How do you move your Bitcoin off the exchange to a hardware wallet?
Verify on the device. Test-send first.

Why move it off the exchange at all?

The case is made elsewhere on this site, so here is the one-paragraph version. Bitcoin on an exchange is an IOU from a company; Bitcoin in your own wallet is a bearer asset no one can freeze, lend out, or lose on your behalf. Mt. Gox collapsed in 2014 holding customer coins measured in the hundreds of thousands of BTC, and FTX customers holding billions of dollars in balances learned in November 2022 that an exchange balance is a claim in a bankruptcy queue, not property in hand verify×DON'T TRUST, VERIFYClaim: FTX customers held billions of dollars in balances, and funds belonging to FTX trading customers were misused.Verify at: SEC press release 2022-219 ↗The SEC's own charging announcement states customer balances in the billions and the diversion of customer funds. Checked 2026-07-29.. The full argument, including the honest tradeoffs of being your own custodian, is on the Bitcoin security page, and Bitcoin custody levels maps where a hardware wallet sits on the ladder from exchange account to multisig.

A practical threshold from the how to buy Bitcoin guide: once your stack passes roughly $1,000, the one-time cost of a hardware wallet is smaller than the counterparty risk of leaving it. If you hold Bitcoin exposure through an ETFExchange-Traded Fund (ETF)A basket of investments (stocks, bonds, or Bitcoin) that trades on a stock exchange like a single share. instead, that is a different set of tradeoffs covered in ETF vs self-custody. This page assumes you have decided to hold the real thing.

What do you need before you touch the withdraw button?

Three things, all done before you log in to the exchange. First, a hardware wallet bought directly from the manufacturer, never from Amazon, eBay, or any reseller, because devices can be tampered with in transit. Picking between Coldcard, Trezor, Passport, and the rest is covered in the hardware wallets guide.

Second, a completed device setup: tamper check on the packaging, firmware verified through the manufacturer's official app or documented procedure, a new seed generated on the device (never imported from anywhere), and the 12 or 24 words recorded on paper or steel, offline. The rules for protecting those words, and the recovery drill you should run before real money is at stake, are in the seed phrase guide. If you have not tested recovery, you do not have a backup, you have a hope.

Third, wallet software on your computer that can talk to the device. For Bitcoin-only self-custody the recommendation here is Sparrow, set up per the Sparrow Wallet guide, because its UTXO labeling and coin control matter later in this walkthrough. The manufacturer's own app (Trezor Suite, Ledger Live) also works for a first withdrawal.

How do you generate and verify a receive address?

In your wallet software, open the receive tab and generate a fresh address. For a modern Bitcoin wallet it will start with bc1q or bc1p. Now the step that actually protects you: display the same address on the hardware wallet's own screen and compare it character by character with what your computer shows. Clipboard malware can swap an address after you copy it, and a compromised app can display an address that was never yours. The device screen is independent of the computer, which is the entire point of the hardware verify×DON'T TRUST, VERIFYClaim: Clipboard malware can swap an address after you copy it, and a tampered app can display an address that is not yours, so every receive address should be verified on the hardware wallet's own screen.Verify at: Trezor: Trusted Display, verify every address ↗Trezor's official documentation describes the clipboard-swap and fake-app attack and instructs users to check every address against the device display before use..

Checking the first 4 and last 4 characters is a habit worth keeping, but it is not sufficient on its own: vanity-address generators can brute-force lookalike prefixes and suffixes. For the withdrawal that moves your whole stack, read the entire string on the device. It takes 30 seconds. Copy the verified address, paste it into the exchange, and then compare the pasted result against the device one more time before you confirm.

Why send a test amount first?

Because a Bitcoin transaction cannot be reversed, recalled, or disputed, the only way to prove an address is yours is to send something small to it and watch it arrive. The doctrine: first withdrawal small, second withdrawal everything else. Concrete example with a 0.1 BTC balance on Kraken: withdrawal one is 0.0005 BTC to your verified address, a size chosen because it clears Kraken's 0.000218 BTC minimum with room to spare while risking almost nothing. Wait for the transaction to appear in your wallet and reach 1 confirmation. Confirm the amount matches and the label is yours. Then send the remaining balance to a fresh address from the same wallet, verified on the device again.

Total cost of the doctrine: one extra withdrawal fee. On Kraken that is the flat 0.000015 BTC, which covers the network cost; on Coinbase it is one extra network-fee estimate at sending time. Call it a few dollars. What it insures against is the catastrophic version of every mistake on this page: wrong network, swapped clipboard, mistyped paste, wallet misconfigured to someone else's descriptor. Skipping the test to save a few dollars on a four-figure or five-figure move is the worst expected-value trade in Bitcoin.

