A wallet is key-management software. The coins are entries on the blockchain; the wallet holds the private key that can sign a transfer of them. Everything that follows — backups, hardware devices, seed phrases — is about controlling access to that key, and every large loss reported is, underneath, a story about a key.
Most wallets derive every key from a single seed phrase, usually twelve or twenty-four words. That phrase is the wallet. Anyone who reads it can reconstruct every key it generates and empty every account, on any device, without needing the original hardware. It follows that the phrase must never be typed into a website, stored in a password manager whose vault is synced to a cloud, photographed, or sent to anyone for any reason. No legitimate support process ever asks for it. A request for a seed phrase is definitionally an attack.
The custody choice is between holding keys yourself and having a company hold them. Self-custody removes counterparty risk and gives you sole responsibility for backups; there is no recovery if the phrase is lost. Custodial holding transfers the technical burden to a company and replaces it with credit risk in that company, which several bankruptcies have shown to be real. Neither is safer in the abstract. They fail in different ways, and the right answer depends on which failure you are better placed to survive.
For self-custody, a hardware wallet is the meaningful upgrade. The key is generated on a dedicated device and never leaves it; transactions are signed on the device and only the signature is passed to the connected computer. This defeats the entire category of malware that reads keys from a compromised machine. It does not defeat a user who approves a malicious transaction on the device's own screen, which is why the screen must be read rather than clicked through.
Approval is where most current losses actually happen. Interacting with a decentralised application means signing messages, and some of those messages grant a contract permission to move tokens on your behalf — sometimes without limit and indefinitely. A drainer site works by presenting exactly such a request in a plausible wrapper. Reading what is being approved, limiting allowances, and periodically revoking old ones are the habits that matter, and they matter more than the brand of wallet.
The rest is unglamorous and effective: keep the seed phrase offline and in more than one physical place; verify addresses on the hardware device's own display rather than on the computer's; send a small test amount before a large transfer; keep a separate wallet for experimenting with unfamiliar applications so that a bad approval cannot reach long-term holdings; and treat any unsolicited message about your wallet — email, direct message, phone call, support chat — as hostile until proven otherwise. Attacks on people succeed far more often than attacks on cryptography.