Crypto Cost Basis Tracking Without Exchange Logins: The Private Way to Know What You Actually Own

You bought your first crypto three years ago, added to it across two different exchanges, sent some to a hardware wallet, swapped tokens a few times, and earned a little staking yield. Today someone asks you a simple question — what is your cost basis? — and you cannot answer it. The exchanges show different numbers depending on what you withdrew. Your hardware wallet has no idea what you paid. The tracking apps that promise to help all ask for the same thing: API keys, OAuth into the exchange, or worse, your seed phrase. This guide is how to track crypto cost basis without handing any of that over, and still arrive at a number you can defend.

Why Cost Basis Is the Number That Matters

Cost basis is what you paid for an asset — including fees, in the currency you actually paid in. It sounds boring. It is the single number that decides:

• How much tax you owe when you sell. Capital gains are sale price minus cost basis. Get the basis wrong and you either overpay or under-report, both of which are expensive.
• Whether a position is actually in profit. Today’s market price minus your basis is the real P&L. Without basis, you only know the spot value, not the result.
• Which lot to sell first. FIFO, LIFO, HIFO, specific-ID — every method requires you to know the basis of each individual lot. Without per-lot tracking you have no method, just guessing.
• Whether to hold or harvest losses. Loss harvesting is only possible if you can identify which lots are underwater and by how much. That is a basis question.

Everything else in crypto reporting — gain/loss summaries, tax forms, year-end statements — is derived from cost basis. Get this layer right and the rest is mechanical.

Why “Just Connect Your Exchange” Is the Wrong Default

The standard cost-basis tool flow is: log in, paste API keys for every exchange, optionally connect read-only OAuth, and let the service compute everything for you. That sounds convenient and it has four problems.

• API keys are credentials. A read-only API key is still a key. It identifies your account, can usually be elevated by social engineering, and lives on someone else’s server until you remember to revoke it.
• The service knows everything you own forever. You hand over the full position list, withdrawal history, and a permanent timeline of your trading behavior. That data does not get unlearned when you cancel the subscription.
• It only sees exchange-side history. Anything you sent to a hardware wallet, swapped on-chain, earned in DeFi, or received as a payment is invisible to an exchange-only tool. You will still end up doing manual work — except now your data is also leaked.
• It breaks the moment an exchange dies or delists you. When the exchange goes offline (it has happened repeatedly), the API stops working and your tracking history goes with it. The public chain does not.

The private alternative reverses the trust model: keep credentials with you, derive history from public sources (blockchain addresses, CSV exports, manual entries), and let a local tool reconcile.

The Principle: One Ledger, Two Inputs, Zero Credentials

Your crypto cost basis lives in a single private ledger that pulls from two trust-minimized inputs — public addresses for on-chain activity, CSV exports for exchange activity — and nothing else.

The ledger is yours. The blockchain is public read-only data: anyone can query a wallet address; the address does not identify you unless you link it. CSV exports are downloads you control: you can review them before they enter your ledger and delete them after. Together they cover everything you have ever done in crypto without giving any third party a credential.

Three rules make the ledger work:

1. Every lot has a date, a cost, and a fee. No “approximately last summer” — pick the best date you have and write it down, with the FX rate of that day if the purchase was in a different currency.
2. Transfers between your own wallets are not taxable events, but they must be tracked. Otherwise the same coins look like a sale on one side and a purchase on the other, and your basis doubles or vanishes.
3. On-chain swaps are two transactions: a disposal and an acquisition. Token A is sold at its fair market value at swap time; that proceed becomes the basis of Token B. Forgetting this is the most common error in DIY tracking.

The Six-Step System

Step 1 — List every place your crypto has ever been

Write down, on one piece of paper or one note, every exchange account, every hot wallet, every hardware wallet, every staking platform, and every DeFi protocol you have used. Include the dead ones — exchanges that closed, wallets you abandoned. If coins ever lived there, they need to be on the list, because they generated transactions that affect basis somewhere.

The goal of this step is completeness, not action. A missing wallet is the source of “where did these coins come from?” mysteries six months later.

Step 2 — Collect public addresses for self-custody wallets

For every hardware wallet, hot wallet, or self-custody address, write down the public address (the receiving address, not the seed). This is safe to share. It is not a credential. It only allows someone to view balances and history, not to move funds.

A useful detail: most wallets generate a different receive address per asset or per use. Collect the master/extended public key (xpub, ypub, zpub) for Bitcoin, and the main address for account-model chains (Ethereum, Solana, etc.). These give a complete view of the wallet’s history without revealing the seed.

Step 3 — Export CSV from every exchange you used

Every reputable exchange offers a “transaction history” or “trade history” export. Download them. Open each CSV and check it has these columns at minimum:

If a column is missing or the values look off, fix it in the CSV before importing — once it enters the ledger, errors propagate. Common cleanup: convert local-currency prices to your home currency using that day’s rate, and remove duplicate rows from re-downloaded exports.

