Crypto Wallets & Custody in Illinois: Exchange, Hardware, Inheritance

What Illinois law now covers

This changed materially in August 2025 and most people have not caught up.

Under the Digital Assets and Consumer Protection Act, digital asset businesses serving Illinois customers must be licensed by IDFPR by 1 July 2027 — with penalties reaching $100,000 per day for unlicensed activity — and licensed firms carry specific custody obligations:

SegregationCustomer assets must be held separately from the firm's own assets.

Full backingThe firm must actually hold what it says it holds on customers' behalf.

Held in trustCustomer assets cannot be loaned out and are protected in insolvency proceedings — they are not available to the firm's creditors.

Outage disclosureFirms must publish outage histories, so a platform that goes down during volatility cannot bury it.

Insurance statementsClear statements about whether, and to what extent, assets are insured.

The trust provision is the significant one. Customers of platforms that collapsed in 2022 discovered their assets were treated as the platform's property and their claims as unsecured. Assets held in trust, segregated and unavailable to creditors, is a substantively different legal position.

What it is not

It is not deposit insurance. There is no FDIC equivalent for crypto. It does not protect you against losing your own account credentials, and it does not make an exchange a bank. It protects you against one specific historical failure mode — the platform treating your assets as its own — which is worth having, and is not everything.

The four kinds of wallet

Custody options compared

Type	Who holds the keys	Best for	Main risk
Exchange account	The platform	Active trading, small balances	Account compromise; platform failure
Mobile / software wallet	You, on your phone or computer	Spending amounts, everyday use	Device malware; losing the phone without a backup
Hardware wallet	You, on an offline device	Long-term holdings of any size	Losing the recovery phrase
Multi-signature	Several keys, several holders	Large amounts, businesses, shared control	Complexity; co-ordination failure

Most people should end up with two of these: a licensed exchange account for buying and for amounts they are relaxed about, and a hardware wallet for everything else. Adding more layers adds more ways to fail.

When to move to hardware

Our working rule, and it has not changed in three years of writing this site:

An amount you would be irritated to lose can sit on a licensed exchange.
An amount you would be genuinely damaged to lose belongs on hardware you control.

That is deliberately not a dollar figure, because the threshold is personal. For a student in Champaign it might be $500. For a household in Naperville it might be $50,000. The test is the same either way.

A hardware wallet costs less than a hundred dollars and stores your private keys on a device that never connects to the internet. Transactions are signed on the device and broadcast by the connected computer, so the keys never touch a machine that could be compromised.

Buy it from the manufacturer

Never from a marketplace listing, never second-hand, never from an eBay seller with a good rating. A tampered device with a pre-generated recovery phrase is a known attack, and it is entirely undetectable until the assets disappear. Order direct, and check the tamper-evident packaging.

Test the withdrawal with a small amount first. Send twenty dollars from your exchange to the new wallet, confirm it arrives, then send the rest. Blockchain transactions are irreversible and a mistyped address is permanent.

Storing a recovery phrase properly

When you set up a self-custody wallet it generates a recovery phrase — twelve or twenty-four ordinary English words in a specific order. That phrase is the wallet. Anyone who has it can take everything; anyone without it cannot recover anything.

Where it must never live:

A photograph on your phone.
A password manager, however good.
A notes app, a document, an email to yourself.
Cloud storage of any kind.
Anywhere a support agent, however convincing, can ask you to read it out. No legitimate support process ever requires it.

Where it should live:

On paper, handwritten. Or stamped into metal if the amount justifies it — paper burns and floods.
Two copies in two physical locations. One at home, one somewhere a single fire, flood or burglary cannot reach. A bank safe deposit box is the obvious second location.
Checked once a year. Verify the copies are still legible and still where you think they are.

For a rural or semi-rural household — much of McHenry County, DeKalb and downstate — the single-location problem is acute, because a detached house is exposed to fire, flood and burglary all at once. Two locations is not paranoia; it is the minimum.

The attacks that actually happen

Not the ones people worry about.

SIM swap. An attacker persuades a mobile carrier to move your phone number to their device, then resets your exchange account through SMS codes. This is the single most common way ordinary crypto accounts are emptied. The fix is app-based two-factor authentication instead of SMS — Google Authenticator, Authy, or your password manager's built-in version. Four minutes to set up, removes the attack entirely.

Phishing. A convincing email or text about a security problem, linking to a login page that looks correct. Type exchange addresses yourself or use a bookmark. Never follow a link in a message about your account.

Fake support. Someone contacts you claiming to be exchange or wallet support and asks for your recovery phrase or remote access to your device. No legitimate support process ever requires either.

