The best crypto wallet in Hong Kong depends on who holds the keys

The best crypto wallet in Hong Kong for most people is a two-part setup: an account at an SFC-licensed exchange for buying and selling, and a hardware wallet you control for anything you plan to hold long term. Licensed platforms must keep at least 98% of client assets in cold storage, but only a wallet where you hold the keys puts the coins entirely out of a third party's reach.

Every crypto wallet is really a keyring. The coins sit on a public blockchain; what you own is the private key that can move them. So the question "which wallet is best" is really "who should hold my keys, and what happens if they, or I, lose them?" Hong Kong gives you more regulated answers to that question than most cities, and also more ways to get it wrong: cloned exchange apps, bank apps that quietly never let coins leave, and a street-level OTC market where a mistyped USDT network can cost you the lot.

Custodial vs self-custody: who holds the keys

A custodial wallet is any account where a company holds the keys for you: an exchange, a bank's crypto service, a broker. You log in with a password and two-factor code, and if you forget them you prove your identity with your HKID and get back in. A self-custody wallet is software or hardware where the keys are generated on your device and never leave it. Nobody can freeze it, and nobody can rescue it.

Neither is automatically safer. JPEX users in 2023 held "custodial" balances on an unlicensed platform and could not withdraw when it collapsed; more than 2,700 people reported losses above HK$1.6 billion. Meanwhile, people who hold their own keys lose coins every year to a phone thrown out with the recovery phrase in its notes app. The right answer depends on the amount, how often you trade, and how disciplined you are with backups.

How licensed exchanges hold your coins

If you keep crypto at one of the thirteen platforms on the SFC's licensed list, such as OSL or HashKey Exchange, your "wallet" is governed by the SFC's Guidelines for Virtual Asset Trading Platform Operators, in force since 1 June 2023. Client assets must be held on trust through an associated entity, separate from the platform's own money, and at least 98% of client virtual assets must sit in cold storage. The platform also needs compensation arrangements; under the guidelines those cover 50% of client assets in cold storage and 100% of those in hot storage.

In August 2025 the SFC went further with a circular on custody standards (25EC44). It expects keys to be generated and backed up securely, preferably offline; hardware security modules to be vetted; withdrawals restricted to whitelisted addresses; transaction-signing devices to be dedicated and air-gapped; and on-chain balances reconciled against the ledger around the clock. This is the practical reason a licensed exchange is a reasonable place to park coins while you learn.

What it does not do is make you immune. If a scammer gets your password and SIM, a licensed exchange will still process a withdrawal to an address you whitelisted under pressure. Turn on app-based two-factor authentication, not SMS, and set a withdrawal whitelist with a cooling-off period if your platform offers one. Our licensed exchanges list shows which platforms actually accept retail clients.

Bank and broker apps that never let coins leave

Hong Kong's banks and brokers mostly reach crypto through an omnibus account at a licensed platform. The SFC–HKMA joint circular of December 2023 sets the terms: clients of these omnibus arrangements deposit and withdraw fiat only, with no virtual-asset transfers in or out. Mox is the clearest example. Its crypto service, launched in late January 2026 with HashKey Exchange and HashKey Custody, lets you buy BTC, ETH and SOL, priced in US dollars, but explicitly allows no on-chain transfers.

That is not a scandal; it is a design choice that removes a whole category of risk. But it matters if you want a USDT wallet to receive payment, to move coins to a hardware wallet, or to switch platforms without selling. Before you choose, ask one question: can I withdraw to an external address? If the answer is no, treat the app as price exposure, closer to a crypto ETF than to owning coins.

Hot wallets on your phone

A hot wallet is an app that stores keys on an internet-connected device. It is the right tool for small balances, for receiving USDT from a friend, or for trying a decentralised application. Well-known wallets from established open-source projects and exchange groups are widely used; note that some offshore exchanges that exclude Hong Kong from their trading services still let their self-custody wallet apps run, because the wallet holds no customer funds for them.

Treat the phone as the weak link. Install only from the official app store listing linked on the project's own website, keep the operating system updated, and never paste your recovery phrase into anything. A hot wallet with a few thousand Hong Kong dollars is a reasonable convenience. A hot wallet with your savings is a bet that nothing on your phone ever goes wrong.

Hardware wallets in Hong Kong: buying a cold wallet

A hardware wallet, often called a cold wallet, is a small device that generates and stores keys offline and signs transactions internally. Ledger and Trezor are the best-known brands; several others exist. It is the one piece of crypto kit where where you buy it matters as much as what you buy.

Sham Shui Po's electronics arcades around Apliu Street and the Golden Computer Arcade are where Hong Kong goes for cheap gadgets, and you may see crypto hardware offered in stalls or online marketplaces. Resist the discount. A tampered device, or one sold with a recovery phrase already printed on a card in the box, is a known scam pattern worldwide. Buy from the manufacturer's official store or a reseller listed on the manufacturer's own site, and check that the device generates a fresh phrase when you set it up. Some local businesses also sell devices; Crypto HK, the OTC shop in Admiralty Centre, lists hardware wallets among its services on its website. We have not tested any shop's stock.

When the device arrives, set it up at home, not at a counter. Write the recovery phrase by hand, never photograph it, and send a small test amount first. If you bought coins at one of the crypto shops around 608 Nathan Road in Mong Kok or Admiralty, give them your own hardware wallet's receiving address instead of a wallet the shop sets up for you.

