Once you own a cryptocurrency, the coins have to be held somewhere, and that choice decides who can move them. The risks that matter on a long-term holding are storage risks, such as a leaked recovery phrase or a phished login. Storage comes down to two custody models: you hold the keys, or an exchange does.
AAVE, the governance token of the Aave protocol, is an ERC-20 token deployed on Ethereum and bridged to several other networks (source: Aave Docs, AAVE Token). ERC-20 is the standard interface for token transfers and for approvals that let another on-chain party spend your tokens (source: Ethereum Improvement Proposals, ERC-20: Token Standard).
After you buy AAVE, keep only your trading amount on an exchange account with app-based two-factor authentication, and move the rest to a wallet whose recovery phrase is written down offline, ideally a hardware wallet. Before every transfer, check the network, the contract of the AAVE token, and your approvals.
What is self-custody for AAVE?
Self-custody for AAVE means you hold the private keys for the Ethereum address that owns your tokens, so nobody else is able to sign a transfer out of it. The alternative is custodial storage, where an exchange holds the keys and credits AAVE to an account you open with a username, a password, and a two-factor code.
Every Ethereum account consists of two keys: one generates the address you share, and the other stays secret because it signs transactions. A wallet app is the tool that reads that account and sends from it, which is why you can change wallet apps whenever you like while the provider itself never has custody of the funds (source: ethereum.org, Ethereum wallets). A self-custody wallet starts with an AAVE wallet setup that generates the key pair and its recovery phrase on your own device.
Centralized exchanges tie your account to a username and password that can be recovered through the usual reset process. That convenience means trusting the exchange with custody of funds that would be at risk if it ran into financial trouble (source: ethereum.org, Ethereum wallets). The industry terms are custodial storage for keys someone else holds for you and non-custodial storage for keys you hold yourself (source: Investopedia, Cold Storage).
| Custody model | Who holds the keys | What protects your AAVE | Main risk |
|---|---|---|---|
| Self-custody wallet | you | your recovery phrase backup and device security | a lost or leaked recovery phrase |
| Exchange account | the exchange | your login, two-factor authentication, and the exchange's own security | account takeover or exchange failure |
Neither model is safe by default, so pick the one whose failure you can manage for the amount involved. Many holders use both: an exchange balance for the AAVE they expect to trade soon and a self-custody wallet for the tokens they plan to hold for years.
How to back up your AAVE seed phrase
A seed phrase, also called a recovery phrase, is the list of words a wallet generates so you can rebuild your keys on a new device. Backing it up means writing the words on paper or another offline medium, storing that copy somewhere private, and keeping it out of every website, chat window, and support form.
The phrase is the master key to the wallet, which means anyone who holds it can open every account derived from it and drain each balance, AAVE included. Genuine support staff, wallet makers or websites have no reason to request it (source: ethereum.org, Ethereum security and scam prevention). Any request for the phrase, however official it looks, is a scam.
Write the words down by hand when the wallet first shows them and keep that copy off your computer (source: ethereum.org, Ethereum wallets). A photo or screenshot of the phrase can sync to a cloud storage provider, which makes it reachable by attackers who break into that cloud account (source: ethereum.org, Ethereum security and scam prevention).
Paper has its own failure point, because a sheet that is lost, destroyed, or made unreadable takes access to the funds with it (source: Investopedia, Cold Storage). Make a second copy and keep the two in separate secure places, so a single fire or burglary cannot reach both.
A common route to a stolen phrase starts with a message. Support impersonators look for people asking questions in Discord channels and other chat apps, offer private help, and then ask for the phrase or for a transfer to their wallet. Phishing emails link to imitation sites that ask you to type the phrase in (source: ethereum.org, Ethereum security and scam prevention). If you use a browser wallet, bookmark its official site and open it only from that bookmark (source: ethereum.org, Ethereum wallets).
Hot wallets and cold storage for AAVE
A hot wallet keeps your private keys on a device connected to the internet, such as a phone app, a browser extension, or a desktop program. Cold storage keeps the keys offline, most often on a hardware wallet, so each AAVE transfer is approved on a separate device that a hacked computer struggles to control.
Cold storage is the practice of keeping private keys offline to protect them from online theft. Hot wallets run on connected devices whose software an attacker is able to alter (source: Investopedia, Cold Storage). A hardware wallet stores the private key on the device itself, where the key never touches the internet. Keeping keys offline sharply cuts the risk of theft even when someone gains control of your computer (source: ethereum.org, Ethereum security and scam prevention).
Say you hold 40 AAVE, expect to swap about 2 AAVE in the coming months, and plan to hold the other 38 AAVE for years. Keep the 2 AAVE in a hot wallet on your phone and the 38 AAVE on a hardware wallet that has its own written recovery phrase. Signing from the hardware wallet is slower, because you confirm each transfer on the device screen, yet a phishing link opened on your phone can reach only the 2 AAVE. That split follows the usual rule of holding in a hot wallet only what you need for near-term transactions (source: Investopedia, Cold Storage).
