How to Buy Bitcoin Safely in 2026: Exchange, Fees, and Cold Storage

Buying bitcoin is easy. Buying it without overpaying by 2% and without handing it to a thief six months later is the part most guides skip. This is the process we follow ourselves, written down in order, with the fees each path costs as of October 2026.

Two numbers frame everything below. The same $1,000 purchase costs about $45 on a card through an instant-buy screen, or about $2.50 as a bank-funded limit order on the same exchange’s pro interface. And the losses that reach the news (exchange hacks) are rarer than the ones that do not: people handing over their recovery phrase to a fake support agent, or getting their SMS codes intercepted.

Step 1: Pick a regulated exchange with a security record

The exchange is the one point in this process where you have to trust somebody. Pick for track record, not for the app’s star rating.

What we check before moving money to any exchange:

• Licensing in your country. In the US that means state money transmitter licenses and FinCEN registration; in the EU, a MiCA authorization. An exchange that is not licensed where you live will eventually freeze your account or disappear.
• Years without losing customer funds. Kraken has operated since 2011 with no customer coin losses from a breach. Coinbase has been public since 2021 and has never lost customer bitcoin to a hack, though a 2025 incident saw bribed support contractors leak personal data for about 1% of users. That leak fuelled phishing calls, which is why the account hardening in step 2 matters more than the exchange’s name.
• Proof of reserves or audited financials. Kraken publishes Merkle-tree proof of reserves. Coinbase files audited statements with the SEC. Either is acceptable. An exchange with neither gets no money.
• Withdrawals that actually work. Read recent reviews for the phrase “withdrawal pending.” An exchange that lets you in but not out is a trap, regardless of how legitimate the website looks.

Our pick is Kraken: longest record, 0.25% maker fee on the pro interface, proof of reserves, and a support desk that has not been in the news. Coinbase is the fallback for people who want the most polished app and for the handful of US states where Kraken’s funding options are limited. If you only ever want bitcoin, River and Strike are bitcoin-only platforms with free recurring buys after the first week and a 0.15 to 0.25% spread, and we have no affiliate relationship with either; they are worth a look if you plan to buy a fixed amount every week.

Step 2: Lock the account before it holds anything

Do this the day you sign up, before the first deposit. The attacks that hit exchange customers go after the login, not the exchange.

1. Unique password from a password manager. Twenty characters, never reused. Credential-stuffing from old breaches is still the cheapest attack there is.
2. Authenticator app, never SMS. Use an app (Aegis, Google Authenticator, or a hardware key such as a YubiKey). SMS codes are defeated by SIM swapping, where someone convinces your carrier to move your number to their phone. Both Kraken and Coinbase let you remove SMS entirely; do it.
3. Withdrawal address allowlist. Kraken calls it “address whitelisting” under Settings, Security; Coinbase calls it “Address book, allowlisting.” Once on, withdrawals can only go to addresses you pre-approved, usually with a 24 to 48 hour delay for new entries. An attacker who steals your session cannot drain the account to their own wallet.
4. Global settings lock (Kraken) or security-change delay. Kraken’s Global Settings Lock freezes security settings for a period you choose. It stops an attacker from quietly turning off the protections above.
5. Separate email address. A new address used only for the exchange, itself protected by an authenticator app. Most account takeovers begin with the email, not the exchange.

Step 3: Verify your identity

Every regulated exchange requires it. Expect to upload a government ID, take a selfie, and confirm your address. Kraken’s Intermediate tier (ID plus proof of address) unlocks bank funding and is approved within minutes most of the time; Coinbase verification is similar.

Two things worth knowing. First, upload documents only inside the exchange’s own app or website, never by email or through a link someone sends you. Second, verification is also when you decide the account name: use your legal name exactly as on your bank account, or bank deposits will be rejected or held.

If you are tempted by a platform that skips this step, read the FAQ on no-KYC buying below and then do not do it.

Step 4: Fund by bank transfer, not card

How money enters the exchange is the first place fees hide.

