Learning how to buy Ethereum takes about ten minutes. Learning how to buy it safely takes a little longer, and that is the part this guide focuses on. The purchase itself is the easy step: an exchange takes your money and credits your account with ETH. The mistakes happen around it. People sign up on a lookalike site, skip two-factor authentication, send coins on the wrong network or fall for a “support agent” who messages them first.
We run a block explorer site, so we approach buying from the other end: the moment your ETH lands in a wallet you control and you can see the transaction yourself on the public chain. Everything before that point is about making sure it gets there. The eight steps below take you from an empty wallet to a verified, self-custodied balance.
How to buy ETH safely: the 8 steps
Here is the whole route at a glance. The sections after it explain the parts where people most often go wrong.
- 1
Set your budget and your goal
Decide how much you are prepared to put at risk and whether you want ETH to hold, to pay gas, or to use in apps. Crypto prices can halve in weeks. Only use money you could afford to lose.
- 2
Pick a registered exchange that serves your country
Shortlist exchanges that operate legally where you live, then confirm their registration yourself on the regulator’s own register (FinCEN, NMLS, FCA, ESMA/BaFin/AMF, FSA Japan). Never rely on a logo on the exchange’s website.
- 3
Create the account and complete identity checks
Type the exchange address yourself or use the official app. Expect to upload an ID document and a selfie, and sometimes proof of address. Legitimate exchanges ask for this; they never ask for your wallet recovery phrase.
- 4
Lock the account down before you deposit
Turn on app-based 2FA or a passkey, use a unique password, set an anti-phishing code if offered and enable a withdrawal address allow-list, ideally with a waiting period for new addresses.
- 5
Fund the account and buy ETH
Bank transfer is usually cheapest; cards are fastest but cost more. Compare the total: how much ETH you receive for your money after fees and spread, not the headline fee alone.
- 6
Set up a self-custody wallet
Install a reputable wallet app or set up a hardware wallet. Write the recovery phrase on paper, store it offline and never type it into a website. Copy your receiving address from the wallet itself.
- 7
Send a small test withdrawal
Withdraw a small amount first, choosing the Ethereum network that matches your wallet. Check the first and last six characters of the address before you confirm.
- 8
Verify the transfer on-chain, then send the rest
Paste the withdrawal transaction hash into a block explorer. Check status, recipient, amount and confirmations. Once the test is finalized and visible in your wallet, withdraw the remaining balance.
Where to buy Ethereum: choosing a regulated exchange
Most people buy their first ETH on a centralized exchange, because it is the simplest way to turn dollars, euros or pounds into ether. The single most important filter is not the fee or the app design. It is whether the company is legally allowed to serve customers where you live, and whether you have confirmed that yourself.
Exchanges love to show regulator logos. Ignore them and go to the source. Every regulator below runs a free public search. Type the company’s legal name, then check that the registration number, trading name and web address match exactly. Scammers regularly clone real firms’ details, so a match on name alone is not enough.
United States
Crypto exchanges that transmit money must register with FinCEN as a Money Services Business, which you can check in the FinCEN MSB registrant search. Registration is an anti-money-laundering requirement, not an endorsement. The more meaningful layer is state licensing: search the company on NMLS Consumer Access to see which state money transmitter licences it actually holds. If your state is not on the list, the exchange may not be able to serve you. The SEC’s Investor.gov also publishes alerts about crypto fraud.
United Kingdom
Crypto firms must be registered with the Financial Conduct Authority for anti-money-laundering purposes. Look the firm up on the FCA Financial Services Register and check the FCA warning list for clones. Registration does not mean your crypto is protected by the Financial Ombudsman or the FSCS.
European Union
Under the MiCA regulation, crypto-asset service providers need an authorisation from a national authority, and the national transition periods ended by 1 July 2026 at the latest. Check the interim register published by ESMA, or the national regulator: BaFin’s company database in Germany and the AMF in France. An authorised provider can passport its licence to other EU countries, and the register shows where.
Japan
Residents of Japan should use a crypto-asset exchange service provider registered with the Financial Services Agency. The FSA publishes the official list as a PDF; if a platform is not on it, it is not allowed to solicit Japanese customers.
The exchange we point readers to
When readers ask us where to start, we point them to CEX.IO. It has operated since 2013, is registered with FinCEN as a Money Services Business, holds money transmitter licences in multiple US states (NMLS ID 1804170), is registered with the UK FCA for cryptoasset activities and is PCI DSS compliant for card payments. That is a track record and a set of registrations you can check yourself on the registers above, which is exactly what we recommend you do. Availability differs by country and US state, so confirm that it can serve your jurisdiction before you sign up. No exchange is risk-free, including this one.
Identity checks (KYC): what to expect
Regulated exchanges must know who their customers are. Expect to provide your full name, date of birth and address, a photo of a passport, national ID card or driving licence, and a live selfie so the system can match your face to the document. Some countries and higher limits also require proof of address or a question about the source of your funds. Approval can take minutes or, on a busy day, a couple of days.
Two privacy habits help here. Upload documents only inside the official app or site you reached by typing the address yourself, never through a link in an email or chat. And remember that no legitimate exchange will ever ask for your wallet recovery phrase, your 2FA codes or remote access to your computer as part of verification.
