Hardware wallets vs exchange custody in Singapore

A hardware wallet is a small computer that keeps private keys off the internet and asks you to confirm sends on a screen you can see. A MAS-licensed exchange is a company that holds keys for you, in a trust arrangement, while you trade and use PayNow. Singapore readers are often sold these as moral opposites. They are not. They fail in different ways, at different times, and the right mix depends on how much you hold, how often you transact, and whether anyone else can recover the setup if you cannot.

MAS does not license your Ledger. That sentence should sit at the top of every forum thread that treats a device unboxing as a regulatory event.

What MAS actually licenses — and what it does not

The Monetary Authority of Singapore licenses persons who carry on a business of providing a digital payment token service, under the Payment Services Act 2019. You can look the operating company up on the Financial Institutions Directory. You can read MAS Notice PSN02 on AML and the PS-G03 consumer-protection guidelines on segregation, statements, and the retail ban on the platform staking your coins.

None of that statute is about a USB-shaped object manufactured in France, Switzerland or the United States. Ledger, Trezor, Coldcard and their peers are consumer devices. If the manufacturer’s shop in another country takes your card, that is a retail sale. It is not onboarding to a DPT service, it is not a risk-awareness assessment, and it does not create a complaints path to MAS when you lose the PIN.

The inverse error is also common. Leaving coins on a licensed book is not “MAS custody” in the sense of a central-bank vault. The licensee should segregate customer assets and use a safeguarding person. MAS has also warned, in plain language, that you may still face significant delays recovering assets if the provider becomes insolvent. A licence is a conduct overlay. It is not a guarantee fund.

So the comparison is: a Singapore-regulated intermediary with legal duties and operational staff, versus a device and a phrase that only you (and anyone who photographs the phrase) control. For the day-to-day process of making that split, read how to store crypto safely in Singapore.

The trade-offs, in SGD terms

Think in scenarios, not slogans.

If the platform fails, coins on the book are in the insolvency. You become a claimant. Segregation should put you ahead of the company’s own creditors. It does not put SGD in your DBS account on Tuesday. If you needed that money for a completion, you have a problem that a licence number will not solve.

If you fail — lost phrase, house fire, phishing, a helper who “tidied” the steel plate — self-custody fails completely. There is no ticket. There is no MAS case officer. The coins remain on the chain, unreachable.

If a travel-rule review holds a withdrawal, exchange custody has converted a liquid-looking balance into a balance you cannot spend until first-line compliance is satisfied. Self-custody after a successful withdrawal does not have that gate. Getting through the gate the first time is still the platform’s process.

If you transact every week, a hardware wallet adds friction that people then defeat by leaving a hot app on the phone “just for small amounts.” That hot app is often where the loss occurs. If you transact twice a year, the friction is the feature.

Price the costs honestly. A reputable device from the official shop is a few hundred Singapore dollars. A 1 per cent instant-buy markup on a S$10,000 purchase is S$100, paid once, which is why how crypto trading fees work belongs in the same household budget as the gadget. An unrecoverable seed is not a fee. It is the principal.

Recovery phrases are the asset

The device is a viewer and a signer. The 12 or 24 words are the wallet. Manufacturers print this in the first screen of the setup flow and users still treat the cardboard as packaging.

The phrase must be generated on the device, on a machine you unboxed, after you verified the holographic seals in the way the manufacturer currently specifies. Write it down offline. Confirm the words on the device. Then store the paper or steel as bearer property. If a setup flow shows you a phrase on a laptop website, you are not in the manufacturer’s flow. You are in someone else’s.

A PIN on the device is a lock on that piece of plastic. It is not a lock on the phrase. Steal the words, and the PIN is irrelevant. Steal the device without the words or the PIN, and the thief has a brick — unless you were sloppy enough to keep the phrase in the same pouch, which is a surprising fraction of airport-security trays.

Passphrases (a 25th word, in some models) add a plausible-deniability layer and a new way to lock yourself out. If you cannot teach your executor the scheme, do not add the scheme. Complexity that you will not rehearse is not security. It is a delayed total loss.

Firmware updates matter. Install them from the manufacturer’s application, over a cable you trust, after checking the version on the manufacturer’s site. Do not install firmware from a Google result titled “Ledger live update 2026.” That is a scam pattern, not IT hygiene.

Why you should not buy a Ledger off Carousell

Pre-seeded devices are a known fraud. The unit arrives shrink-wrapped. The recovery card is already filled in, or a “helpful” slip tells you to enter words that the seller generated last week. You follow the slip because the plastic looked new. Six weeks later the wallet is empty and the listing is gone.

Tampered firmware is the more expensive version of the same idea. You generate what you believe is a fresh seed; the device exfiltrates it or substitutes an address. You cannot see that on a Carousell thumbnail.

Grey-box stock also includes customer returns, display units, and devices that have been opened, resealed and photographed under kitchen lighting. The saving against the official shop is usually less than the cost of a single successful theft. Buy from the manufacturer’s store or from a list of resellers the manufacturer publishes. Have the parcel delivered to an address you control. Do not collect a “sealed” box from a stranger at Tampines MRT.

If you already bought a grey-market unit, do not “just use it for a bit.” Retire it. Buy a clean device. Generate a new seed. Move the coins. The old phrase is compromised whether or not anything has happened yet.

The same rule applies to Telegram “bulk Ledger, factory sealed, GST invoice available.” A GST invoice is not a supply-chain attestation.

When exchange custody is the less-bad option

Self-custody is the wrong tool for a balance you are about to sell, for a person who will not rehearse a recovery, and for a household that cannot store a steel plate without it becoming family folklore. A licensed Singapore book, with authenticator 2FA, a withdrawal whitelist, and a working FAST off-ramp in your own name, is then the adult arrangement.

It is also the less-bad option for sums so small that the operational overhead of a device exceeds the platform risk. There is no prize for hardware-walletting S$180 of leftover altcoins.

What exchange custody is not: a place to leave a life-changing amount because the app is convenient, or because you have not got round to buying a device, or because a YouTuber said MAS “guarantees” customer assets. Read the licensee’s Singapore terms. Read the risk-awareness assessment you clicked through. Size the working balance as money you can have frozen for a week without missing a mortgage GIRO.

If you do move coins off the book, complete proof of control and a small test send first. Whitelist the address. Do not combine a first-time hardware setup with a first-time travel-rule withdrawal at 11pm. The storage guide walks through the operational order; this piece is the decision, not the checklist.

Nothing here is a recommendation to buy a device, a token, or a platform product. MAS does not license the gadget. The Financial Institutions Directory does not list it. Your recovery phrase is not a customer asset of anyone but you.