Key facts
- Crypto held on an exchange is not technically yours. What you hold is a balance in a company's database. The private key that controls the coins sits with the operator.
- The tax exemption is a genuine reason to keep an exchange account. Gains on digital asset sales are exempt from personal income tax from 1 January 2025 to 31 December 2029, on the condition that the sale is made through an operator licensed by the Thai SEC.
- The two approaches work together. Buy and sell through a licensed exchange, and move holdings into your own custody for the periods in between. Self-custody does not affect the exemption.
- A license is supervision, not a guarantee. Zipmex held one. In late July 2026 the Thai SEC filed a criminal complaint against Bitkub Online and two former directors over filings submitted after a 2021 cyberattack.
- In some cases the exchange keeps operating and the user simply loses access. In June 2025 Thai investors had about four weeks before Bybit, OKX, CoinEx, XT.COM and 1000X were blocked nationwide.
- A workable threshold: if losing the balance would affect your whole year, move it. Below that level, the risk of losing your own recovery phrase can exceed the risk of leaving it on a licensed exchange.
- A hardware wallet does not eliminate risk, it relocates it. You move from trusting a company to taking long-term responsibility for 24 words yourself.
The short answer
If the balance is modest — at a level where losing it would not affect your finances overall — keeping it on a licensed exchange in Thailand is a reasonable choice.
SIAMBC sells hardware wallets, but the conclusion above is an honest assessment. Someone holding ฿5,000 of Bitcoin who has never managed a private key is not meaningfully safer for moving it into their own custody. They have simply taken on a different category of risk, and the main one — losing the recovery phrase — cannot be undone, and happens far more often than an exchange failing.
The assessment changes as the value grows. Once the balance becomes a significant asset, you are entrusting money you cannot afford to lose to a company you have no way to inspect. That is the point at which it should move into your own custody, and in practice most investors reach that point later than they should.
The rest of this article sets out how to judge where that point sits for you.
What keeping crypto on an exchange actually means
Every cryptocurrency is controlled by a private key. Whoever holds the key can move the coins. That is the whole of the system, and there is no appeals process behind it.
When you buy Bitcoin through an exchange, the exchange holds that key. What you receive is a balance in their system recording what they owe you. Your account does not control coins directly — it controls your right to ask the operator to act on your behalf, and it works for as long as the operator remains both willing and able to do so.
Usually they are. Licensed operators in Thailand fall under SEC supervision through the Emergency Decree on Digital Asset Businesses. They are required to segregate customer assets from company assets, and to hold capital against the risk of the custody they provide. That is meaningful regulation, and it is a considerably better position than an offshore platform with no clear supervisor.
But what it delivers is supervision of a company, not the removal of that company from the equation. A gap remains between "the SEC regulates this exchange" and "these coins are mine", and the past five years in Thailand have shown fairly clearly what sits inside it.
Case studies from Thailand
Everything below actually happened, and happened here.
Bitkub, 2021 — disclosed in 2026
In May 2021 a cyberattack moved 16 types of digital asset, worth approximately 1.7 billion baht, out of one of Bitkub's wallets. Five years later, in late July 2026, the Thai SEC filed a criminal complaint against Bitkub Online and two former directors with the Economic Crime Suppression Division, stating that the daily net-capital reports filed between 10 May and 30 October 2021 did not reflect the loss.
Bitkub's position is that customer assets were never at risk, as the co-founders used their own funds to purchase replacement assets, and the company maintains that customer holdings are complete. One former director has publicly accepted sole responsibility, saying he altered the figures himself to prevent a bank run. The matter remains at the allegation stage and is with investigators and prosecutors.
The significant point here is not that Bitkub was at fault — customers did not lose a single baht. The point is that a 1.7 billion baht loss occurred inside the country's largest exchange without a single customer knowing for five years. Had anyone asked in 2022 whether their balance was safe, the answer would have been yes, and there was no way to verify otherwise. Users cannot see an exchange's internal position, and at that time neither could the regulator.
Zipmex, 2022 to 2024
Zipmex was a licensed Thai exchange with a large domestic customer base. In July 2022 it suspended withdrawals following exposure to two offshore crypto lenders that had already run into difficulty. Thai customers who had placed funds in its yield product spent years pursuing recovery. The SEC subsequently found that customer assets had been transferred out of Thai wallets to overseas accounts without notifying the regulator, filed a complaint against the former chief executive, and in 2024 the Ministry of Finance revoked the license.