Step 4 — Enter manual lots for peer-to-peer and gifts

Some coins arrive without a CSV — bought from a friend, received as a gift, earned as a payment for work, or moved in from a wallet you no longer have history for. Enter these manually with the best-effort cost basis:

• Bought peer-to-peer: the actual price you paid, in your home currency, on the day.
• Received as payment for work: the fair market value on the day you received it (that value is also taxable income — record it separately).
• Gift: in most jurisdictions, you inherit the original cost basis from the giver (ask them). If you cannot find out, use the price on the day of the gift and document the assumption.
• Inherited: typically reset to fair market value on the date of inheritance (jurisdiction-specific — confirm with a local tax professional).

Document the assumption next to each manual lot. The audit defense is not “I have a perfect record” — it is “I have a consistent method, applied transparently.”

Step 5 — Reconcile transfers

This is the step that breaks every spreadsheet attempt. Pull up the full ledger and match each “withdraw” on an exchange to a “deposit” on a wallet, and vice versa. They should net to zero in coin terms (minus the network fee). Mark each pair as a transfer, not a sale.

If a withdraw has no matching deposit, you have either lost coins (which is a deductible loss in some jurisdictions, with proof), forgotten to add a wallet, or moved them to a counterparty (which is a disposal). Resolve each one before moving on. Unreconciled transfers are the source of phantom gains.

Step 6 — Pick a method and stick to it

Choose your lot identification method — FIFO is the safest default and is required by tax authorities in some countries — and apply it consistently across years. Switching methods mid-stream creates a paper trail that looks like you optimized after the fact, which is the kind of thing audits notice.

Once the method is set, every sale produces: which lot was used, the basis, the proceeds, the holding period, and the gain/loss. Sum those at year-end and the tax form fills itself.

The Common Errors That Inflate or Deflate Your Basis

• Counting a transfer as a buy. Coins moving into your wallet from your own exchange are not a purchase. If the system thinks they are, you double the basis and under-report gains.
• Ignoring fees. A 0.1% trading fee feels small, but on a hundred trades it materially shifts basis. Buy-side fees add to basis; sell-side fees subtract from proceeds.
• Using purchase-day spot price instead of execution price. They are not the same. The CSV will have the execution price; use it.
• Forgetting on-chain swaps. A Uniswap or Jupiter swap is a sale of Token A and a purchase of Token B at the same instant. Both legs need to be recorded with the fair market value of one of them (usually the dollar/euro/local-currency leg).
• Mixing currencies. Buying ETH for euros on Tuesday and selling it for dollars on Friday produces a euro-denominated basis and a dollar-denominated proceed; you cannot compare them directly. Convert everything to your home currency at each event’s actual exchange rate.
• Trusting the exchange’s “average price” field. It is an average. Cost basis is per-lot. The average will match only if you sell everything at once.

How Thrust Handles This

Thrust is built around the same principle this article describes: your crypto stays in your wallet, and your tracking stays on your phone.

• Add wallets by public address. Paste a public address or extended public key for any supported blockchain. Thrust reads the public chain data directly and reconstructs the transaction history. No seed phrase, no API key, no exchange login. Coverage spans the major chains people actually hold across.
• Import exchange history by CSV. Pull the CSV from your exchange, drop it in, and let it land in the same ledger as the on-chain wallets. Edits stay local.
• Manual lots for peer-to-peer and gifts. Enter the date, amount, price, and fee — Thrust treats it as a first-class lot, not a footnote.
• Unified ledger across fiat and crypto. The same app holds your bank accounts, cards, brokerage, and crypto, so cost basis lives next to the cash that paid for it. Transfers between fiat and crypto stay correctly classified.
• Multi-currency by default. Buy in euros, sell in dollars, hold across both — Thrust keeps a per-event FX rate so the basis stays in your home currency without you doing the math.
• Ghost Mode. Nothing leaves the device. There is no server account, no analytics pipeline that watches what you own, no third party that learns your wallet addresses. The cost-basis numbers exist only on your phone (and in iCloud backup if you turn it on).
• AI CFO that reads only your local data. When the app surfaces “this lot has been held over a year” or “you have unrealized losses worth reviewing,” it is reading from the on-device ledger you built. Nothing is shipped out to be analyzed.

The result is a cost-basis ledger that is private by construction, complete enough to defend at tax time, and built from inputs you control.

The Closing Thought

Cost basis is the boring number that makes every interesting decision in crypto possible — when to sell, when to harvest, when to rebalance, what you actually owe. The reason it stays a guess for most people is not that the math is hard. It is that the standard tools demand more access than the math requires. You can keep the credentials, take the public data, and still arrive at the right number. The work is one careful afternoon and a weekly five-minute check-in after that. The privacy you get back is permanent.