How crypto wallets work in the UAE: custodial vs self-custody and how to choose
A crypto wallet works by storing the private keys that control your coins, not the coins themselves. In the UAE you can leave assets with a licensed platform that holds the keys for you (custodial) or hold the keys yourself (self-custody). The right choice depends on the amount, how often you trade and how well you can protect a recovery phrase.
Risk warning. Virtual Assets may lose their value in full or in part, and are subject to extreme volatility. The owner and/or investor in the Virtual Asset can lose all the money or other value they invest, and does not benefit from any form of financial protection. For information only, not investment advice. Read the risk disclosure for virtual assets.
Key takeaways
- A wallet stores private keys, not coins. The coins stay on the blockchain, and whoever holds the key can move them.
- Custodial means a company holds the keys. BitOasis names BitGo as its custody provider and says a majority of client crypto is held offline, without giving a percentage.
- Self-custody means you hold the keys and a recovery phrase. Nobody can reset a lost phrase.
- Transfers are final. BitOasis lists 11 networks it does not accept for incoming transfers (help-centre article modified ).
- Sending costs a fee each time: on BitOasis 0.0005 BTC for Bitcoin and 2.00 USDT for USDT on TRC20, read on . Receiving is free.
- In Dubai, custody needs its own VARA licence in a separate legal entity.
This guide is part of the BitOasis Learn hub. It explains how wallets work in general and uses what BitOasis publishes as one worked example. If you have not bought anything yet, start with the guide to buying Bitcoin in the UAE.
How a crypto wallet works: what it actually holds
A crypto wallet holds keys, and the coins never leave the blockchain. A blockchain is a shared ledger that records which address controls which amount. Three terms explain the rest.
- Private key
- A long secret number. Whoever has it can sign a transfer out of the address. You never need it to receive.
- Address
- A public identifier created from the key. You share it so that others can send to you, much like an account number.
- Blockchain
- The shared ledger. It records every transfer between addresses and accepts a transfer only if it carries a valid signature.
So a wallet is a keyring, not a purse. The app or device stores the key and uses it to sign. If you delete the app but still have the key, or the recovery phrase that rebuilds it, you can still move the coins. If someone else gets the key, so can they.
Custodial wallets: a platform holds the keys
A custodial wallet is an account in which a company holds the private keys and you hold a login. Your balance is a record in the company's books, backed by coins in wallets that the company or its custodian controls. If you buy on a platform and leave the coins there, you are using a custodial wallet. That settles the crypto wallet vs exchange question: an account on a trading platform is a wallet whose keys someone else holds. The wallets in the BitOasis app work this way.
The benefit is convenience. You can trade, sell for dirhams and recover a forgotten password. The cost is counterparty risk: if the company fails, is hacked or pauses withdrawals, you depend on its controls and on the rules that apply to it.
What to check in a custodian
Six questions cover most of what matters, and the answers should be in writing on the company's own pages.
- Who holds the keys? The platform itself or a named custodian, and which legal entity.
- Are client assets segregated? They should sit in wallets separate from the company's own funds.
- How much is offline? Look for the share held in cold storage, not only the words.
- Who has checked? Proof of reserves, a SOC 2 report or an ISO 27001 certificate, each with an issuer and a date.
- What happens in an insolvency? Whether client assets stay outside the company's estate, and whether any insurance applies.
- Which regulator licenses it? The licence should be on a public register that you can open yourself.
For a custodian that holds a VARA licence, some answers are set by rule. The VARA Custody Services Rulebook, in force from , says assets in custody are not the custodian's own assets. It requires each client's assets to be kept in separate wallets and bars the custodian from re-using them (rehypothecation), even with the client's consent.
Worked example: what BitOasis discloses
BitOasis is a custodial service that names its custodian. Its public pages, read against the six questions on , give these answers.
