On 5 October 2026 the U.S. Treasury’s FinCEN withdrew its long-pending proposal to record and report transfers from regulated exchanges to private wallets (FinCEN announcement; this desk’s news report). The headline lowers one regulatory worry for people who hold their own keys. It does nothing about the dangers that actually cost self-custody users money: typing the wrong address, losing the recovery phrase, or being tricked into approving a transfer. This guide is a nine-step checklist for a first withdrawal, with a pass-or-fail test at every step.
It is educational, not a recommendation to hold bitcoin in any particular way, and it does not name or endorse a wallet brand. Exchange custody and self-custody involve different trade-offs: an exchange can reverse errors, reset passwords and, in some jurisdictions, offers certain protections, while self-custody puts every safeguard in your hands.
Before you start: what you need and what it costs right now
- A wallet whose software or hardware you obtained directly from the maker, not through a search ad or a link in a message.
- Pen, paper or a metal backup plate for the recovery phrase — not a photo, a note on your phone or a cloud document.
- Time. A first withdrawal done carefully takes roughly an hour, most of it waiting for confirmations.
- Network fees. At 06:15 UTC on 7 October, mempool.space’s recommended-fee endpoint showed 1 sat/vB at every priority level (mempool.space), meaning on-chain transfers are about as cheap as they get. Fees move with demand, so check again at the time you send.
The video above is a third-party beginner walkthrough published on 19 May 2026. Wallet menus differ between products, so use it for the overall flow and follow your own wallet maker’s instructions for the exact screens.
Step 1 — Initialise the wallet yourself, on a clean device
Set up the wallet with the device or app freshly installed and, ideally, never previously used. If a hardware wallet arrives with a recovery phrase already printed, a pre-set PIN or any sign the packaging was opened, do not use it; contact the maker. A wallet generates its own recovery phrase during setup. Nobody should ever give you one.
Pass: you saw the phrase generated on the wallet’s own screen or in the app during setup. Fail: anyone supplied it.
Step 2 — Write the recovery phrase down by hand, once
Copy the words in order onto paper or a metal plate, then check them against the screen one at a time. Do not photograph them, type them into any other device, email them or store them in a password manager that syncs to the cloud. Anyone who sees the phrase can move your coins; anyone who finds a photo of it years from now can too.
Pass: the words exist in one physical place only and you can read them back correctly. Fail: a digital copy exists anywhere.
Step 3 — Prove the backup works before any real money arrives
Most losses are not theft; they are backups that were never tested. Wipe or reset the wallet (or use a second, spare device or a reputable offline restore tool) and restore it from the paper. Then confirm it shows the same first receiving address as before. Only then continue.
Pass: the restored wallet produces the same first address. Fail: stop, rewrite the phrase, and repeat. If a word was written wrong, you want to discover that with zero bitcoin on the line.
Step 4 — Generate a receive address and check it on the device screen
Ask the wallet for a fresh receiving address. With a hardware wallet, use the “verify on device” option so the address is shown on the device’s own display, which malware on your computer cannot rewrite. Compare the whole address, not just the first and last few characters.
Pass: the address on the computer and on the device match completely. Fail: any difference at all — cancel and investigate.
Step 5 — Prepare the exchange side
Log in only through a bookmark or by typing the exchange’s address yourself. Enable two-factor authentication with an authenticator app or security key, and, if the exchange offers one, an address allowlist with a withdrawal delay. Withdrawal-address allowlists protect you if your account is compromised, because new addresses cannot be used immediately. Read the exchange’s withdrawal page for its minimum amount, fee and network (Bitcoin on-chain, not a wrapped version on another chain).
Pass: you chose the “Bitcoin / BTC network” withdrawal and not another network label. Fail: you are unsure which network a menu entry refers to — ask the exchange’s support through its official site.
Step 6 — Send a small test transaction first
Withdraw a small amount — enough that the fee is not absurd relative to it, but small enough that a mistake is affordable. Paste the address, then verify it again against the device screen before confirming. Clipboard-hijacking malware and “address poisoning” (where a scammer sends dust from a lookalike address so it appears in your transaction history) both rely on you copying an address from the wrong place.