The license did not prevent this. Regulation provides a process for redress after the event; it does not act as a barrier preventing the event.
June 2025: five exchanges blocked
On 30 May 2025 the Thai SEC announced that Bybit, OKX, CoinEx, XT.COM and 1000X would have access blocked nationwide from 28 June, on the grounds that they were operating without a Thai license, and advised investors to deal with their assets before the deadline. Roughly four weeks in total.
Anyone traveling, unwell, not following the news, or simply not paying attention during that window could no longer reach their own account from Thailand. Those exchanges had not failed and the coins were all still there, but access from within the country closed on a timetable set by somebody else. This is a risk most investors never factor in, and one that self-custody removes entirely, since a hardware wallet operates without needing anyone's permission.
The measures have continued to tighten. Two royal decrees effective April 2025 extended licensing requirements to foreign operators soliciting Thai users, including peer-to-peer platforms, with a grace period that ended on 28 June 2026.
The account freezing problem
Since 2023, more than one million bank accounts in Thailand have been frozen under measures against mule accounts, pursuant to the Royal Decree on Measures for the Prevention and Suppression of Technology Crimes. People with no involvement have been caught up in it, in some cases for several weeks, and the Bank of Thailand has publicly acknowledged the problem.
This is directly relevant because an exchange account is linked to a Thai bank account. If the bank account is frozen, moving money in and out of the exchange stops with it, regardless of how well that exchange is managed. Coins held under your own keys are unaffected by such measures — though this is a point about resilience, not a route around the law.
The picture internationally
In February 2025 approximately 401,000 ETH, worth around $1.5 billion, was stolen from Bybit, the largest recorded crypto theft to date. The FBI attributed it to North Korea's Lazarus Group. The method was a compromise of the transaction signing process during a routine transfer out of a cold wallet.
Bybit absorbed the loss and continued operating. What is worth considering is that this happened to one of the largest exchanges in the world, with a professional security team and cold storage in place. The reason is that assets held by an exchange form a large target that attackers pay continuous attention to. An individual user's holdings are not in the same position.
Why you should still keep a licensed exchange account
This is the point that self-custody articles written outside Thailand tend to omit, and it is the strongest argument against closing an exchange account.
Under Ministerial Regulation No. 399, announced in September 2025, gains on digital asset sales are exempt from personal income tax from 1 January 2025 to 31 December 2029. The exemption applies to individuals rather than companies, and carries the significant condition that the sale must be made through a digital asset operator licensed by the Thai SEC. Sales through an unlicensed or offshore platform do not qualify.
A licensed exchange is therefore not merely a matter of convenience — it is the channel the tax treatment is attached to, for a five-year period. Advice to move everything off and trade peer-to-peer carries a cost that is not always stated.
The appropriate approach is not complicated, and it is what most long-term holders in Thailand already follow.
Use the exchange as an entry and exit point rather than long-term storage. Buy and sell through a licensed exchange, and move holdings into your own custody for the period you hold them. Transfers between wallets you own are not sales, so self-custody does not affect how a later sale is assessed. Keep your own records of what was bought, when, and at what price, because once coins leave the platform you are the only party holding the complete picture.
Tax depends on individual circumstances, and the rules are likely to change again before 2029. The above describes the current legal framework rather than advice for any particular case. For substantial sums, consult an accountant in Thailand.
When to move it into your own custody
There is no fixed figure, but there are better questions than asking what counts as a large amount.
Would losing it affect your whole year? Not at the level of affecting your entire life, and not at the level of temporary regret, but at the level of affecting your financial plans for the year. If so, those assets should not be in someone else's care. For most investors in Thailand this level sits at around ฿50,000 to ฿100,000, which is some way below the point at which most people actually act.
The cost of the wallet against the risk. An entry-level hardware wallet costs around ฿2,000. As a proportion of holdings, that is nearly 7% at ฿30,000, where the argument can go either way, and 0.7% at ฿300,000, where there is nothing left to weigh.
The intended holding period. Funds being traded this month need to be on an exchange in order to be traded. Funds intended to be held for another three years have no reason to be there. The longer the holding period, the more opportunity there is for one element in the chain — the exchange, the regulator, or your bank — to run into difficulty.