The common mistake is importing the hardware wallet's recovery phrase into the phone app so the 38 AAVE are easier to check. That step copies the master key onto an internet-connected device, and the long-term holding becomes as exposed as the 2 AAVE in the hot wallet. To check the cold balance, look up its public address on a block explorer.
Moving AAVE between the two wallets is an ordinary on-chain token transfer that costs gas in ETH, so run the usual address and network checks when you send and receive AAVE. When you choose a crypto wallet for either role, confirm it supports Ethereum and every other network where you hold AAVE.
Token approvals on a self-custody AAVE wallet
A token approval is a permission you sign that lets a smart contract move a set amount of your AAVE without asking you again. Decentralized apps rely on approvals to take tokens for a swap or a deposit, and an old unlimited approval to a malicious contract can drain AAVE from a wallet whose seed phrase is perfectly safe.
Under the ERC-20 standard, the approve function lets a chosen spender withdraw from your account repeatedly, up to the amount you set. A second function, allowance, reports how much that spender is still able to take (source: Ethereum Improvement Proposals, ERC-20: Token Standard). Because the approval lives on the token contract, an approved contract can move AAVE out of a hardware wallet without a new signature.
Many apps ask for an unlimited allowance to save you a second approval fee later. A contract holding unlimited access to a token can spend all of that token in your wallet, even after you have withdrawn your funds from the app. Approvals carry no expiry date. Disconnecting your wallet from a site keeps any allowance you granted in force (source: ethereum.org, How to revoke smart contract access to your crypto funds).
To review your approvals, open a revoke tool such as Etherscan's token approval checker and connect your wallet on the same network as your AAVE. Find any contract that has access to AAVE, click revoke, and confirm the transaction in your wallet. Each revocation is its own transaction and costs a network fee (source: ethereum.org, How to revoke smart contract access to your crypto funds).
When you sign a new approval, set the spending limit to the amount the transaction needs, since an unlimited limit lets the contract empty that token from your wallet. Airdrop scams work the same way. A stranger sends a token to your wallet and points you to a claim site, where the transaction you are asked to approve gives the scammer control of your account or sends your funds to them (source: ethereum.org, Ethereum security and scam prevention). Learn how AAVE scams and fake tokens imitate the real contract before you approve anything unfamiliar.
Keeping AAVE on BloFin and withdrawing to your wallet
If you trade AAVE as well as hold it, an exchange account gives you a second place to keep part of the balance, with an order book and a password login in place of a seed phrase. The exchange holds those keys, so the AAVE you keep there is protected by your account security and by the exchange itself.
BloFin offers that second place as another way to trade AAVE, through the AAVE/USDT Spot market, where you buy and sell the token itself, or the AAVEUSDT Perpetual, a USDT-margined contract that tracks the AAVE price. Spot AAVE/USDT gives you tokens you can later withdraw to your own wallet. A perpetual contract is a position on the price, so it holds no AAVE that could move into self-custody.
Use a unique password and an authenticator app for two-factor authentication, because codes sent by SMS are exposed to SIM jacking, where an attacker takes over your phone number (source: ethereum.org, Ethereum security and scam prevention). Treat any message that asks you to move funds or read out a code as a scam attempt.
Withdrawals from BloFin require active two-factor authentication through Google Authenticator or a passkey, set up before you start the withdrawal itself.
- Transfer the AAVE you plan to withdraw into your Funding Account, because withdrawals are processed only from that account.
- Hover over Assets in the top right corner, select Withdraw, and search for AAVE.
- Choose the withdrawal network that matches the network your receiving wallet uses for AAVE.
- Paste your wallet address, then compare the first and last few characters with the address your wallet shows.
- Enter the amount and read the network fee displayed on screen before you confirm, which varies by asset and network.
- Click Withdraw, enter the email code and the Google Authenticator code before they expire after five minutes, and confirm the details.
Once broadcast, the withdrawal can be tracked by its transaction hash (TXID) in your withdrawal history. Each asset has a minimum withdrawal amount shown on the screen before you submit. Limits apply daily and monthly by verification level, starting at 20,000 USDT a day for a standard account. Personal verification raises the daily limit to 1,000,000 USDT and address verification to 2,000,000 USDT.
Before you decide how much AAVE stays on the exchange and how much moves to your wallet, compare the maker and taker rates for spot and perpetual trading on the BloFin fee schedule.
Checklist before you store AAVE long term
Before you stop checking an AAVE balance regularly, confirm seven things: where it is held, how you will recover the wallet, which token contract you use, whether gas is available, which approvals remain, whether a test transfer succeeded, and how any exchange balance is protected. The list below covers each check before you leave the balance untouched.
- Write down where each portion of your AAVE sits: a self-custody address, an exchange spot balance, or a perpetual position that holds no tokens.
