Crypto security is the set of practices that protect your funds, accounts, and private keys from theft, loss, and fraud. Unlike a bank, there is no customer service line to call if someone drains your wallet — transactions are irreversible and no central authority can undo them. Getting security right is therefore one of the most practical skills you can build as a crypto user.
This guide works through the major threat categories and gives you concrete steps for each one.
Protect your seed phrase above everything else
Your seed phrase is a sequence of 12 or 24 ordinary words that encodes the master key to your wallet. Anyone who obtains those words controls your funds, permanently and irrevocably. Everything else in this guide matters less.
Write it on paper, not in a file
The moment you create a new wallet, the software shows your seed phrase once. Write it on paper with a pen. Do not take a screenshot. Do not paste it into a notes app, a cloud document, or a password manager. Any file that touches a networked device is a file that can be exfiltrated.
Store it somewhere physically secure
Paper burns and floods. Consider storing your seed phrase on a stamped metal plate (inexpensive kits are widely available) and keeping it in a fireproof location — a home safe, a safety deposit box, or split between two trusted locations. The right answer depends on how much value you are protecting and how much redundancy you need.
Never share it with anyone
Legitimate wallet software, exchanges, and support staff will never ask for your seed phrase. Any request for those words, regardless of how official it looks, is an attack. This bears repeating because it is the single most common vector by which people lose funds.
Secure your exchange accounts
Most beginners start by buying crypto on a centralized exchange. These accounts are worth hardening carefully.
Use a strong, unique password
Use a password manager (Bitwarden, 1Password, and similar tools are widely trusted) to generate and store a long, random password for every exchange account. Never reuse passwords. A breach at one site should not cascade to your crypto accounts.
Enable the strongest two-factor authentication available
Two-factor authentication (2FA) adds a second proof of identity beyond your password. Not all 2FA is equal:
| 2FA Method | Strength | Notes |
|---|---|---|
| SMS text message | Weak | Vulnerable to SIM-swap attacks |
| Email code | Weak | Depends on your email security |
| Authenticator app (TOTP) | Strong | Free; use Google Authenticator or Aegis |
| Hardware security key (FIDO2) | Strongest | Physical device; very resistant to phishing |
If your exchange supports a hardware key (YubiKey and similar), use it. If not, an authenticator app is far better than SMS. Disable SMS-based 2FA if a stronger option is available.
Watch for SIM-swap attacks
A SIM swap occurs when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. This lets them receive any SMS codes sent to your number. Contact your carrier to add a PIN or passphrase to your account, and eliminate SMS 2FA wherever possible.
Secure your devices
Your security is only as strong as the device you use to access your wallets and accounts.
- Keep your operating system and apps updated. Security patches close known vulnerabilities.
- Use a reputable antivirus or endpoint protection tool on desktop machines.
- Avoid accessing wallets or exchanges on public Wi-Fi. If you must, use a trusted VPN.
- Be cautious with browser extensions. A malicious extension can read everything on a page, including wallet data. Install only well-reviewed extensions from official sources, and consider keeping a separate browser profile purely for crypto activity.
- Lock your devices with a strong PIN or passphrase. Enable full-disk encryption (on by default on modern phones; available via BitLocker or FileVault on desktop).
Use hardware wallets for significant holdings
A hardware wallet is a small physical device that stores your private keys offline. When you sign a transaction, the signing happens inside the device — your private key never touches your internet-connected computer. Even if your computer is fully compromised by malware, a hardware wallet keeps your keys safe.
Hardware wallets are not foolproof — supply-chain attacks, firmware vulnerabilities, and physical theft are real risks — but they raise the cost of attack dramatically compared to software wallets.
If you hold an amount of crypto that would cause you real financial pain to lose, a hardware wallet is worth the modest cost. Treat it like a vault rather than a daily spending wallet.
When you set up a hardware wallet, you will still receive a seed phrase. The physical device protects against remote attacks, but the seed phrase backup protects against the device being lost or broken. Secure both.
Recognize and avoid common attacks
Understanding how common scams work is a defense in itself.
Phishing
Attackers build fake websites that look identical to real exchanges and wallets, then drive traffic to them via search ads, social media links, and email. Before entering any credentials or connecting a wallet, confirm the URL is exactly correct. Bookmark legitimate sites and navigate from the bookmark rather than searching each time.
Fake support
Discord servers, Telegram groups, and Reddit threads for crypto projects are full of fake “support agents” who reach out to users experiencing problems. They will eventually ask for your seed phrase or ask you to approve a transaction. Real support teams do not contact users through DMs.
Malicious smart contract approvals
When you interact with decentralized exchanges and other DeFi protocols, your wallet will ask you to approve transactions. Some approvals grant a contract unlimited permission to move your tokens. Use a tool like Revoke.cash periodically to audit and revoke approvals you no longer need.
Address poisoning
An attacker sends a tiny transaction from an address that looks nearly identical to one you have used before, hoping you will copy it from your transaction history. Always verify the full address — not just the first and last few characters — before sending funds.
Back up more than just your seed phrase
Document which wallets and exchanges you use, the email addresses associated with each account, and where physical backups are stored. Keep this information somewhere a trusted person could access in an emergency. A wallet that cannot be recovered after your death or incapacitation is effectively lost.
Key takeaways
- Your seed phrase is the master key to everything. Write it on paper, store it physically, and never share it with anyone.
- Use an authenticator app or hardware security key for 2FA; disable SMS-based 2FA where possible.
- Keep devices updated and be selective about browser extensions.
- For holdings you cannot afford to lose, a hardware wallet is a worthwhile investment.
- Verify URLs before logging in; treat any unsolicited DM from “support” as an attack.
- Review smart contract approvals regularly and revoke any that are no longer needed.
Next up: Self-Custody and Your Keys