How to store crypto safely in Singapore

Most Singapore readers do not lose coins because a protocol failed. They lose them because a password sat in a browser, a seed phrase sat in iCloud, a “support agent” asked them to read 12 words, or a platform they had never checked on the MAS directory froze a withdrawal they needed on Monday. Storage is not a personality test between “not your keys, not your coins” and “I trust the bank.” It is an operational choice about which risks you can actually live with, in Singapore dollars, under MAS rules.

This is a custody guide, not a recommendation to buy any token, and not a promise that any setup is theft-proof. If you do not yet hold coins, the buying decision is a separate article. If you already hold them, the job is to stop a preventable loss.

Exchange custody versus self-custody

A MAS-licensed DPT platform holds customer assets under consumer-protection expectations that took effect in stages from October 2024 and June 2025. Customer tokens should be segregated, held in a trust arrangement with a safeguarding person, and reported to you on a statement of account. Retail customers should not have their assets lent or staked out from under them. That is a higher bar than an anonymous overseas book. It is not a deposit, it is not SDIC-insured, and MAS has been explicit that insolvency can still mean delay.

Self-custody — a hardware wallet, or a well-built software wallet whose keys never left your device — removes the platform as a credit risk. It introduces a different one: you. There is no password-reset email. There is no MAS complaints process that can reconstruct a discarded seed. The hardware wallet versus exchange custody trade-off is not ideological. It is “who fails, and how badly.”

A split that this desk sees work in practice is boring. Keep on a licensed Singapore book only what you intend to trade or to sell back into SGD in the next settlement cycle. Move a longer-term holding to a device you bought from the manufacturer’s shop, after you have practised a small withdrawal and a small receive. Do not empty an account you still need for PayNow buys, and do not self-custody a size you have never restored from backup.

Look up the operating company on the Financial Institutions Directory before you treat the book as “safe because it is in Singapore.” A brand on the Investor Alert List is not a custody venue.

Two-factor authentication that is actually worth using

SMS one-time passwords are better than nothing and worse than a dedicated authenticator. SIM-swap fraud against Singapore numbers is not theoretical. If your exchange login, your email, and your phone number all reset through the same Singtel or StarHub SIM, an attacker who captures the SIM captures the account.

Use an authenticator app on a device you control, not an SMS. Turn on withdrawal whitelists so a new address cannot be added without a time delay and a second factor. Lock the email inbox that receives password resets with its own authenticator, not with the same SMS. Passkeys, where a platform offers them, are preferable to reused passwords stored in a browser.

Anti-phishing codes — a word you set that the real platform reprints on every genuine email — are worth the two minutes. Cloned apps and lookalike domains are a staple of the local scam set; see crypto scams targeting Singaporeans. Download the iOS or Android app from the link on the licensee’s own site, not from a Google advertisement.

2FA does not help if you approve a transaction you did not create. Read the address on the hardware wallet screen, not on the laptop that may be showing you a substituted QR. A compromised browser can show a correct-looking destination and put a different one on the wire.

Where not to keep a seed phrase

A recovery phrase is not a reminder. It is the private keys, written in a standardised word list. Anyone who photographs it can empty the wallet later from another country. That is why it does not belong in Apple Notes, Google Drive, iCloud Photos, WhatsApp saved messages, email drafts, or a screenshot labelled seed.jpg.

Cloud backups of those apps are the actual vulnerability. You are not defending against a genius. You are defending against a phished iCloud prompt, a reused password, a stolen laptop that was still logged in, or a “Microsoft support” caller who asks you to read the words “to verify the wallet.”

Write the phrase once, on paper or on a steel plate sold for that purpose, and store it as you would store traveller’s cheques you could not cancel. A home safe is a start. A sealed envelope with a solicitor or a trusted family member is a start. Splitting the phrase across two locations so that a single burglary or a single HDB fire does not finish you is a start. Laminating it and leaving it in a drawer under the passports is how coins disappear during a renovation.

Never type the phrase into a website to “check validity.” Never read it aloud on a call. Never photograph it “just for tonight.” If you have already stored it in Notes, the remediation is to generate a new wallet on a clean device, send a test amount, send the rest, and retire the old seed. Do not copy-paste the old phrase into a new app and hope.

Inheritance if something happens to you

Singapore probate will not discover a 24-word phrase taped behind a wardrobe. If you die, or if you are incapacitated, someone you trust needs a way to find the asset without that knowledge already living on their phone.

For exchange balances, your executor works through the platform’s deceased-user process with a death certificate and a grant of probate or letters of administration. That process is slow and document-heavy. It exists. For self-custodied coins it does not, unless you have left instructions.

Do not put the seed in the will. Wills are read, copied and filed. Put in the will, or in a letter of wishes, the fact that a digital-asset inventory exists and where the sealed instructions are kept. The instructions themselves can sit with a solicitor, in a safe-deposit box, or with an executor who already understands they are accepting a bearer instrument. Test the process while you are alive: can that person locate the device, the PIN, and the backup, and complete a small send?

If the answer is no, you do not have an inheritance plan. You have a collection of gadgets. CPF nominations and bank joint accounts do not extend to a Ledger. Treat this as an estate-administration problem, not a crypto-Twitter problem.

Travelling through Changi with a hardware wallet

A hardware wallet is allowed through Changi. It looks like a USB stick. ICA and Singapore Customs are interested in goods, dutiable items, and the cross-border cash reporting regime for physical currency and bearer negotiable instruments of S$20,000 or more. A device that stores keys is not cash. You still answer questions honestly if an officer asks what the object is: a cryptographic key-storage device for digital tokens you already own.

Do not travel with the recovery phrase in the same bag, or at all if you can avoid it. A phrase on paper in hold luggage is a gift to whoever opens the suitcase. A phrase in your phone’s camera roll is how a lost phone becomes an emptied wallet. The device can be replaced. The phrase cannot. If you need to transact on the trip, take the device and leave the backup in Singapore.

Do not unlock the wallet for a stranger, a “security contractor,” or a helpful person at the charging station. Do not plug it into a public USB port. Airport charging stations have a long and dull history of being the wrong place to insert anything that holds keys. If you must top up a phone, use your own charger and a wall socket.

Declare what you are asked to declare. Do not volunteer a seed phrase, a PIN, or a portfolio value to someone who has not identified themselves as an officer. A hardware wallet is not a crime. Treating every uniform as a reason to open the device is how coins leave the terminal without you.

A practical split most Singapore readers can live with

Use a licensed venue for on-ramps and off-ramps. Turn on authenticator 2FA and a withdrawal whitelist. Keep a working SGD buffer so you are not forced into a panic withdrawal the night before a FAST cut-off. Move size you would hate to see stuck in a travel-rule hold onto a device you bought new, from the official shop, and that you have restored from backup at least once.

Write the seed on steel or paper. Keep it off the cloud. Tell one person how to find the sealed instructions. Practise a receive and a send with S$50 before you move S$50,000. None of that is exciting, and none of it is financial advice. It is how you avoid being the next short paragraph in a police advisory.

Why a Carousell “brand new Ledger, never opened” is not a bargain sits in the hardware-wallet comparison. Storage is a process. Buy the process, not a gadget.