- Locate your offline recovery phrase copies and confirm you can read every word, without photographing them.
- Confirm the token contract. On Ethereum, official AAVE lives at contract address 0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9 with 18 decimals (source: Etherscan, Aave Token (AAVE)). The official deployments on other networks (Arbitrum, Base, Optimism, and Polygon) each use a separate contract address (source: Aave Docs, AAVE Token).
- Keep ETH in the same address for gas. The gas fee is paid in ETH and is charged even when a transaction fails. A plain ETH transfer uses 21,000 units of gas. At a combined base and priority fee of 12 gwei, that transfer costs 0.000252 ETH. A token transfer calls a smart contract and needs more gas than that plain ETH payment (source: ethereum.org, Gas and fees).
- Revoke every token approval you no longer use, especially unlimited ones.
- Send a small test amount before moving a full balance to any new address, device, or network, and wait for it to arrive.
- For AAVE kept on an exchange, confirm that two-factor authentication runs through an authenticator app and note why that balance is still there.
The test transfer costs one extra network fee, which is cheap insurance against a mistyped address on a 38 AAVE move. When a balance looks wrong after a wallet restore, check the selected network and the token contract before assuming the recovery phrase failed, because a wallet set to another network shows no balance for tokens held on Ethereum.
Looking to trade AAVE tokens on BloFin? To get started, you'll need to first create a BloFin account, fund your account with cryptocurrency, then open the AAVE/USDT Spot trading page or the AAVEUSDT Perpetual page.
Frequently asked questions
Is it safer to keep AAVE on an exchange or in your own wallet?
Each option fails in a different way, so the safer one is the option whose risk you can control for the amount involved. Stolen crypto is generally uninsured and unbacked by any government, and a blockchain transfer cannot be pulled back the way a bank refunds a compromised card. Some exchanges keep customer keys in cold storage of their own, which is the custodial version of the same offline protection (source: Investopedia, Cold Storage). In a self-custody wallet, that protection depends entirely on how you store the keys.
Can you still vote with AAVE kept in cold storage?
AAVE holders can vote on Aave governance proposals or delegate their voting power to someone else, and holders of stkAAVE, the AAVE staked in the safety module, have the same rights. Those votes shape protocol deployments, parameter adjustments, and new features (source: Aave Docs, AAVE Token). Voting from a hardware wallet works like any other signature, with the governance app preparing the vote and you confirming it on the device. A hardware wallet therefore keeps your governance rights intact while the keys stay offline.
Does staking or supplying AAVE on Aave count as storing it?
Staking and supplying put your AAVE to work inside smart contracts, which adds protocol risk on top of custody risk. AAVE staked in the safety module earns rewards in a module that was designed as a backstop in case the protocol becomes insolvent. AAVE supplied to Aave markets can serve as collateral for borrowing other assets (source: Aave Docs, AAVE Token). Borrowing against supplied AAVE exposes it to liquidation, so treat staked or supplied tokens as an active position you monitor, separate from the balance in cold storage.
What should you do if you lose the seed phrase but still see your AAVE?
Move the AAVE to a new wallet while the device that still holds your keys keeps working. The written seed phrase is the only way to recover a wallet (source: ethereum.org, Ethereum wallets). Without it, a phone that breaks, gets replaced, or is reset takes access to the balance with it. Create the new wallet, write its recovery phrase on paper, send a small amount to confirm the address works, then transfer the remainder. Ignore any website or chat that offers to rebuild the phrase for you.
Is AAVE on Arbitrum or Base the same token as AAVE on Ethereum?
The AAVE you hold on Arbitrum or Base is the same governance token, carried there from Ethereum through canonical messaging bridges. Bridging the tokens back to Ethereum depends on the availability of that network's bridge (source: Aave Docs, AAVE Token). A balance on another network therefore carries one more dependency than AAVE held on Ethereum itself. Before you receive AAVE on a second network, switch your wallet to that network and keep enough of the gas token it uses in the same address.
Should I review AAVE approvals before long-term storage?
Yes. Disconnecting a wallet from a website leaves its existing token permissions in place, so an app may retain access after you stop using it. Review the spending allowances associated with your AAVE account and revoke permissions you no longer need. Each network has its own approval records, so check the networks where you used the wallet. Revoking an allowance requires an onchain transaction and its fee, so retain enough gas to submit it (source: ethereum.org, How to revoke smart contract access to your crypto funds).
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources include Aave token documentation, the ERC-20 standard, Etherscan, ethereum.org guidance, Investopedia, and the BloFin Academy withdrawal guide. All facts independently verified against cited documentation current as of October 2026.
This article is for informational and educational purposes only. It is not financial, investment, trading, or legal advice. Cryptocurrency can lose value. Borrowing on Aave can lead to liquidation if the health factor drops below 1. Spot AAVE/USDT buys the token. An AAVEUSDT Perpetual is a contract on the price. Do your own research. Consider your circumstances before using any protocol or trading any asset.