| Who holds the keys | Custody through BitGo The Terms name three BitGo entities: BitGo Custody MENA FZE, BitGo Trust and BitGo Inc. They describe the wallets as managed by BitOasis and say BitOasis remains liable for assets it controls under its custody arrangements. |
|---|---|
| Segregation | Segregated wallets The Terms say client virtual assets are not co-mingled with company funds. |
| Online and offline storage | A majority offline, no percentage The Terms describe hot, warm and cold wallets and say that moving coins out of offline storage can take several hours. The Security page says a majority is in cold storage. |
| Independent checks | Not published No proof-of-reserves page, SOC 2 or ISO 27001 claim was found on the pages sampled. |
| If something fails | No deposit protection The Terms say balances are not covered by a deposit insurance or deposit protection programme. No insurance statement and no insolvency clause were found. |
| Regulator | VARA BitOasis Technologies FZE is licensed by VARA for Broker-Dealer Services, VASP Licence reference VL/2024/11/001. BitGo Custody MENA FZE is on the VARA public register with Custody Services as its activity. |
Four questions stay open: which party and which of the three BitGo entities holds the keys to a UAE customer's coins, what share is offline, whether reserves or security controls are independently verified, and how client assets would be treated if BitOasis or a custodian failed. A platform can answer each with a document. Until it does, treat the answer as unknown. The security page keeps the current BitOasis custody and security facts, and the About page explains who is behind BitOasis.
Self-custody wallets: you hold the keys
A self-custody wallet keeps the private key on a device you control, so no company can move, freeze or restore your coins. That removes counterparty risk and replaces it with your own mistakes. There is no password reset and no help desk for a lost key. Self-custody wallets come in two families.
Hardware wallets
A hardware wallet is a small device that keeps the key offline and signs transfers inside the device, which is why it is called a cold wallet. You confirm each transfer on the device's own screen, so malware on your phone or laptop has a harder job. The trade-offs: the device costs money, it is slower for frequent trading, and it can be lost, damaged or, if bought from an unofficial seller, tampered with. The device is not the backup. The recovery phrase is.
Mobile and browser wallets
A mobile app or browser-extension wallet keeps the key on a device that is online, which makes it a hot wallet. It is usually free, quick to set up and convenient for small amounts. It is also exposed to whatever reaches that device: malicious apps, fake wallet downloads and phishing pages that ask you to type your phrase. Treat a hot wallet like the cash in your pocket, not like your savings.
The recovery phrase
The recovery phrase is the wallet. It is a list of ordinary words, shown at setup, from which the wallet rebuilds every key. Anyone who has the words can move the coins from any device, without your phone or PIN.
- Write it on paper or metal. Do not photograph it, email it or keep it in cloud notes.
- Store it where it survives fire, a house move and your own forgetfulness.
- Never type it into a website or give it to anyone, including a caller who claims to be support.
- Decide who should be able to find it if something happens to you.
Lose the phrase and the device, and the funds are gone. Share the phrase, and they are stolen. Neither can be undone.
Custodial vs self-custody at a glance
Neither option removes risk. Each one moves it: a custodial wallet puts the risk in a company, a self-custody wallet puts it in you. Both can end in the loss of everything you hold.
| Question | Custodial wallet | Self-custody wallet |
|---|---|---|
| Who controls the keys | The platform or its custodian. You have a login. | You. The key is on your device and in your recovery phrase. |
| Main risk | The company fails, is hacked or restricts withdrawals, or someone takes over your account. | You lose the phrase, reveal it to a scammer or send to a wrong address. |
| If you lose access | Password reset and an identity check through support. | Only the recovery phrase restores the wallet. Without it, nothing does. |
| Trading and AED withdrawals | Built in: you sell and withdraw dirhams from the same account. | You first send the coins to a platform, wait for the transfer and pay a send fee. |
| Cost of moving funds | On BitOasis receiving is free and each send has a per-asset fee, for example 0.0005 BTC. | You pay the network fee on every transfer you send. It changes with congestion. |
| Who to complain to | The company first, then its regulator. For BitOasis that is its complaints procedure, then VARA. | Nobody. The maker of a wallet app does not hold your coins and cannot reverse a transfer. |
BitOasis figures read on . Sources are listed at the end of this guide.
The two are not exclusive. You can keep a trading balance in a custodial account and move holdings you do not plan to touch to a wallet you control.
Networks and addresses: where transfers go wrong
A blockchain transfer is final: once the network has confirmed it, nobody can cancel it or call it back. The BitOasis Terms say the same of a withdrawal to an external wallet. Two mistakes are worth guarding against: a wrong address, and the right address on the wrong network.
Transfers cannot be reversed
Check the asset, the network and the full address on both sides before you confirm. Send a small test amount first and wait until it arrives.
Sending on a network the receiver does not support
The same asset can exist on several networks, and a receiver credits only the networks it supports. BitOasis is a concrete example. Its help-centre article on unsupported networks, modified on , lists 11 networks it does not accept for incoming transfers: Polygon, Avalanche, Fantom, Arbitrum, Optimism, Cosmos, Binance Smart Chain (BEP-20), Base (written there as Basescan), opBNB, Chiliz and Omni.