Payment methods and fees, in plain terms
You will usually be offered three ways to pay. Bank transfer (ACH or wire in the US, SEPA in Europe, Faster Payments in the UK) is normally the cheapest, and it can take from a few seconds to a few days depending on the rail. Debit or credit card is instant and convenient but typically costs noticeably more, often a few percent once processing fees are included. Wallet payments such as Apple Pay or Google Pay behave much like cards.
Fees hide in three places: an explicit trading or processing fee, the spread between the price you pay and the market price, and a withdrawal fee when you move ETH out. The easiest honest comparison is to ask each exchange the same question: “If I pay 500 in my currency, how much ETH ends up in my own wallet?” Instant “buy” buttons are simpler; an order book with a limit order is often cheaper if you are comfortable using one.
Securing your exchange account
Do this before you deposit anything, not after. Use a password you have never used elsewhere, stored in a password manager. Switch on two-factor authentication with an authenticator app, a security key or a passkey rather than SMS, which can be hijacked through SIM swapping. Set an anti-phishing code if the exchange offers one, so genuine emails carry a word only you know.
The most underrated setting is the withdrawal allow-list. When it is on, the account can only send crypto to addresses you have approved in advance, and many exchanges add a waiting period, often 24 to 48 hours, before a newly added address can be used. If someone does get into your account, that delay is your window to freeze it.
Withdrawing ETH to a self-custody wallet
Coins on an exchange are an IOU from the exchange. Coins in a wallet whose recovery phrase only you hold are yours in the full sense. For amounts you intend to keep, a self-custody wallet removes the risk of the exchange freezing withdrawals or failing, and it lets you use ETH directly in apps. The trade-off is that nobody can reset your recovery phrase for you. Write it on paper or metal, keep it offline and never photograph it. The ethereum.org wallet finder is a good neutral starting point.
When you withdraw, the exchange will ask which network to use. For ETH on Ethereum mainnet choose “Ethereum” or “ERC-20”. Many exchanges also offer layer 2 networks such as Arbitrum or Base, which are cheaper; they only make sense if your wallet is set to that network too, and our layer 2 explorer guide explains how to track funds there. Copy your address from the wallet app, paste it and compare the first and last six characters. That check defeats clipboard malware and address poisoning, where scammers send you tiny transfers from lookalike addresses hoping you will copy the wrong one from your history.
Always start with a test transaction of a small amount. It costs one extra withdrawal fee and a minute of your time, and it proves that the address, the network and your wallet setup all work before the full amount is on the line. On mainnet in 2026 the network fee itself is tiny; our Ethereum gas tracker shows the live price.
Verifying the withdrawal on-chain
Once the exchange processes your withdrawal, it shows a transaction hash (sometimes called TxID): a 66-character string starting with 0x. Paste it into our live Ethereum explorer and check four things. Status should say Success. The to address, or the recipient under “internal transfers”, must be your address. The value should match what you withdrew minus any exchange fee. And the confirmations count shows how deep the transaction is buried.
Do not be alarmed if the “to” field shows a contract rather than your address. Many exchanges batch withdrawals through a smart contract, so your ETH arrives as an internal transfer inside that transaction. Your own address page tells the clearest story: search it in the explorer and you will see the new balance and the incoming transfer. Our transaction explorer guide explains every field and our address explorer guide covers balances and history.
On confirmations: Ethereum produces a block every 12 seconds and a transaction is finalized after two epochs, about 13 minutes. After that it cannot be reversed without a massive, highly visible attack on the network. When your test shows as finalized and appears in your wallet, send the rest with confidence.
Scams to avoid when buying ETH
Crypto fraud rarely looks like hacking. It looks like helpfulness. These are the patterns we see most often, and each one has a simple defence.
Fake support agents
You post a question on social media, and within minutes a “support agent” replies or messages you. Or you search for an exchange’s phone number and call one planted in an ad. Real exchanges do not contact you first through direct messages, and they never need your recovery phrase or screen access. Only use support through the official app or website.
“Recovery” services
After a loss, victims are often targeted a second time by firms promising to trace and recover stolen crypto for an upfront fee. Explorers let anyone follow stolen funds, but following them is not the same as getting them back; that takes law enforcement and, usually, a cooperating exchange. The FTC calls refund and recovery scams “the worst of the worst” for a reason: legitimate agencies never charge upfront to help you get money back, and nobody can guarantee it. Its guide to crypto scams covers the other common patterns. Report losses to the FTC or the FBI’s IC3 in the US, or through FCA ScamSmart in the UK.
Pig-butchering investment scams
A stranger strikes up a friendship or romance, usually after a “wrong number” text or a dating app match, and after weeks of trust-building introduces you to a trading platform showing spectacular gains. The platform is fake, the balance is a number on a screen, and withdrawals require ever larger “taxes” or “fees”. FinCEN has issued an alert describing exactly this scheme. If someone you have never met in person is coaching you to invest, stop.
Two more to watch: fake apps and search ads impersonating exchanges and wallets, and “giveaways” that promise to double any ETH you send. Neither is ever real. Before you interact with any token someone sends you, check it in our token explorer guide, because unsolicited airdrops are a favourite lure for phishing approvals.