The direct answer
Most crypto losses are not sophisticated hacks. They are a small set of avoidable failures: a seed phrase stored in a photo, a token approval granted to a malicious contract, a fake exchange domain, a password reused from a breached site, or a “support agent” who asked for remote access.
Securing crypto means closing those five doors before optimizing anything else. Do the items in the first section today; they prevent the majority of losses. Everything after that is refinement.
Tier 1: Do these today (90 minutes)
1. Generate a fresh wallet and move meaningful balances to hardware
A hardware wallet keeps the private key offline and requires physical confirmation for each transaction. For any balance you would be upset to lose, a hardware wallet is the baseline, not a luxury. Buy directly from the manufacturer, never from a marketplace, and verify the packaging and the device’s initial setup.
2. Write your seed phrase on paper or metal — never a photo
A photograph of your seed phrase lives in your camera roll and your cloud backup. That is a single compromised account away from total loss. Write the phrase by hand, verify it twice, and store it offline. For substantial holdings, use a metal backup that survives fire and water.
3. Split storage physically, not digitally
Store the seed phrase in two locations, both physically secure — a safe and a safe deposit box, or a safe and a trusted relative’s home. Do not store half digitally and half on paper; that adds a digital exposure without adding real redundancy.
4. Turn on app-based 2FA, then remove SMS
Exchange accounts should use a TOTP authenticator app or a hardware security key. SMS codes are vulnerable to SIM-swap attacks. After enabling app-based 2FA, remove your phone number as a recovery method where the platform allows it, and save the backup codes offline.
5. Use a unique email and a password manager
Crypto email should be its own address, not the one you use for shopping and newsletters. Generate a unique, long password for every exchange and wallet, stored in a password manager. The password manager becomes a high-value target, so protect it with a strong master password and its own 2FA.
6. Revoke old token approvals
Every “approve” you have ever signed may still be live. A malicious contract can drain an approved token at any time. Use your wallet’s built-in approval manager or a reputable approval-revocation tool on the correct chain, and revoke everything you do not actively use. Repeat quarterly.
7. Bookmark the real sites
Phishing is the most common crypto attack, and it usually starts with a search ad or a lookalike domain. Save the official URL to your browser, and never log in through a link in an email, a DM, or a search result.
Tier 2: Within the first week
Add a transaction-verification habit. Before signing anything, read the wallet prompt. Check the recipient address against a known copy, the amount, the network, and the contract you are interacting with. Malicious signatures often look like ordinary swaps or “mint” actions.
Use a dedicated browser profile or a dedicated device for crypto. Fewer extensions and fewer sessions mean fewer attack surfaces. Never install browser extensions you have not verified; wallet-draining extensions exist and look legitimate.
Separate hot and cold funds. A hot wallet holds spending money; the hardware wallet holds savings. Never connect the savings wallet to a random dApp. If you must interact with a new protocol, use a throwaway wallet funded with only what you can afford to lose.
Enable withdrawal allowlists. Most major exchanges offer address whitelisting, sometimes with a delay after any change. This blocks an attacker who has taken over your account from sending funds to a new address.
Review account security settings. Confirm your recovery email, phone number, registered devices, API keys, and active sessions. Delete old API keys, and restrict new ones to IP addresses and to reading only, unless trading requires otherwise.
Set up alerts. Enable login and withdrawal notifications, and consider a monitoring service that warns about sanctioned-address exposure or unusual outflows.
Tier 3: Ongoing hygiene
- Update devices and firmware. Wallet firmware updates often contain security fixes. Verify the update is offered by the official app.
- Audit your approvals and connected sites monthly. Disconnect dApps you no longer use.
- Test your backups annually. Restore your seed phrase on a spare device, confirm the wallet loads, then wipe the device. A backup you have never tested is a guess.
- Keep a recovery plan. Write down what someone would need to do if you were incapacitated: where the device is, where the backup is, who the executor is. Do not put the seed phrase in the will itself; use a sealed instruction letter and a lawyer-held location.
- Verify counterparties. Before sending funds to a new exchange or a “friend” from a chat group, verify independently. Impersonation is rampant in Telegram and Discord.
- Watch for address poisoning. Attackers send tiny transactions from addresses that look like yours, hoping you copy one from your history. Always verify the full address, not just the first and last characters.
The five mistakes behind most losses
| Mistake | What happens | Fix |
|---|---|---|
| Seed phrase in a photo or cloud note | Attacker gains full control | Handwritten or metal backup, offline |
| Reused password | Credential stuffing leads to account takeover | Unique passwords plus a manager |
| Blind signing | Malicious contract drains the wallet | Read prompts; use a burner for new dApps |
| SMS 2FA | SIM swap defeats the second factor | Authenticator app or hardware key |
| Fake site or support | Phishing or remote-access theft | Bookmarks; no remote access, ever |
Common attack patterns to recognize
Pig butchering. A long, friendly relationship on a chat app leads to a fake investment platform. Early withdrawals work to build trust; the final deposit never comes back.
Fake exchange support. Someone contacts you claiming to be support and offers to “validate” or “sync” your wallet, usually asking you to share your screen or enter your seed phrase on a site.
Airdrop and mint scams. Free tokens require you to sign an approval that drains your wallet. Never sign for a token you did not expect and cannot verify.
Address poisoning and clipboard hijackers. Malware swaps the address in your clipboard, or attackers plant lookalike addresses in your transaction history.
Romance and job scams. A “remote job” or “trading mentor” asks you to deposit funds to unlock earnings. There is no job and no earnings.
Physical and social attacks. Home invasion and “wrench attacks” target known holders. Keep holdings private, avoid publicizing balances, and use a decoy wallet when pressed.
A simple security scorecard
Score yourself one point per item:
- Hardware wallet for savings
- Seed phrase offline, in two locations, tested
- App-based 2FA on every exchange
- Unique email for crypto accounts
- Password manager in use
- Approvals revoked in the last 90 days
- Official sites bookmarked
- Hardware wallet never connected to unknown dApps
- Withdrawal allowlist enabled
- Recovery plan documented with an executor
Ten out of ten is achievable in a weekend. Eight is a reasonable baseline. Below six, fix it this week.
FAQ
What is the safest way to store crypto?
A hardware wallet with an offline seed phrase backup, plus app-based 2FA and withdrawal allowlists on the exchanges you still use.
Is a crypto wallet safer than an exchange?
Self-custody removes counterparty risk but puts the security burden on you. Exchanges are easier to use but introduce insolvency and hack risk. Most experienced users split holdings.
Can my crypto be hacked if it’s offline?
Not remotely. An offline key can still be lost in a fire or stolen physically, which is why physical backup redundancy matters.
How often should I revoke approvals?
Quarterly, and immediately after using a new dApp you do not fully trust.
Is 2FA enough to protect an exchange account?
App-based 2FA plus a strong unique password plus a withdrawal allowlist is a strong baseline. SMS 2FA alone is not.
What should I do if I think my wallet is compromised?
Move remaining assets to a new wallet immediately, revoke approvals, then follow the stolen-funds reporting process.
Disclaimer: This article is general security information. Tailor controls to your threat model and consult a professional for high-value holdings.