Whether it could be replaced. Losing ฿20,000 is a bad month for someone on a high income. The same figure for someone who saved for two years is a different situation altogether. The number matters less than the context behind it.
Whether you are prepared to look after the recovery phrase. This requires an honest self-assessment, and it is the question our team asks customers in the shop most often. If a piece of paper recording 24 words is realistically going to go missing, buy the wallet together with suitable backup from the outset, or reconsider the decision. Self-custody is a responsibility, not simply a purchase.
The limits of a hardware wallet
Setting out the limitations honestly is more useful to a reader than presenting only the advantages.
It does not help if the recovery phrase is lost. The device can be replaced. The 24 words cannot. This is the leading cause of loss among people holding their own keys, by a wide margin, and it originates with the user. SIAMBC has published a full guide to storing a recovery phrase in Thailand, because high humidity, flooding and termites make paper a higher-risk storage method here than in many other countries.
CryptoSafe
฿299
- 86 x 54 x 2.5 mm stainless steel, credit-card sized
- Records a full 24-word BIP39 phrase, stamped by you
- Rated to withstand fire up to 1000°C for 30 to 60 minutes
Adding: Plate only. Sets with pen, stamp and hammer are on the product page.
Buying the backup at the same time as the wallet is the best-value decision in this process, because the weakest part of the setup comes into existence the moment those 24 words are written onto the paper card supplied in the box.
It does not help if the user approves the transaction. If you connect to a fraudulent site and sign what appears on screen, the device carries out your instruction. What a good device provides is a screen showing the detail of what is being signed, together with the discipline of checking before confirming — and that second part is the user's responsibility.
Ledger
฿10,480
- 2.8-inch E Ink touchscreen at 480 x 600 px, showing a full address on one screen
- ST33K1M5 secure element, certified to CC EAL6+
- Bluetooth for iPhone and Android, with a Ledger Recovery Key included in the box
Adding: Black Graphite. BTC Orange and Neptune Blue are on the product page.
Screen size is not a convenience feature — it is the entire surface on which a transaction is verified. A device that displays four characters at a time is asking the user to trust a summary, while one that displays the full address gives the user a real opportunity to check it.
It does not help if someone else obtains the recovery phrase. Anyone holding those 24 words can access the coins from anywhere in the world, with no need for the device. This is why no legitimate organization or service provider ever asks to see a recovery phrase.
It does not help if the source of purchase is not considered. A device received from a seller that cannot be verified, with a recovery phrase already recorded in the box, is not a hardware wallet but a trap. Buy from the manufacturer or an authorized distributor and set the device up yourself, so that the recovery phrase is generated by the device in front of you.
It does not place the user beyond scrutiny or outside the law. Self-custody concerns only who holds the keys.
Recommended models for a first wallet
The three models below are suitable starting points at three price levels. None is the best choice in every situation — they suit different users.
Tangem
฿2,190
- Two cards, used by tapping a phone over NFC — no charging and no cable
- Supports both iPhone and Android
- No recovery phrase to record by default; the second card serves as the backup
Adding: Black. White is on the product page.
This model suits anyone hesitating because of concerns about storing a recovery phrase. By default Tangem does not generate one: the private key is created inside the card, and a spare card performs the backup role, so there is no set of words that can be lost. The trade-off is real, however — the cards are the wallet, so a spare card must be kept as carefully as a paper record of 24 words. Tangem also offers an optional recovery phrase during setup for users who want one, and that choice cannot be reversed. For someone moving a first ฿50,000 off an exchange using an iPhone, this involves the fewest steps.
Ledger
฿2,060
- Secure element certified to CC EAL6+, a higher grade than the more expensive Nano X
- A screen for verifying every transaction on the device itself
- Supports computers and Android only. It does not support iPhone
Adding: Matte Black. Four other colors on the product page.
This is the model most users in Thailand start with, and the lowest-cost route to a certified secure element. A detail many people are unaware of is that its chip certification is a grade above the Nano X, which costs more — buyers are not receiving a reduced-specification device. The one thing to confirm before ordering is that this model has no Bluetooth and does not support iPhone, which is the leading reason for returns. Anyone managing crypto on an iPhone should check which models support iPhone first.
