How can I safely store and trade Bitcoin and other crypto currencies? How can I safely store Bitcoin?

Exchanges require me to deposit to trade, is this safe? If I can't trust exchanges, what is the best way to safely store my cryptocurrency and transact it?
There are several ways to store cryptocurrencies, so let's break them down by use-case and safety-level.

Exchanges

There are, broadly speaking, two types of exchanges. Centralized exchanges, such as Bitfinex, Bittrex, Kucoin, etc., and decentralized exchanges such as Etherdelta and Switcheo.

Trading on a centralized exchange requires you to deposit cryptocurrencies before you can trade them.  In this regard, they function as custodial services, and thus come with a very high level of risk.  If the exchange operators steal your coins, or if the exchange gets hacked, your funds may disappear, and there may be very little you can do to get them back.

In general, one should only store coins that they are actively trading on an exchange.  To reduce the risk of loss via theft or fraud, balances that are not being actively traded should be withdrawn to one of the wallets described below.

Decentralized exchanges are less risky, as they allow you to deposit coins as part of your trade, and the proceeds from a trade will typically go directly to your wallet.  However, certain risks still exist, such as:


The site acting as the front of the decentralized exchanges could be compromised, and work to steal your keys
perhaps the contract is a scam and will take your incoming coins, and not pay out the proceeds of the trade. 


These risks can be reduced by:


Using a temporary wallet for trades
Only storing coins you are trading in that wallet
Ensuring that you are using the correct decentralized exchange (check the domain, check the contract address).


Personal Wallets

Personal wallets also come in a number of flavours.  We will break them down into three broad categories:


Hosted Wallets
Local Hot wallets
Cold storage, or offline wallets


Hosted Wallets

Hosted wallets, such as exchange wallets, do not give you direct access to your keys.  If the service is down, compromised, or shuts down permanently, you can no longer access your coins.  Do not use a hosted wallet unless you are using another service offered by that company, such as trading.  Ensure you withdraw your funds to a more secure wallet when you complete your exchange business.

Local hot wallets

Hot wallets, in general, refer to wallets where the keys are stored on an Internet-connected computer.  They are designed to quickly process outgoing transactions.   Many services offer a hybrid hosted-hot-wallet, such as btc.com and blockchain.info.  The provider of a hosted-hot-wallet will provide you seed words or private keys which can be used to recover your coins if the service goes down.  Hosted-hot-wallet services also offer ways to easily access your wallet, such as a regular email/username/password account system, mobile apps, 2FA, etc.

Hosted Hot wallets come with several risks.   You must trust that:


the initial key generation is not backdoored.
they are not storing unencrypted copies of your keys.
they will not steal your funds when you are using their web interface/mobile apps, which would naturally need access to your keys to make any transactions. 


You are also vulnerable to phishing attacks for the account credentials, domain takeovers, and hacks of their systems, which may be compromised and made to serve malicious versions of their apps that would steal your keys or otherwise drain your accounts.

Many people use these services for their ease-of-use, and a number of (so far) reliable ones exist.  Always be careful when using such a service, and follow basic security measures such as ensuring you use strong passwords, enable 2FA, confirm the website address is correct, use a trusted computer to access the service, etc.

Some hot wallets, such as Bitcoin-qt, Electrum, etc., allow you to run them locally on your own computer. These wallets generate and store keys on your computer, and will typically only require a password to unlock the wallet. They do not rely on centralized servers, and instead may either connect directly to the bitcoin P2P network (or the network of your altcoin), or to second layer P2P networks such as Electrum servers.   While generally more secure than a host hot wallet, these have risks such as :


your computer being compromised and the keys stolen
downloading a malicious version of the wallet client that gives you non-random keys, or steals keys after generating or importing them. 


To avoid such attacks, you should only use a trusted computer, and verify the signature and hashes of the wallet client software after downloading it.

Cold storage

Cold storage refers to the most secure type of wallet where the keys are not stored on an Internet-connected computer.  There are essentially two types of cost storage wallet; paper, and hardware.

