Crypto transactions cannot be reversed, and there is no bank to call when something goes wrong. Billions of dollars are lost every year to hacks, scams and simple mistakes. A large share of individual losses come from a short list of causes: leaked seed phrases, phishing, malicious token approvals and weak account security. The habits below address each of them.
Understand What You Are Protecting
A crypto wallet does not store coins. It stores private keys, and whoever holds the keys controls the funds. Most wallets generate keys from a seed phrase of 12 or 24 words. Anyone who sees that phrase can rebuild the wallet on their own device and empty it.
Protect Your Seed Phrase
- Write the phrase on paper or stamp it into metal. Keep it offline.
- Never photograph it, type it into a notes app, email it or store it in cloud storage.
- Never enter it into a website. A real wallet asks for the phrase only when you restore it inside the wallet app or device itself.
- Keep a second copy in a separate location to protect against fire, flood or theft.
- No support agent, exchange or wallet company will ever need your seed phrase. Anyone who asks for it is attempting theft.
Use a Hardware Wallet for Larger Amounts
A hardware wallet keeps private keys on a dedicated device that never exposes them to your computer or phone. Transactions are approved on the device's own screen. Malware on your computer cannot sign for you. Bitcoin.org's guide to securing your wallet covers offline storage and backups.
- Buy directly from the manufacturer, not from a marketplace reseller.
- Set the device up yourself. A device that arrives with a seed phrase already filled in is compromised.
- Read what the device screen shows before approving. The screen is the part you can trust.
- Test recovery from your backup before you deposit a large amount.
A hardware wallet does not stop you from approving a malicious transaction. It only guarantees that nothing is signed without your physical confirmation.
Lock Down Exchange and Email Accounts
- Use a unique, long password for each account, stored in a password manager.
- Turn on two-factor authentication with an authenticator app or a hardware security key.
- Avoid SMS codes where you can. In a SIM swap, an attacker convinces a phone carrier to move your number to their SIM and then receives your codes.
- Secure your email with the same care. Password resets go through email, so it is the key to everything else.
- Turn on withdrawal address allowlists and anti-phishing codes if the exchange offers them.
Recognize Phishing and Impersonation
Most thefts from individuals start with a message. The ethereum.org security and scam prevention guide lists the common patterns.
- Fake websites: copies of exchanges, wallets and DeFi apps, often promoted through search ads. Use bookmarks for sites you rely on.
- Fake support: people who reply to your public question and offer help by direct message.
- Fake apps and extensions: wallet look-alikes in app stores and browser extension stores.
- Airdrop bait: unknown tokens or NFTs that appear in your wallet with a link to "claim" something.
- Address poisoning: an attacker sends a tiny transaction from an address that looks like one you use, hoping you copy it from your history later. Always check the full address.
Manage Token Approvals and Signatures
On Ethereum and similar chains, using a DeFi app usually means granting it permission to move a token on your behalf. Many apps request an unlimited allowance. If that contract is malicious or is later exploited, it can take the full balance of that token.
- Approve only the amount you need when the wallet lets you edit it.
- Review and revoke old approvals from time to time with an approval checker.
- Read signature requests. A signature that costs no gas can still authorize a transfer.
- If a site you do not know asks you to sign something to "verify" your wallet, close it.
Separate Wallets by Purpose
- Vault wallet: a hardware wallet for long-term holdings that never connects to new apps.
- Daily wallet: a smaller balance for DeFi, NFT mints and testing new protocols.
If a daily wallet is drained, the vault is untouched.
Secure Your Devices
- Keep your operating system, browser and wallet software up to date.
- Do not install pirated software or unknown browser extensions on a device you use for crypto.
- Be careful with clipboard contents. Some malware replaces a copied address with the attacker's address.
- Avoid discussing your holdings in public. Physical threats against known holders do happen.
Be Skeptical of Offers
Guaranteed returns, pressure to act quickly and requests to move funds to a "safe" wallet are standard signs of fraud. So are relationships that start online and turn into investment advice. The US SEC's investor education site has a crypto assets section with alerts on common schemes. Be especially wary of recovery services that contact you after a loss. Many of them are a second scam.
If Something Goes Wrong
- Move remaining funds to a new wallet with a new seed phrase. A leaked phrase cannot be made safe again.
- Revoke approvals from the affected address.
- Change passwords and two-factor settings, starting with email.
- Report the theft to the exchange involved and to the authorities in your country.
Nothing in this article is financial advice.
Track on CoinMarketGuy
Use the exchanges page to look up an exchange before you open an account, and the coin pages, such as the Bitcoin price page, to check a price independently when an offer quotes one that looks too good.