Trezor
฿3,890 ฿4,590-15%
- Secure element certified to EAL6+, with open-source firmware and design
- Supports a passphrase entered on the device, creating a separate hidden wallet
- Backup as 12, 20 or 24 words; setup through Trezor Suite on a computer
Adding: Cosmic Black. Three other colors on the product page.
A step up, suited to users who want to inspect the source code themselves, or who want to use a passphrase. The passphrase is a feature worth understanding, as it creates an entirely separate wallet from the same set of words, which is a fundamentally different security model from a PIN. Trezor has made its firmware available for inspection since 2014, which is why it remains widely recommended among users who place importance on open systems.
If none of the three fits, the full range is on the hardware wallets page, covering Ledger, Trezor, SafePal, Tangem, OneKey, Blockstream, Keystone, SecuX, CoolWallet and other brands, all in stock in Bangkok.
Common questions
Is Bitkub safe?
Bitkub is the largest licensed exchange in Thailand, it operates under SEC supervision, and it has never cost customers money — including in the 2021 case, where the co-founders used personal funds to purchase replacement assets. At the same time, the company was the subject of a complaint from that same regulator in July 2026 concerning how the 2021 loss was reported. Both are facts, and they hold simultaneously. Whether something is safe enough to trade on and whether it is safe enough to hold savings in over the long term are two different questions, and the second is the one worth considering.
Does moving crypto to a hardware wallet affect the tax exemption?
It does not. Transfers between wallets you own are not sales. The exemption is assessed on the channel through which the sale takes place — an operator licensed by the Thai SEC — not on where the coins were stored beforehand. Keep records of your purchases, and for substantial sums check with an accountant in Thailand.
What value of crypto justifies buying one?
The test our team uses in the shop is whether losing that balance would affect your financial plans for the year. If it would, the cost of a wallet is very low by comparison. Around ฿50,000 is the level at which it is worth considering, and by ฿100,000 the reason it remains on an exchange is usually habit.
Can I keep part on an exchange and part in my own custody?
Yes, and this is the approach most long-term holders use — a trading balance on the exchange, with long-term holdings moved into self-custody. There is no requirement to choose only one.
What happens if the hardware wallet is lost?
The crypto is unaffected. The device stores the key, it is not the key itself. Buy a replacement from any brand supporting the same standard, enter the recovery phrase, and the balance is restored. This is why the recovery phrase matters more than the device.
Are Binance TH and Binance the same?
They are not. Binance TH is operated by Gulf Binance, a joint venture with Gulf Energy Development, which holds a Thai license. The global binance.com platform is a separate legal entity, and the Thai SEC filed a criminal complaint against it in 2021 for operating without a license. Where the tax exemption is a consideration, the distinction matters, because the exemption is tied to the license.
Should everything be withdrawn immediately?
Acting in haste is a cause of mistakes. Set the wallet up properly first, verify the recovery phrase, send a small test transfer and confirm it arrives, and only then move the remainder.
Someone claiming to be customer support asked me to confirm my recovery phrase. Is this normal?
It is not, and it is fraudulent in every case without exception. SIAMBC, every manufacturer and every exchange have no policy of requesting a customer's recovery phrase, whatever reason is given — warranty claims, identity verification, firmware updates or wallet migration.
Buying in Thailand
Every model mentioned in this article is in stock at our shop in Thawi Watthana, Bangkok, with free delivery nationwide within one to two business days. Within Bangkok, same-day delivery is available by Grab or LINEMAN, arranged through LINE.
For anyone moving crypto off an exchange for the first time, visiting the shop is preferable to ordering online. Our team will set the device up with you, check that the recovery phrase has been recorded correctly, and run a test transfer before any real assets are moved. It takes around twenty minutes and removes the step where mistakes most often occur. The shop is open Monday to Saturday, 9:00 to 17:00.
See all hardware wallets or contact us before deciding — our team is glad to answer questions ahead of a purchase.
One rule to remember
Anyone who asks for your 24-word recovery phrase is a scammer. No exceptions.
Neither SIAMBC nor any manufacturer will ever ask for it, whatever reason is given — warranty claims, identity verification, system updates or account recovery. Those 24 words are the key to your funds. Whoever has them owns your crypto, and it can never be recovered.
Share:
The COLDCARD hack explained: what happened, who is affected, and what to do