Are coins stored inside a wallet?

A wallet manages keys and creates transactions. Bitcoin balances are represented by unspent transaction outputs on the blockchain. Control of the required signing keys determines spending authority.

With custody, a provider controls signing keys. With your own wallet, you control them and must protect the backup. Neither arrangement removes every operational risk.

Source: Bitcoin wallets

Exchange account versus your own walletIn a custodial account, you request and the platform signs with its keys. In your own wallet, you sign and the network checks. A withdrawal connects these arrangements.Custodial accountYou request → platform signsPlatform holds the keysWithdrawalYour own walletYou sign → network checksYou protect the keys and backup
The location of the signing keys changes who can authorise a payment.

Why is a recovery backup sensitive?

A recovery phrase can restore many wallets and may grant control over their funds. Keep it private and offline. Do not send it to someone claiming to offer support or enter it into an unsolicited website.

Use the software provider’s verified backup instructions. A password for an account and a recovery backup have different roles.

Source: Securing a Bitcoin wallet

What should you inspect before sending?

Verify the destination and amount on a trusted display. Malware can replace a clipboard address. For an unfamiliar workflow, a small test payment can help reveal a mistake, but it does not remove every risk.

Understand fees and confirmation time. A website balance alone does not prove that a payment has settled on the intended chain.

Source: Things to know about Bitcoin

Which requests should make you stop?

Urgent deposit demands, requests for recovery phrases and offers to release funds after another payment are warning signs. Verify domains and software through primary sources. Do not share private keys to claim an unfamiliar fork coin.