The article says funds sent on an unsupported network may be lost for good, that recovery is possible only in some cases and may carry a fee, and that BitOasis is not responsible for such losses. Its instruction is short: use only the network shown on the receive page of your BitOasis wallet. That screen also settles one inconsistency. On 12 October 2026 the BitOasis fee table listed sends of USDC on Base and of AVAX on Avalanche, although the help-centre article names both networks as unsupported for incoming transfers.
Some assets also need a destination tag or memo next to the address when you send to a platform. The pages read for this guide do not say whether BitOasis requires one, so copy exactly what the receive screen shows.
USDT on TRC20 and ERC20
USDT is one token issued on several blockchains, and each version moves only on its own network. Tether's documentation lists USDT on Ethereum as an ERC20 token and on Tron as a TRC20 token, among others. It also says Tether no longer issues USDT on the Omni Layer and is no longer obliged to redeem it there; Omni is one of the networks on the BitOasis list. An Ethereum address receives USDT sent on Ethereum, and a Tron address receives USDT sent on Tron.
The address format is only a first check. Ethereum addresses start with 0x and Tron addresses with T, but other networks, Avalanche among them, use the same 0x format as Ethereum. An address that looks right does not prove the network is right. BitOasis sends USDT on both networks: ERC20 with a 2.79227 USDT fee and a 25 USDT minimum, TRC20 with a 2.00 USDT fee and a 10 USDT minimum.
What moving crypto costs
Moving crypto costs a fee on every transfer you send. On BitOasis, receiving crypto is free, and each send has a fixed fee, charged in the asset you send, and a minimum amount per asset and network. The examples below were read from the crypto tab of its fees page on .
| Asset and network | Fee per send | Minimum send |
|---|---|---|
| Bitcoin (BTC) | 0.0005 BTC | 0.000054 BTC |
| Ethereum (ETH), ERC20 | 0.0011 ETH | 0.0001 ETH |
| USDT, TRC20 | 2.00 USDT | 10 USDT |
| USDT, ERC20 | 2.79227 USDT | 25 USDT |
| XRP | 0.11 XRP | 25 XRP |
| Receiving crypto from an external wallet: free. | ||
Read from the BitOasis fees page on . The page shows no date of its own, so check it on the day you send.
A flat fee weighs more on a small transfer. An illustrative example with made-up amounts: sending 500 USDT on TRC20 costs 2.00 USDT, which is 0.40% of the amount. Sending 50 USDT costs the same 2.00 USDT, which is 4.0%. On ERC20 the two figures are about 0.56% and 5.6%. A test transfer of the 10 USDT minimum adds another 2.00 USDT. For Bitcoin, 0.0005 BTC is 5% of a 0.01 BTC send and 0.5% of a 0.1 BTC send.
Two more points. The fee a platform publishes is its own figure, while the network fee underneath varies with congestion, so published fees can change and a self-custody wallet quotes a different fee at different times. And you cannot send less than the minimum, which matters for small balances.
Moving USDT or Bitcoin on BitOasis
The product pages carry the same figures with the steps: USDT networks and send fees on BitOasis and Bitcoin fees and limits. The fee schedule lists all crypto send and receive fees. If your coins are in your own wallet and you want dirhams, read about sending crypto in and selling for AED.
UAE rules that touch wallets
In Dubai, a firm that holds crypto for other people needs a VARA licence for custody. VARA, which covers Dubai outside the Dubai International Financial Centre, lists eight virtual asset activities. Its Licensed Activities page says custody is the only one that must be kept apart from the others, in a distinct legal entity with a standalone licence. BitOasis Technologies FZE is licensed by VARA for Broker-Dealer Services, VASP Licence reference VL/2024/11/001. Custody is not on that licence, and its Terms name BitGo for custody.
Platforms also collect information about both ends of a transfer. A BitOasis help-centre article on the Travel Rule, modified on , says all transactions go through a compliance review, that the sender's and the recipient's information is tracked and verified, and that some transactions may take slightly longer. It names no threshold and no data fields.
Nothing in the sources read for this guide restricts a person in the UAE from holding their own keys. The VARA pages set licensing rules for firms that offer virtual asset services. This is general information, not legal advice. Other parts of the UAE have their own regulators, and the regulation guide explains how crypto is regulated in the UAE.