Paper wallets usually just consist of a private key and public address printed out or otherwise stored on a physical medium that is not connected to a computer or the internet. Creating the private key and public address, in an ideal scenario, would use a peer-reviewed, vetted bitcoin address generator on an air-gapped, recently formatted, trusted computer with a cryptographic-quality random number generator. These requirements are occasionally difficult to meet, but are doable by most people given enough effort. Once generated, coins can be transferred to the address, and the private key can be stored on a piece of paper or a flash drive, or inscribed in a metal sheet, and then stored somewhere physically safe, such as a bank vault, home safe, or even split up into pieces and stored in multiple locations.

These wallets are typically extremely safe, since if generated correctly, they are impossible to compromise without physically compromising the location where the private key is stored. However, they are cumbersome to use, as the key must be physically retrieved and imported into a software wallet before a transaction can be signed.  The signing itself can be done on an offline computer to minimize risk, with the signed transaction verified and broadcast by a separate, online computer.

Offline wallets are typically used to store coins for a long time, without the intention of regularly spending them.  Coins can be sent to the paper wallet at any time without retrieving or using the private key.

Hardware wallets, such as the Ledger and Trezor, are newer takes on cold storage. These are essentially tiny computers than generate and store the private keys, and sign transactions on the device itself. You use them by connecting them to a computer, which then passes an unsigned transaction to the device. The device will then display the amount and destination, and attach the signature after you confirm the details are correct. The signed transaction is then sent back to the computer, and the private keys never leave the device.

The attack vectors here are limited to:


a device flaw
stealing the device + pin
stealing the seed words for the device (make sure you keep these very safe)
tricking someone into signing a transaction without verifying the outputs. 


The wallet devices themselves are currently considered quite safe (although an attack was recently demonstrated and patched by Ledger).  Provided you choose a strong PIN and store the seed words safely, hardware wallets are the safest, most user-friendly way to store cryptocurrencies, offering a large advantage over hot wallets and exchanges, and even paper wallets in terms of ease of use.  However, hardware wallets currently do not support all cryptocurrencies, and one may have to resort to paperwallets + hardware wallets to cover their entire portfolio.

General Advice

This advice applies no matter what wallet you opt for, and extends to general computer security as well


Use a trusted computer - Make sure you don't install any untrusted programs that may contain keyloggers or other malware.  If paranoid, get a separate computer for crypto use, and format it regularly.
Verify the hashes and signatures of any clients you download.  All trustworthy crypto software comes with known-good hashes published on the website along with the download links, and often with signatures from trusted developers/community members.  Verifying these hashes and signatures helps ensure the program you downloaded was not been tampered with.
Check where you are downloading a program from - Make sure it is the official site, as many phishing clones exist. Check the domain for character swaps (l instead of i, etc.), check the extension, make sure it uses https, and use a computer you trust.
Use strong, random passwords/PINs for wallets and accounts - Get a password manager, no other way to say it really.
Enable 2FA everywhere you can.  Ideally, use time-based 2FA where available, instead of SMS-based ones, and use a device you trust for saving the 2FA codes.
Always verify the transaction address and amount before sending.  Malware exists that will silently change a crypto address after you copy it, and before you paste it into the wallet.  Verify the address before sending.  Many wallets, such as hardware wallets, Bitcoin-qt, Electrum etc. offer a preview function before signing or broadcasting the transaction. Use this feature to ensure the address and amount matches what you entered.
99.999999% of the time, anything that offers you free BTC, offers to mine BTC for you, offers to double your coins, etc. is a scam - Don't fall for it.
Make backups of your seed words/wallet files and verify them.  Computers or hardware wallets can break, and having a backup is essential.  Hierarchical Deterministic wallets, aka HD Wallets, allow you create a long-lived backup that can restore addresses and keys generated after the backup was taken.  Non-HD Wallets, such as bitcoin-qt in non-HD mode, must be backed up every time you generate a new address.  If you restore an old backup from a non-hd wallet, you will lose the value of cryptocurrencies received after the backup was created.