelve or twenty-four words. That phrase is your wallet. Anyone who has it can recreate your wallet on any device anywhere in the world and take everything in it. Nobody who lacks it can recover your funds, including you.

There is no password reset, no customer service, no appeal, no insurance. This property is the entire point of self-custody and it is also the entire risk.

What to do:

• Write it on paper immediately, by hand, at setup. Check every word.
• Make two copies and store them in physically separate locations — not two drawers in the same house.
• Use metal for meaningful amounts. Stamped or engraved steel plates survive fire and immersion. Paper survives neither. They cost less than the hardware wallet.
• Test the backup before funding it heavily. Wipe the device and restore from the phrase. A backup you have never tested is a hypothesis, not a backup.
• Tell one trusted person the assets exist and who to contact for help — without giving them the phrase itself.

What never to do:

• Photograph it. Phone photos sync to cloud accounts that get compromised.
• Store it in cloud notes, a password manager, an email to yourself, or a text file.
• Type it into any website, app, "wallet validator", "migration tool" or support form. There has never been a legitimate reason to do this.
• Read it aloud to anyone on the phone, however convincing.
• Put it in your will. Wills become public record during probate.

Generic wallet advice says "store it somewhere safe" and stops. That is not enough, and Maryland gives us a concrete reason to say so.

Ellicott City was devastated by flash flooding in July 2016 and again in May 2018. Businesses that had operated on Main Street for decades lost everything on the ground floor within minutes. Nobody involved had planned for water arriving that fast.

Now apply that to a recovery phrase in a desk drawer. It is a perfectly good defence against a hacker on the other side of the world and no defence at all against water, fire, or a building you are not allowed back into. The failure is total and permanent — you can watch the balance on a public block explorer forever and never touch it.

What good physical storage looks like:

• Two copies minimum, in physically separate buildings. One at home, one somewhere a local event would not reach — a bank safe deposit box, a relative in another county.
• Metal over paper where the amount justifies it. Fire and flood are the two realistic Maryland threats and metal survives both.
• Not in an obvious place. A desk drawer, a bedside table and a filing cabinet marked "important" are the first three places anyone looks.
• Not somewhere a contractor, cleaner or houseguest will encounter it.
• Consider splitting the phrase only if you genuinely understand the scheme you are using. Naively tearing a phrase in half often makes recovery harder without making theft meaningfully harder.

Rural and suburban Maryland households often have better options here than city apartments — outbuildings, safes, physical separation between structures. Our Carroll County and Washington County guides discuss this. Use the advantage if you have it.

Self-custody protects the coins you have moved. Your exchange account still needs protecting, because that is where new purchases land and where an attacker can drain funds before you notice.

Stop using SMS two-factor authentication. This is the highest-value change most people can make. SIM swapping — where an attacker persuades a mobile carrier to port your number to their device — defeats text-message codes entirely and is a routine attack against crypto accounts. Move to an authenticator app at minimum, and to a hardware security key if the platform supports one.

Use a unique password. Not a variation of one you use elsewhere. A password manager is fine for this — the thing a password manager must never hold is your recovery phrase.

Turn on withdrawal address allowlisting if the platform offers it. Most add a time delay before a new address can be used, which turns an instant theft into one you have hours to notice and stop.

Use a dedicated email address for financial accounts, with its own strong password and its own two-factor. Email is the master key to most account recovery flows.

Be suspicious of urgency. Every account-takeover attempt involves manufactured time pressure — a suspicious login, an expiring verification, an account about to be frozen. Exchanges do not call you. If you receive a call claiming to be from one, hang up and log in yourself through an address you typed.

Our Gaithersburg guide goes further into practical security, which felt like the right place for it given NIST is headquartered there.

This is the section people skip and the one that permanently destroys the most value. It deserves fifteen minutes of your attention.

If you hold your own keys and nobody else can reach them, your crypto does not pass to your family. It is not lost in the sense of being stolen — it sits on the ledger, visible to anyone who looks, and unreachable forever. Estates have watched this happen with substantial sums.

The legal side. Maryland has adopted a version of the Uniform Fiduciary Access to Digital Assets framework, which gives a personal representative a legal route to digital property. That solves the question of whether your executor may access the assets. It does nothing about how. A representative with full legal authority and no recovery phrase is exactly as stuck as one with neither.

The practical side, which is the part that matters:

1. Write a memorandum, stored with your estate papersIt should state that digital assets exist, roughly what they are, where the hardware and backups are located in general terms, and who to contact for technical help. It should not contain the recovery phrase.
2. Store the phrase where a fiduciary can reach it with proper authorityA bank safe deposit box, a solicitor's strongroom, or a sealed instruction with an attorney. The point is that access requires legal authority rather than merely finding it.
3. Never put a recovery phrase in a willWills become public record in probate. A phrase in a will is a phrase published to the world.
4. Tell at least one person the assets existAn heir who does not know to look will not look. This is the most common failure of all and it costs nothing to fix.
5. Involve a Maryland estate attorney who has handled digital assetsThis is a specialism. Ask directly whether they have done it before.
6. Review it when anything changesNew wallet, new exchange, new hardware, moved house. An out-of-date memorandum is worse than none, because it sends people looking in the wrong place.

For larger positions, a qualified custodian is worth considering precisely because it puts a legal entity between your estate and the assets — one that can be served process and can verify authority through a normal legal process.

We deliberately do not publish a ranked list of wallet brands. Devices and apps change faster than any page can track, and a stale recommendation in this category is actively dangerous. What we will give you are the criteria that do not change.

For a hardware wallet:

• Buy directly from the manufacturer. Never from a marketplace, never second-hand, never from an eBay listing. Supply-chain tampering on hardware wallets is a documented attack.
• The device must generate the phrase itself. If a device arrives with a pre-printed recovery phrase, it is compromised. No exceptions.
• Prefer established manufacturers with a long track record and open, reviewable firmware practices.
• Check it supports the assets you actually hold before buying.

For a software wallet:

• Download only from the official site or the official app store listing. Fake wallet apps are a persistent problem in both major app stores.
• Prefer open-source projects with an active development history you can inspect.
• Be wary of anything new and heavily promoted. Wallets that appear alongside an aggressive marketing campaign deserve more scepticism than ones that have quietly existed for years.

For everyone: send a small test transaction first, always, on every new wallet and every new address. It costs cents and it is the only way to confirm the whole chain works — the address is right, the network is right, and you can actually see the funds arrive.

Once your wallet is set up, the buying side is covered on our top 10 exchanges page, and the tax records you should keep alongside it on our Maryland tax page.