Funding method	Typical cost	Settles in	Use it?
ACH / SEPA / Faster Payments	Free on Kraken and Coinbase	1 to 3 business days (instant on SEPA Instant and FPS)	Yes
Wire transfer	$0 to $25	Same day	For large amounts
Debit card	2 to 4% on top of the trading fee	Instant	No
PayPal / Apple Pay	2.5 to 4%	Instant	No

Instant funding by card feels convenient, but you pay for the speed twice: a card fee and, on most platforms, a higher “simple buy” spread. A bank transfer initiated on Monday arrives by Wednesday and costs nothing. If the price moves 3% in those two days it may go either way; the card fee only ever goes one way.

Start with a small amount, $50 to $100, for the first full round trip. You are testing the process, not the price.

Step 5: Buy with a limit order on the pro interface

Both Kraken and Coinbase run two storefronts on the same account. The default app screen (Kraken’s “Buy” tab, Coinbase’s “Buy & sell”) is built for speed and charges accordingly. The pro screen (Kraken Pro, Coinbase Advanced) is the actual exchange, with an order book and fees a fraction of the size.

What a $1,000 bitcoin purchase costs today, by path:

Path	Fee structure	Cost on $1,000
Coinbase simple buy, card	3.99% fee + ~0.5% spread	~$45
Coinbase simple buy, bank	1.49% fee + ~0.5% spread	~$20
Kraken instant buy, bank	1% fee + spread	~$12 to $15
Coinbase Advanced, market order	0.60% taker	$6
Coinbase Advanced, limit order	0.40% maker	$4
Kraken Pro, market order	0.40% taker	$4
Kraken Pro, limit order	0.25% maker	$2.50
River / Strike recurring buy	0% fee + 0.15 to 0.25% spread	$1.50 to $2.50

Fee tiers quoted are the base tier under $10,000 of 30-day volume; rechecked October 2026.

How to do it on Kraken Pro, which is the path we use:

1. Open Kraken Pro (web, or the toggle at the top of the app) and select the BTC/USD pair, or BTC/EUR, BTC/GBP as appropriate.
2. Choose Limit, not Market.
3. Set the price a few dollars below the current best ask. The order sits in the book until someone sells into it, which classifies you as a “maker” and gets the 0.25% rate. In a normal market it fills within minutes.
4. Enter the amount in your currency, not in BTC. Kraken converts.
5. Confirm, then check the “Orders” tab until status reads Filled.

The Coinbase Advanced flow is the same: Advanced, BTC-USD, Limit, price just below the ask.

Step 6: Withdraw to a wallet you control

Bitcoin on an exchange is an entry in that exchange’s database. Bitcoin in your own wallet is yours regardless of what happens to the exchange. For anything beyond pocket-money amounts, move it.

A hardware wallet is a small device that signs transactions without ever exposing the private key to your computer or phone. Two devices cover almost everyone:

• Trezor Safe 3, about $59. Open-source firmware, secure element chip, a bitcoin-only firmware option that removes every other coin from the interface. This is what we use for long-term holdings.
• Ledger Nano S Plus, about $59. Largest coin support, closed-source secure element, good mobile app. Ledger’s 2023 “Recover” feature (an opt-in paid service that splits your seed with third parties) upset many users but is off unless you turn it on.

Rules for buying the device itself:

• Only from the manufacturer’s own store. Devices sold through Amazon third-party sellers and eBay have been tampered with, often arriving with a pre-filled “recovery card” that sends your coins to the seller. Both links above go to the official shops.
• The device must generate the seed on its screen during setup. If a recovery phrase arrives printed, scratched off, or in the box, the device is compromised. Return it.
• Firmware update first, from the official app (Trezor Suite, Ledger Live), before any coin touches it.