Address-poisoning. An attacker sends a tiny transaction from an address that looks similar to one you have used, hoping you will copy it from your history next time. Always verify the full address, not just the first and last few characters.

Clipboard malware. Software that silently replaces a copied wallet address with the attacker's. Always check the address on the destination screen matches what you intended to paste.

From our review desk

In every case we have looked at where an Illinois reader lost crypto from an account rather than to a scam call, the entry point was SMS two-factor authentication. Not sophisticated hacking, not an exchange breach — a phone number moved to someone else's device. It is the single highest-value security change available and almost nobody makes it until after something has gone wrong.

Inheritance: the failure mode nobody plans for

This is the part most crypto guides skip entirely, and it is the one with the most total losses.

Exchange-held assets are recoverable by an estate. The firm has ownership records and a process, and Illinois's requirement that assets be held in trust strengthens the estate's position considerably. It is slow and it involves paperwork, but it works.

Self-custodied assets are recoverable only by whoever holds the recovery phrase. If nobody does, they are permanently inaccessible. No court order, no executor's authority, no subpoena retrieves them. This is not a procedural obstacle — it is a mathematical one.

A workable arrangement:

InventoryA written list of what exists and where — which exchange, which wallet, which device — kept with your other important documents. Never containing passwords or phrases.

Recovery phraseTwo paper copies in two physical locations, one of them a safe deposit box.

Executor letterA sealed note telling your executor that digital assets exist and where the copies are, without containing the phrase itself.

LegalMention digital assets to whoever drafted your will. Illinois has adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act governing fiduciary access to online accounts.

ReviewWhenever you change hardware, change platforms, or update the will.

This is genuinely a conversation for an estate attorney rather than a website — but raising it costs nothing, and the failure mode is total. Our Wheaton guide covers how digital assets surface in DuPage County probate and family matters.

Transfers and tax

Two separate questions, and they are easy to conflate.

Federally, moving crypto between wallets you control is not a disposal. No sale, no gain, no loss, nothing to report. Your cost basis and holding period carry across unchanged.

The Illinois position from 1 January 2027 is less settled. The Digital Asset Tax Act charges 0.2% on digital assets a broker exchanges, transfers or stores for a customer, and it explicitly includes transfers between two accounts of the same customer. A transfer to self-custody is different — there is no broker on the receiving side — and the statute does not resolve that cleanly.

One practical implication

If you intend to move holdings to a hardware wallet, doing it during 2026 removes the question entirely. That is not tax advice and it is not a prediction about how the Act will be applied — it is simply an observation that a step you were going to take anyway is simpler before the effective date than after it.

Our Digital Asset Tax Act guide covers what the statute says and what remains open, and the filing guide covers federal treatment.

This page describes custody options and published legal requirements. It is not legal, tax or investment advice.

Questions Illinois readers actually ask

Do I need a crypto wallet in Illinois?

Not to buy — an exchange account holds assets for you. You need one if you want to control the assets yourself rather than rely on a platform. Illinois law now requires licensed firms to segregate customer assets, keep them fully backed and hold them in trust, which is real protection. It is still not the same as holding your own keys, and anything you would be genuinely damaged to lose belongs on hardware you control.

Is it safe to leave crypto on an exchange in Illinois?

Safer than it was. Under the Digital Assets and Consumer Protection Act, licensed firms must segregate customer assets from their own, keep them fully backed, hold them in trust so they cannot be lent out or absorbed in an insolvency, publish outage histories and state whether anything is insured. That is meaningful legal protection — but not deposit insurance, and it does not protect you from losing account access to a SIM-swap attack.

What is a recovery phrase and how should I store it?

A sequence of twelve or twenty-four words generated when you set up a self-custody wallet. It is a complete backup of the wallet — anyone with it can take everything, and without it the assets are permanently inaccessible. Write it on paper. Never a photo, a password manager, a notes app or cloud storage. Two copies in two physical locations, one somewhere a house fire would not reach.

What happens to my crypto if I die?

Exchange-held assets are recoverable by an estate — the firm has ownership records and a process, though it is slow, and Illinois now requires assets to be held in trust which strengthens the estate’s position. Self-custodied assets are recoverable only by whoever holds the recovery phrase. If nobody does, they are permanently gone and no court order retrieves them. Keep a written inventory (without the phrase in it) and raise digital assets with whoever drafted your will.

Does moving crypto to my own wallet trigger Illinois tax?

Federally, no — a transfer between wallets you control is not a disposal. The Illinois position from 1 January 2027 is less clear. The Digital Asset Tax Act explicitly includes transfers between accounts of the same customer, but a transfer to self-custody has no broker on the receiving side, and the statute does not resolve that cleanly. It is a question worth putting to a tax professional before the effective date rather than assuming an answer.

Keep reading