How do you withdraw Bitcoin from Coinbase?

Coinbase calls withdrawals "sends" and distinguishes on-chain sends (to an external address, irreversible, network fee applies) from off-chain sends between Coinbase users (instant, free, never touches the blockchainblockchainImagine a spreadsheet that tracks every Bitcoin transaction ever made, copied identically on thousands of computers worldwide. To rewrite a past entry, an attacker would have to change it on a majority of those computers at the same instant. That is mathematically impractical. That is why Bitcoin transactions cannot be undone.Full definition). Moving to your hardware wallet is an on-chain send. The web flow as documented on Coinbase's own help pages: from the Dashboard choose Send crypto, select Bitcoin and the amount, select To and choose the network, paste your verified address, then Preview Send, review, and Send now, completing 2-step verification if prompted. Coinbase's warning is blunt: pick the wrong network and the funds are lost, and it cannot retrieve crypto sent to an incorrect address verify×DON'T TRUST, VERIFYClaim: Coinbase on-chain sends are irreversible, incur network fees, follow the Dashboard, Send crypto, Preview Send, Send now flow, and Coinbase cannot retrieve funds sent to the wrong address or network.Verify at: Coinbase Help: Steps to send crypto ↗Coinbase's official help article documents the send flow, the on-chain vs off-chain distinction, and the wrong-network warning. Checked 2026-07-29..

Fees. Coinbase does not publish a flat BTC withdrawal fee. Its fee disclosure states that when you send crypto off the platform it charges a fee based on its own estimate of prevailing network fees for a standalone send, that the fee it actually pays may differ because it batches transactions, and that the fee is disclosed on the preview screen before you commit. If you send over Lightning instead, Coinbase charges a 0.2% processing fee verify×DON'T TRUST, VERIFYClaim: Coinbase charges an estimated-network-fee-based fee on external sends, disclosed at transaction time, may pay less than users' aggregate estimated fees due to batching, and charges 0.2% on Lightning sends.Verify at: Coinbase: pricing and fees disclosures ↗Coinbase's official fee disclosure page documents network transaction fees on sends, batching, and the Lightning processing fee. Checked 2026-07-29.. For a hardware wallet withdrawal, ignore Lightning entirely: your device holds on-chain keys, so choose the Bitcoin network.

Holds. If you bought the Bitcoin with a bank (ACH) deposit, the crypto can be sold or traded on Coinbase during the hold but cannot be sent off the platform until the cash settles, which takes 3 to 5 days from the deposit. Hold length depends on account history, the confirmation email states the exact release date, support cannot shorten it, and debit-card deposits are sendable immediately verify×DON'T TRUST, VERIFYClaim: Crypto purchased with a cash deposit on hold can be sold or traded on Coinbase but not sent off-platform until the hold lifts; Coinbase requests ACH cash within 3 to 5 days; hold times depend on account history and cannot be reduced by support.Verify at: Coinbase: understand your available balance ↗ · Coinbase: funds on hold ↗Both official Coinbase help articles document the deposit-hold behavior, the 3 to 5 day bank request window, and that holds cannot be shortened. Checked 2026-07-29.. Coinbase also notes that some sends can be temporarily restricted even after a hold clears; the sanctioned fallback in that case is waiting or withdrawing the cash back to the originating bank.

Optional security features worth turning on before your first withdrawal. The address book allowlist restricts all sends to saved addresses; a newly added address becomes usable after 48 hours, and disabling the allowlist itself takes 48 hours, which turns a stolen-password attack into a two-day race you can win. Separately, transfer protection can add a 6 to 48 hour delay and extra verification to outbound sends above a threshold you choose verify×DON'T TRUST, VERIFYClaim: Coinbase allowlisting limits sends to address-book entries, new addresses activate after 48 hours, disabling takes 48 hours, and transfer protection can add a 6 to 48 hour delay plus verification to outbound transactions.Verify at: Coinbase: address book allowlist ↗ · Coinbase: transfer protection ↗Coinbase's official help articles document the 48-hour allowlist activation and the 6 to 48 hour transfer-protection delay range. Checked 2026-07-29.. If you plan to allowlist, add your hardware wallet address 48 hours before you want to withdraw, not the day of.

How do you withdraw Bitcoin from Kraken?