Pass: the transaction appears in the exchange’s history with a transaction ID, and the first and last characters and the middle of the destination match your device. Fail: the destination differs from your wallet’s address; do not send more.
Step 7 — Watch it confirm, and read the transaction yourself
Paste the transaction ID into a block explorer such as mempool.space and watch the confirmation count. One confirmation means the transaction is in a block; many wallets treat three or six as safe for larger amounts. Your wallet should show the incoming balance once the transaction is seen on the network and mark it spendable after confirmations.
Pass: the explorer shows the output going to your address with at least one confirmation and your wallet shows the same amount. Fail: the amount or address differ from what you expect.
Step 8 — Send the rest, then protect your records
Once the test has arrived, withdraw the remainder, either in one transaction or in stages if you prefer to spread risk. Keep a plain-text note of dates, amounts, transaction IDs and the exchange’s cost basis information for your own tax records; the FinCEN withdrawal does not change how bitcoin is taxed, and a tax professional can tell you what applies where you live. Never put your recovery phrase in these records.
Pass: the full amount is visible in the wallet and the exchange balance is as intended. Fail: a partial amount is missing; wait for confirmations before assuming a loss.
Step 9 — Plan for the day you are not there
Self-custody removes a company from the chain of trust, and it also removes a company that can help your family. Decide who could find and use your backup if you were unavailable, how they would learn what it is, and where a copy should live (a second physical location is common). Write instructions that never include the phrase itself in the same place as the device. Revisit the plan at least once a year.
The video above is from a hardware-wallet company, published 7 August 2026. Treat it as an explainer on terminology, and compare approaches from more than one source before choosing a wallet.
What FinCEN’s withdrawal changes — and what it does not
| Question | Answer based on the sources reviewed |
|---|---|
| Did a new federal reporting duty for withdrawals to self-custody wallets ever take effect? | No. The 2020 proposal, which would have required records above $3,000 and reports above $10,000 per Decrypt, was never finalised and was withdrawn on 5 October 2026. |
| Does the withdrawal make exchange KYC disappear? | No. The withdrawal removes proposed duties; the announcement does not describe repealing existing Bank Secrecy Act obligations. |
| Can similar rules come back? | Possibly. Coin Center’s Peter Van Valkenburgh told Decrypt that the “underlying statutory authority to create new, similar bad rules remains.” |
| Does the withdrawal change taxes? | Nothing in the announcement does. Ask a tax professional. |
Source for thresholds and the Coin Center quote: Decrypt, 5 October 2026.
Common mistakes this checklist prevents
- Wrong network. Sending a token that merely represents bitcoin on another chain to a native Bitcoin address, or the reverse, can make funds unrecoverable.
- Fake support. Anyone who messages you first and asks for your recovery phrase is a scammer; real support never needs it.
- Skipped test. A small test costs a few cents at today’s fees and avoids a total loss from a single typo.
- Untested backup. The phrase has to be restored at least once before it counts as a backup.
- Single point of failure. One piece of paper in one drawer is a plan until the drawer floods.
How this fits the rest of the field guides
Self-custody is a security topic rather than a trading one, so it sits apart from the market-reading guides. For a very different skill, see Field Guide #50 on bitcoin’s 50-, 100- and 200-day moving averages, and for the full list, the Reading Room.
Primary sources: FinCEN; mempool.space recommended fees. Reporting: Decrypt.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange BTC-USD daily candles (UTC day) pulled by Bitcoin Mastery at about 06:15 UTC on Wednesday 7 October 2026; the 7 October candle is still open at that time, so any closing figure quoted is the 6 October close unless stated. Treasury yields are the U.S. Treasury’s own daily par yield curve (constant-maturity) series. Third-party figures are attributed to their source and date. Moving averages are simple averages of Coinbase daily closes and will differ slightly on other venues. Network fee data was read from mempool.space at the time stated; fees change continuously.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.