- Custody in Dubai
- Separate legal entity with a standalone licence VARA, Licensed Activities page
- BitOasis licence
- Broker-Dealer Services VASP Licence reference VL/2024/11/001, status Active on the VARA register
- Custody provider named by BitOasis
- BitGo BitOasis Terms of Service
- Legal tender
- Virtual assets have no legal tender status in the UAE BitOasis Risk Disclosure Statement; see our risk disclosure statement
How to choose: a decision checklist
Choose by three things: how often you trade, how well you can protect a backup and how much is at stake. Neither route removes the risk of total loss. The flow below is a way to think it through, not advice.
Five rules of thumb go with it.
- Keep on a platform only what you plan to trade or cash out, and know which custodian holds it.
- Before you move a larger sum to your own wallet, send a small test and restore the wallet from its phrase once.
- Use a hardware wallet for amounts that would hurt to lose, and a phone wallet for small sums.
- Count the fees. Every move between a platform and your wallet costs a send fee, so frequent small moves add up.
- Keep records: addresses, dates, transaction IDs and where the backup is.
Security habits that matter more than the wallet
No wallet type protects you from a stolen login, a fake link or a convincing phone call. Six habits do most of the work.
- Use an authenticator app for login codes where you can, instead of SMS. BitOasis offers biometrics, email, SMS and time-based one-time passwords.
- Use a long, unique password for each crypto account and for the email account behind it.
- Check the domain before you log in, and open the site from a bookmark, not from an ad or a message. Start from the home page on bitoasis.net.
- Never share a one-time code, a password or a recovery phrase, and never install remote-access software because someone asks you to.
- Install wallet and platform apps only from the official store listings linked on the provider's own site.
- Treat an unexpected call or message from “support” as unverified until you have checked it through the platform's official channels, such as live chat or [email protected].
Frequently asked questions
Do I need a wallet before I buy crypto?
No. When you buy on a custodial platform, the coins are credited to a wallet inside your account, and the platform or its custodian holds the keys. You need your own wallet only if you want to hold the keys yourself. You can set one up later and send the coins to it. Sending out costs a fee, for example 0.0005 BTC for Bitcoin on BitOasis.
Is it better to keep crypto on a platform or in my own wallet?
Neither is better for everyone. A platform is more convenient for trading and for withdrawing dirhams, but you rely on the company and its custodian. Your own wallet removes that reliance, but a lost or exposed recovery phrase means the funds are gone for good. You can also split: a trading balance on a platform and longer-term holdings in a wallet you control.
Can an Ethereum wallet receive USDT?
Yes, if the USDT is sent on the Ethereum network as an ERC20 token. USDT also exists on other networks, such as Tron (TRC20), and an Ethereum address receives only tokens sent on Ethereum. Before you send, check that the sending platform and your wallet show the same network. BitOasis sends USDT on ERC20 and on TRC20.
What happens if I send crypto to the wrong network?
The transfer cannot be reversed, and the receiver may never credit it. With a platform, recovery depends on the platform. BitOasis says that for a transfer on a network it does not support, recovery may be possible in some cases and may carry a fee, and in other cases the funds are permanently lost. Contact support with the transaction ID, and send a small test first next time.
What is the difference between a hot wallet and a cold wallet?
A hot wallet keeps its keys on a device that is connected to the internet, such as a phone app or a browser extension. A cold wallet keeps them offline, usually on a hardware device. Hot is more convenient and more exposed to online attacks. Cold is slower and better shielded from them. Platforms use both: BitOasis says a majority of client crypto is held offline, without giving a percentage.
Sources
Each source was opened and read on . BitOasis's own documents are named with their address on bitoasis.net.
- BitOasis, Terms of Service (bitoasis.net/en/page/terms-of-service): custody arrangements and providers, segregation, storage, finality of transfers. See our summary of the terms of service.
- BitOasis, Security page (bitoasis.net/en/page/security): cold storage and multi-factor authentication. See our security and custody page.
- BitOasis, Fees, crypto send and receive tab (bitoasis.net/en/page/fees/crypto): fees and minimum amounts. See the BitOasis fee schedule.
- BitOasis help centre, Digital Assets: Unsupported Networks, modified 29 April 2026.
- BitOasis help centre, Travel Rule: Enhancing Regulatory Compliance and Security, modified 29 April 2026.
- Dubai Virtual Assets Regulatory Authority, Licensed Activities.
- Dubai Virtual Assets Regulatory Authority, Custody Services Rulebook, effective 19 June 2025.
- Tether, Supported Protocols and Integration Guidelines.
Check the network and the fee before you move USDT.