Kraken's flow starts from the Portfolio view: choose Withdraw, search for Bitcoin, and select the network. Kraken lists BTC on several networks including Lightning and wrapped forms on other chains, and its documentation carries the same warning as Coinbase's: an incompatible network means permanent loss. For a hardware wallet, the network is Bitcoin, nothing else. Adding your address is its own small ceremony: paste it (Kraken's docs say never type an address by hand) or scan the QR, and give it a unique label like "Coldcard cold storagecold storageStoring Bitcoin on a device that's never connected to the internet, protecting it from online attacks.Full definition." If you add the address from a trusted device it is approved automatically; otherwise Kraken emails a confirmation link that expires in 1 hour. Enter the amount, confirm the details, provide 2FA if you have funding 2FA enabled, and note that Kraken does not send an email confirmation for the withdrawal itself; you track it in the activity tab verify×DON'T TRUST, VERIFYClaim: Kraken's withdrawal flow runs Portfolio, Withdraw, select asset and network; addresses should be pasted, never hand-typed, need a unique label, auto-approve on trusted devices or require an email link valid for 1 hour; no email confirmation is sent for the withdrawal itself.Verify at: Kraken: how to withdraw cryptocurrencies ↗ · Kraken: adding and confirming a withdrawal address ↗Both official Kraken support articles document the flow, the copy-paste rule, the trusted-device auto-approval, and the 1-hour email link expiry. Checked 2026-07-29..

Fees and minimums. Unlike Coinbase, Kraken publishes a flat schedule. As checked on 2026-07-29 (page last updated 2025-12-31), on-chain Bitcoin withdrawals cost 0.000015 BTC with a minimum withdrawal of 0.000218 BTC including the fee; Lightning withdrawals cost 0.1% with a 0.00001 BTC minimum. Kraken's own caveat applies: fees change, and the confirmation screen shows the final number verify×DON'T TRUST, VERIFYClaim: Kraken's published schedule lists a 0.000015 BTC on-chain withdrawal fee, a 0.000218 BTC minimum including fee, and 0.1% with a 0.00001 BTC minimum for Lightning, subject to change at confirmation time.Verify at: Kraken: cryptocurrency withdrawal fees and minimums ↗Kraken's official fee table lists these figures per asset and states final fees are shown at confirmation. Figures as displayed 2026-07-29..

Holds. Kraken applies a 72-hour withdrawal hold, equal to the purchase amount, after first-time debit or credit card purchases and Apple Pay or Google Pay purchases, and after every PayPal purchase. Trading continues during the hold; withdrawal of that amount waits. Separately, ACH deposits through Plaid are held for 7 days, and if you change your password, withdrawals to new addresses are held for 24 hours. Plan around time-based holds rather than expecting support to lift them early verify×DON'T TRUST, VERIFYClaim: Kraken applies a 72-hour withdrawal hold equal to the purchase amount after first-time card and digital-wallet purchases and every PayPal purchase, holds ACH Plaid deposits 7 days, and holds withdrawals to new addresses 24 hours after a password change.Verify at: Kraken: why is there a withdrawal hold ↗ · Kraken: how to withdraw cryptocurrencies ↗Kraken's official support articles document the 72-hour instant-purchase hold, the 7-day ACH Plaid hold, and the 24-hour post-password-change hold. Checked 2026-07-29..

How do Coinbase and Kraken compare on Bitcoin withdrawals?

Same destination, different friction. All figures are from each exchange's official help pages as checked 2026-07-29 and change without notice; the confirmation screen is the authority.

Which exchange to be on in the first place, spreads included, is a different question answered in best Bitcoin exchange 2026. For withdrawal purposes both work; Kraken's flat published fee is easier to reason about, Coinbase's pass-through tracks the actual network conditions.

What is the difference between the network fee and the exchange fee?

Two different parties get paid. The network fee goes to Bitcoin miners and is set by open competition for block space, priced in satoshis per virtual byte; it rises when the mempoolmempoolThe waiting area for Bitcoin transactions that have been broadcast to the network but not yet confirmed in a block.Full definition is busy and falls when it is quiet. The exchange fee goes to the exchange. Kraken charges a flat 0.000015 BTC and eats the difference between that and what it actually pays; Coinbase charges you its estimate of the network fee and may pay less than the sum of user estimates when it batches many withdrawals into one transaction. Either way, you do not control the fee rate or the broadcast timing of an exchange withdrawal; the exchange does.

That control returns once the coins are in your own wallet, where you choose the fee rate on every send. How mempool congestion, fee estimation, and stuck-transaction rescue (RBF and CPFP) work is covered in the mempool guide. If your withdrawal seems slow during a fee spike, the exchange batching queue is usually the reason, and patience is usually the fix.