Seed-phrase safety: the rules that actually matter

The recovery phrase, twelve or twenty-four words, is the wallet. Anyone who has it owns your coins, from anywhere in the world, without your device. Almost every self-custody loss comes back to that phrase being exposed, lost, or typed into the wrong place.

• Write it on paper or stamp it on metal. No screenshots, cloud notes, WhatsApp messages to yourself, or email drafts.
• Store two copies in different places, for example at home and in a bank safe-deposit box. A Hong Kong flat is small; a typhoon leak or a helper tidying up can destroy a single sheet.
• No genuine support agent, exchange, wallet maker or police officer will ever ask for it. Anyone who does is running a scam.
• Consider an optional passphrase (a "25th word") only if you are sure you can remember or store it; forgetting it locks you out permanently.

Travel Rule and whitelisting withdrawals

Hong Kong applies the FATF Travel Rule to virtual-asset transfers through Schedule 2 of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, in force from 1 June 2023. For transfers of HK$8,000 or more, licensed platforms must collect and pass on originator and recipient details, and they must do due diligence on transfers to and from unhosted wallets. In practice that means your first withdrawal to a personal wallet usually triggers extra steps.

1. Add the address to your whitelistCopy it from the wallet itself, never from a chat message. Label it clearly.
2. Declare it as your own walletThe platform will ask whether the address belongs to you or a third party, and may ask for proof you control it.
3. Wait out any cooling-off periodMany platforms hold new addresses for a period before first use. It protects you if your account is compromised.
4. Send a small test amountConfirm it arrives on the right network before sending the balance.
5. Keep the recordSave the transaction hash and date. It helps with tax records and with any bank questions later.

Going the other way, deposits from a personal wallet into a licensed exchange can also prompt questions about where the coins came from. If you bought them at a Bitcoin ATM or through P2P trading, keep receipts and screenshots. Coins that passed through an address linked to fraud can be held while the platform reviews them.

USDT wallets in Hong Kong: TRC-20 vs ERC-20

USDT is the coin most Hong Kong OTC shops trade, and it is also the coin people most often lose to a network mistake. The same token exists on several blockchains. TRC-20 USDT runs on Tron, with addresses that start with a capital T and low network fees. ERC-20 USDT runs on Ethereum, with addresses starting 0x and higher fees. Other versions exist on other chains. A USDT wallet in Hong Kong is simply any wallet that supports the network you intend to use.

Before any USDT transfer, confirm three things: the network the recipient expects, that your wallet holds a little of that chain's native coin to pay the fee (TRX on Tron, ETH on Ethereum), and that the first and last characters of the address match. Some address-poisoning scams send you a tiny transfer from an address that looks almost identical to one you use, hoping you copy it from history next time. Our USDT to HKD guide covers the legal side, including why shops are no longer permitted to offer USDT to the public under the Stablecoins Ordinance since 1 August 2025.

Clone apps and fake wallets

The SFC's suspicious-platform alert list is full of names designed to look like something you trust. In 2026 alone it added look-alike domains impersonating HashKey (August), DFX Labs (July and September) and EX.IO (June), as well as a platform called R-Coin Wallet in January. The pattern is always similar: a link in a Telegram group or dating-app chat, a polished app that shows your balance growing, and a withdrawal that requires one more "tax" or "unlock fee".

Defend yourself with habits rather than hope. Type exchange addresses by hand or use the link on the SFC register. Download wallet apps from the developer's official site. Check the SFC alert list before sending money anywhere new. And if a wallet or platform has contacted you first, assume it is hostile until proven otherwise. Our Hong Kong crypto scam guide lists the current patterns and how to report them.

Inheritance and backups

Self-custody has an awkward final chapter: if you die or lose capacity and nobody knows how to reach your keys, the coins are gone for everyone. Custodial accounts at licensed platforms are easier for executors, because the platform can verify identity documents and a grant of probate. Self-custodied coins need a plan.

A simple approach many holders use is a sealed letter, kept with a will or with a trusted lawyer, that explains which devices and platforms exist and where the recovery phrase copies are stored, without writing the phrase in the letter itself. More advanced setups split control across multiple keys so no single person or location can move funds alone. Whatever you choose, test it: could your spouse actually follow the instructions without calling you?

Finally, remember the online option some Hong Kong residents use to get started. International exchanges such as CEX.IO, founded in London in 2013 and holding registrations in the US, Gibraltar, Spain and Lithuania, sell crypto by card and let you withdraw to your own wallet. CEX.IO is not licensed by the SFC, so Hong Kong investor protection does not apply; the SFC recommends its licensed platforms. Our CEX.IO review sets out the trade-offs, and the wider Hong Kong crypto regulation guide explains why that distinction matters.

Frequently asked questions

Sources & further reading

1. SFC — Guidelines for Virtual Asset Trading Platform Operators · effective 1 Jun 2023
2. SFC circular 25EC44 — custody of client virtual assets · 15 Aug 2025
3. SFC — Suspicious virtual asset trading platforms alert list · checked 30 Sep 2026
4. SFC–HKMA joint circular 23EC66 on intermediaries’ VA activities · 22 Dec 2023
5. AMLO (Cap. 615), incl. Sch. 2 s.13A Travel Rule · in force 1 Jun 2023
6. SFC — Lists of virtual asset trading platforms · updated 29 May 2026
7. Blockhead — Mox Bank launches crypto trading · 26 Jan 2026
8. Crypto HK — OTC trading and services · checked 30 Sep 2026

Keep reading