Protecting crypto requires five defenses: secure your identity, choose custody deliberately, verify every signature, monitor exposure, and prepare a recovery plan. A hardware wallet alone cannot stop phishing, malicious approvals, compromised email accounts, or a transaction you authorize by mistake.
Start with the ways crypto is actually lost#
Crypto security is not one setting. An exchange account can be taken over through email recovery; a self-custody wallet can be drained after a seed phrase leak; a legitimate wallet can sign a malicious approval; and a correct transaction can still go to the wrong network or address. Each failure needs a different control.
| Layer | Typical failure | First control |
|---|---|---|
| Identity | Email or exchange takeover | Unique password and phishing-resistant MFA |
| Custody | Lost key or failed custodian | Separate operational and long-term holdings |
| Device | Malware or hostile extension | Updated, minimal signing environment |
| Transaction | Wrong address or dangerous permission | Verify network, destination, amount and authority |
| Recovery | Panic after an incident | Written response procedure |
Map every place that can authorize movement: exchange logins, recovery email, phone number, seed phrases, private keys, hardware wallets, browser extensions, API keys and smart-contract allowances. The result is a threat model you can act on rather than a generic list of tips.
Match custody to the job#
There is no defensible universal rule such as keeping a fixed percentage offline. Allocation depends on how soon the assets will be used, which networks are involved, your ability to maintain backups, and how much exposure you can accept in one failure domain.
- Exchange account: useful for assets needed for near-term trading, but dependent on account security and the custodian’s operations.
- Hot wallet: convenient for routine onchain activity, but exposed to browsers, extensions, phishing and signing mistakes.
- Hardware wallet: isolates keys from ordinary browsing, but still relies on a correct backup and honest transaction verification.
- Interaction wallet: a low-balance wallet for unfamiliar applications limits the damage from a bad approval or signature.
The SEC’s custody guidance stresses that self-custody transfers key-management responsibility to the owner, while third-party custody introduces questions about control, failure, commingling, insurance and recovery. Treat those as different risks, not as a simple “safe versus unsafe” choice.
Secure the identity layer before buying another wallet#
Your recovery email may be more important than the exchange password. If an attacker controls it, they may reset credentials, approve devices, hide alerts or manipulate support conversations.
Use a password manager to generate a unique password for every financial account. Protect the primary email with the strongest MFA it supports. Prefer a FIDO security key or passkey; CISA and NIST describe FIDO/WebAuthn methods as phishing-resistant, while SMS codes can be intercepted or redirected and one-time app codes can still be entered into a fake site.
Store recovery codes offline, remove obsolete phones and devices, add a carrier PIN where available, and review active sessions. Enabling an authenticator app does not help if SMS remains as an unprotected fallback.
Keep seed phrases outside the online attack surface#
A seed phrase is a master recovery secret. Anyone who obtains it can rebuild the wallet without your normal device, PIN or biometric lock.
Do not place it in cloud notes, email, screenshots, chat messages, support forms or unencrypted documents. Record the words privately, preserve their exact order and use the wallet vendor’s documented backup process. Protect the backup from unauthorized viewing, theft, fire, water and accidental disposal.
A hardware wallet improves isolation only when you verify the real address and transaction on its trusted display. Malware can alter what appears on a computer screen. If a seed phrase is exposed, changing a local wallet password is not a remedy: create a wallet from a new phrase in a trusted environment, move remaining assets and retire every account derived from the old phrase.
Read authority, not just the button label#
Before signing, confirm five fields:
- Asset: verify the contract or asset identity, not only the ticker.
- Network: ensure sender and recipient use the same supported network.
- Destination: compare the complete address against a trusted source.
- Amount: review quantity, decimals and network cost.
- Authority: determine whether the request transfers assets, approves spending, changes ownership or merely proves control.
Use a small test transfer for a new route, but verify the full address again for the main transfer. Do not copy a destination only from transaction history; address-poisoning transactions can insert a look-alike address.
Control smart-contract approvals#
Connecting a wallet usually exposes a public address. Signing creates authority. The useful question is therefore not only “Is this website real?” but “What can this contract do after I leave?”
Use a separate interaction wallet, approve only the amount required where the interface permits, and revoke stale allowances through a trusted block explorer or established approval checker. Disconnecting a site does not revoke an onchain allowance. Revocation also cannot undo a completed transfer or repair a compromised seed phrase.
Harden exchange accounts without assuming away custody risk#
Where supported, enable phishing-resistant MFA, withdrawal allowlists, login alerts, security-change delays and anti-phishing codes. Restrict API keys by permission and IP, and disable withdrawal permission on trading-only keys. Review devices and sessions regularly.
Navigate through a saved bookmark rather than a message or advertisement. A real support employee should not need your password, MFA code, seed phrase or remote-control access. Before choosing a custodian, read which legal entity serves you, what happens during withdrawal suspension, how assets may be held, and what any insurance claim actually covers.
Use an incident plan instead of improvising#
| Incident | Immediate response |
|---|---|
| Exchange account takeover | Secure email, lock the account, change credentials, revoke sessions and API keys, then contact official support |
| Seed phrase exposed | Create a new wallet with a new phrase and migrate remaining assets |
| Malicious token approval | Revoke the allowance, inspect transactions and move assets if the signer may be compromised |
| Suspected malware | Stop signing, isolate the device and secure accounts from a clean system |
| Scam payment sent | Notify relevant platforms, preserve evidence and report through official channels |
Preserve wallet addresses, transaction hashes, asset types, amounts, dates, messages, URLs and case numbers. The FBI’s IC3 asks victims to include transaction details and warns that paid “recovery agents” may be a second scam.
Maintain security every month#
Each month, review login history, wallet activity, token approvals, browser extensions, device updates and API keys. Each quarter, reassess how much value is exposed to every exchange, wallet, seed phrase and device. Test alerts, verify offline recovery materials and update the written incident plan.
Do not test a backup by entering it into an unfamiliar website or ordinary computer. Follow the manufacturer’s documented verification or recovery procedure.
Frequently asked questions#
How much crypto should stay on an exchange?
There is no universal percentage. Keep only what the exchange’s intended function requires and what you can tolerate being inaccessible within that custody domain.
Is a hardware wallet completely safe?
No. It reduces key exposure but cannot stop seed disclosure, malicious signatures, wrong-address transfers or destruction of every backup.
Can 2FA protect a self-custody wallet?
It can protect email and custodial accounts, but possession of a seed phrase or private key normally bypasses those services entirely.
What should I do after a suspicious signature?
Identify the permission granted, revoke relevant allowances, inspect recent activity and move remaining assets if the signing environment or seed may be compromised.
Sources#
- SEC Investor Bulletin: Crypto Asset Custody Basics
- CISA Mobile Communications Best Practice Guidance
- Ethereum.org: Security and Scam Prevention
- FBI IC3 Guidance for Cryptocurrency Scam Victims
Risk notice: This guide provides security education, not legal, investment or recovery advice. Blockchain transactions may be irreversible, and controls vary by wallet, network, platform and jurisdiction.
Editorial standard
This guide is educational and source-led. Security controls, exchange rules and legal requirements can change; verify critical steps through the relevant official service before acting.