How many confirmations until the Bitcoin is really yours?

When the exchange broadcasts your withdrawal it appears in your wallet as unconfirmed: visible, real, but not yet in a block. Each block that includes or builds on your transaction adds 1 confirmation, and blocks arrive every 10 minutes on average. The Bitcoin developer documentation's long-standing guidance: unconfirmed transactions should not be trusted without risk analysis, 1 confirmation drops double-spend risk dramatically, and 6 confirmations (about an hour) is the convention for treating high-value payments as settled verify×DON'T TRUST, VERIFYClaim: Blocks average 10 minutes, unconfirmed transactions carry double-spend risk, risk drops sharply at 1 confirmation, and 6 confirmations is the standard for high-value settlement.Verify at: Bitcoin developer guide: payment processing ↗The open-source Bitcoin developer guide documents confirmation-count risk levels and the six-confirmation convention..

For this workflow the practical bar is lower than the paranoid bar: your test send at 1 confirmation already proves the address is yours, which is all the test needed to prove. Wait for it, send the remainder, and let the big transaction sit to 6 confirmations before you file the whole exercise as done. No action is required from you while confirmations accumulate; the coins are on your keys from the first block onward.

What should you do when the coins arrive?

Two housekeeping moves while the context is fresh. First, label the UTXO. In Sparrow, select the incoming output and give it a name that preserves its origin: "Coinbase w/d 2026-07-29, KYC" beats "my bitcoin" forever after. Coins withdrawn from a KYC exchange are permanently associated with your identity in that exchange's records, and the discipline of keeping KYC coins labeled and separate from other sources is the foundation of every privacy decision you will make later. The full doctrine, including coin control and when consolidation is safe, is in UTXO management, with the broader context in the Bitcoin privacy guide.

Second, note the withdrawal in whatever record you keep for taxes. Moving Bitcoin between accounts and wallets you own is a non-taxable event under IRS guidance, even if the exchange issues an information return for the transfer; your cost basiscost basisWhat you originally paid for an asset. Used to calculate how much profit (or loss) you made when you sell.Full definition and holding period ride along unchanged verify×DON'T TRUST, VERIFYClaim: Transferring virtual currency between wallets or accounts you own is a non-taxable event per the IRS, even if an information return is issued for the transfer.Verify at: IRS: virtual currency FAQ (Q38) ↗IRS FAQ question 38 states wallet-to-wallet transfers between accounts you own do not trigger income, gain, or loss recognition.. Recording the withdrawal transaction ID next to the original purchase records makes the paper trail trivial if you ever need it.

From here the upgrade path is optional and incremental: connect Sparrow to your own node so no third party sees your balance queries (run a node), and revisit custody levels when the stack grows enough to justify multisig or collaborative custody.

What are the common ways people lose money doing this?

Wrong network. The single most damaging mistake. Exchanges now list "Bitcoin" on multiple networks: native BTC, Lightning, and wrapped versions on other chains (Kraken's fee table alone lists BTC on 5 additional networks). Your hardware wallet address starting with bc1 lives on the Bitcoin network only. Both exchanges state plainly that funds sent on an incompatible network are unrecoverable. If the network dropdown says anything other than Bitcoin, stop.

Trusting the clipboard. Kraken's documentation says never type an address by hand, and this page adds: never trust a pasted address either, until the device screen agrees with it. Clipboard-swapping malware exists precisely because most people check 4 characters and hit send.

Address reuse. Sending your second withdrawal to the same address as the first works, but it welds the two transactions together on a public ledger for anyone watching. Every wallet generates unlimited fresh addresses under one seed for free; use a new one per withdrawal. This is privacy hygiene, not paranoia, and it costs nothing.

Screenshot leaks. A screenshot of your withdrawal confirmation contains an amount and an address, which together broadcast your holdings to whoever sees the image, and cloud photo backups mean more people than you think. The catastrophic version is photographing the seed phraseseed phraseThink of it as the combination to a bank vault that exists only in your head: 12 or 24 specific words in a specific order. Anyone who copies the combination opens the vault. The bank has no copy. There is no locksmith, no reset, no customer service. Lose the words, lose the Bitcoin.Full definition itself, which converts an offline secret into a file on someone else's server. Post neither. The Bitcoin scams page covers how leaked stack sizes turn into targeted phishing.

What should you never do, no matter who suggests it?

None of these rules are exotic. Every one exists because a large number of people lost real money learning it. The withdrawal flow on this page, verify on device, test-send, label on arrival, is 20 minutes of process that makes all of them survivable.

Related