Then the first withdrawal:

1. In the wallet app, create a bitcoin account and click Receive. The device shows an address beginning with bc1q or bc1p. Verify that the address on the device screen matches the one on your computer; this check is the entire reason the device has a screen.
2. On the exchange, add that address to the withdrawal allowlist from step 2. Wait out the delay.
3. Send a test amount first. $10 worth. Wait for one confirmation (about 10 minutes, sometimes longer). Confirm it shows in the wallet app.
4. Send the rest. Kraken charges a small flat network fee for BTC withdrawals; Coinbase passes through the network fee. Both are usually under $2 in 2026.

Step 7: Back up the recovery phrase, offline, twice

Setup gives you 12 or 24 words. Those words are the bitcoin. The device is just a convenient way of using them; lose the device and the words restore everything on a new one. Lose the words and nobody can help.

• Write them on the card supplied, by hand, in order. Check every word against the device screen.
• Make a second copy and store the two in different places (home and a trusted relative’s, or home and a safe deposit box).
• Never photograph them, type them into a computer, store them in a password manager or cloud note, or say them aloud to anyone. Every one of those has produced a documented loss.
• For holdings that would hurt to lose, stamp the words into a steel plate (about $30 to $50) so fire and water cannot destroy them.
• Add a passphrase (sometimes called a 25th word) only once you understand it: it creates a separate hidden wallet, and forgetting it is as final as losing the seed.

Do a restore drill once. Wipe the device, restore from the written words, and confirm the same address appears. Twenty minutes now saves the one scenario where you find out the backup was wrong.

The scams that actually get people in 2026

Ranked by how often they appear in exchange support forums and law-enforcement reports:

1. Fake support calls and chats. Someone claiming to be from the exchange or wallet company walks you through “securing” your coins by sending them away, or asks for the recovery phrase to “verify” you. No legitimate company asks for it, ever.
2. Seed-phrase phishing sites. Search ads and lookalike domains for Ledger Live or Trezor Suite that ask you to “validate” your wallet. Bookmark the real app; never install from a search result.
3. Pig-butchering investment platforms. A contact met online suggests a trading site with guaranteed returns. The dashboard shows profits; withdrawals never work. Any platform you cannot find on a regulator’s register is this.
4. Address-swapping malware. Clipboard hijackers replace a pasted bitcoin address with the attacker’s. The screen check on your hardware wallet defeats it; so does the test transaction.
5. “Earn yield on your bitcoin.” Lending platforms paid 6 to 8% until Celsius, BlockFi, and Voyager went bankrupt in 2022 with customer coins. Bitcoin held properly earns nothing, and that is the point. Skip anything that promises otherwise.

When to skip self-custody

Self-custody is not free: it costs a device, an afternoon, and the responsibility for the backup. It is the right call for most holdings, but not all.

Keep the coins on the exchange, with the hardening from step 2, if:

• the total is under about $500 and the device would cost more than 10% of the holding;
• you plan to sell within a few weeks;
• you honestly cannot commit to storing two paper backups somewhere you will find them in five years.

Move to a hardware wallet when the balance grows, or when you notice you would be upset to lose it. The exchange is a sensible waiting room and a bad vault.

Costs, in one place

Item	Cost	Required?
Exchange account	Free	Yes
Bank funding	Free	Yes
Trading fee (Kraken Pro limit)	0.25%	Yes
Hardware wallet	$59	Above a few hundred dollars
Steel seed backup	$30 to $50	Above a few thousand dollars
Withdrawal network fee	Under $2	When moving coins

A first purchase of $1,000 done this way costs roughly $62 all in, with $59 of that being a device you keep. The same purchase on a card through an instant-buy screen costs about $45 and leaves the coins on someone else’s server.

What we would tell a friend

Open Kraken, enable the authenticator app and address allowlist before depositing, fund by bank, buy with a limit order on Kraken Pro, and move anything that matters to a Trezor Safe 3 after a $10 test transaction. The whole thing takes an afternoon plus the bank’s settlement time, and it is the last time you will have to think about where the coins are.

Pricing and fees in this article were rechecked October 2026. Exchange fee schedules change; the pro-interface rule and the security steps do not.