More crypto has been lost to poor security practices than to market crashes. Billions of dollars in Bitcoin sitting in wallets whose owners forgot passwords. Millions stolen through phishing attacks that any informed user would have recognized instantly. Hardware wallets whose seed phrases were photographed and uploaded to the cloud.
Security in crypto is non-negotiable. This guide covers everything you need to know to protect your holdings — from your first purchase to managing significant wealth.
The Fundamental Rule
Not your keys, not your coins.
If you don't control the private key to a wallet, you don't truly own the crypto in it. You own a promise from the exchange or custodian that they'll give it to you when you ask. Exchanges fail, get hacked, freeze withdrawals, or go bankrupt. FTX had $8 billion in user funds when it collapsed in 2022. Users got nothing.
For any amount you can't afford to lose, keep it in a wallet you control.
Wallet Security by Type
Exchange Wallets — Acceptable for Trading, Not for Storage
Keep on exchanges only:
- Funds you're actively trading
- Amounts you'd be okay losing if the exchange fails
- Short-term holdings you're planning to move soon
Never keep on exchanges:
- Long-term holdings
- Amounts that would significantly impact your life if lost
- Your entire crypto portfolio
Enable every security feature the exchange offers: 2FA (Google Authenticator, not SMS), withdrawal whitelist (only your known addresses can receive withdrawals), login notifications.
Software Wallets — Better, But Not Bulletproof
Phantom, MetaMask, Trust Wallet, Backpack — these give you control of your keys while keeping them accessible on your device.
Securing a software wallet:
- Use a strong, unique password
- Enable biometric authentication where available
- Never install wallet extensions on a browser you use for general browsing — use a dedicated browser profile or separate browser
- Never import your seed phrase on a device that has ever been compromised
The main attack vector: Malicious browser extensions and websites that prompt you to "connect your wallet" and then request excessive permissions or trick you into signing transactions that drain your wallet.
Rule: Carefully read every transaction you sign. If a website asks for permissions beyond what makes sense for what you're doing, reject it.
Hardware Wallets — The Gold Standard
A hardware wallet stores your private key on a physical device that never connects to the internet. Even if your computer is fully compromised with malware, the attacker cannot extract the key from the hardware wallet.
Ledger — Most popular hardware wallet. Supports 5,500+ coins. The Ledger Nano X (Bluetooth) and Nano S Plus are the most common models. Note: Ledger's seed phrase backup is stored locally on the device — their 2023 recovery service controversy is worth reading about.
Trezor — Fully open-source firmware (anyone can audit the code). No closed-source secure element — the security model is based entirely on open, auditable code. More transparent, slightly less convenient.
Both are excellent. Ledger has more coin support and a slicker experience. Trezor is preferred by those who prioritize full auditability.
Hardware wallet best practices:
- Buy only from the official manufacturer website — never from Amazon or secondary markets (devices can be tampered with in transit)
- Set up the device yourself — if it arrives with a seed phrase pre-written, it's compromised
- Use the hardware wallet for every significant transaction, even if it takes longer
Seed Phrase Security — The Most Critical Topic
Your seed phrase (12 or 24 words) is the master key to your entire wallet. Anyone who has these words can access your crypto from any device, anywhere in the world.
How to Store Your Seed Phrase
Do:
- Write it on paper with a ballpoint pen (pencil fades)
- Store it in a fireproof safe, safety deposit box, or multiple secure physical locations
- Consider a metal backup device (Cryptosteel, Bilodal, or similar) — paper burns, metal doesn't
- Store at least two copies in different physical locations (house fire protection)
Do not:
- Photograph it
- Store it in cloud notes (iCloud, Google Drive, Evernote, OneNote)
- Email it to yourself
- Store it in password managers (if the password manager is compromised, so is your seed phrase)
- Screenshot it
- Type it into any website, ever (legitimate wallets will never ask for your seed phrase online)
The Passphrase (25th Word)
Most hardware wallets support an additional passphrase — a custom word or phrase you add to your seed phrase. Even if someone finds your 24-word seed phrase, they can't access your wallet without the passphrase.
This is advanced security for large holdings. Store the passphrase separately from your seed phrase and make sure trusted family members can access it if needed.
Exchange Security
Even for trading funds you keep on exchanges, use maximum security:
2-Factor Authentication
Use Google Authenticator or Authy (app-based 2FA) — never SMS-based 2FA. SIM swapping attacks can intercept SMS codes; an attacker calls your carrier, convinces them to transfer your number, and then receives your 2FA codes.
Download Authy and enable multi-device backup so you don't lose access if your phone dies.
Withdrawal Whitelisting
Most major exchanges let you whitelist withdrawal addresses — only addresses on this list can receive withdrawals from your account. Enable this immediately after creating your accounts. Even if an attacker gains access to your account, they cannot withdraw to an address they don't control.
Strong, Unique Passwords
Use a password manager (Bitwarden is free, 1Password is excellent). Generate 20+ character random passwords for every exchange. Never reuse passwords.
Login Notifications
Enable email or SMS notifications for every login. If someone accesses your account, you'll know immediately.
Phishing — The #1 Attack Vector
Phishing attacks impersonate legitimate services to steal your credentials or seed phrase. They're increasingly sophisticated and have stolen hundreds of millions of dollars from crypto users.
How Phishing Works
- You receive an email that looks exactly like it's from Coinbase, Binance, or MetaMask
- The email says your account is suspended, there's suspicious activity, or you need to verify
- It links to a fake website that looks identical to the real one
- You log in — and hand your credentials directly to the attacker
How to Avoid Phishing
Always check the URL: Phishers use domains like coinbase-security.com, metamask-wallet.io, or bynance.com. The real URL matters more than the visual design.
Bookmark legitimate sites: Access exchanges only through bookmarks you created by visiting the real site yourself — never through links in emails.
Never enter your seed phrase online: No legitimate service will ever ask for your seed phrase. Ever. Not MetaMask, not Coinbase, not hardware wallet support. If anyone asks for it online, it's a scam.
Check sender emails carefully: [email protected] is not Coinbase. Look at the actual sending domain, not just the display name.
Browser extensions: Malicious extensions can read everything in your browser including passwords and private keys. Use a minimal set of extensions and audit them regularly.
Smart Contract Security
As you move into DeFi, you interact with smart contracts — code that controls your funds.
Before connecting your wallet to any protocol:
- Verify the URL is the official protocol URL
- Check if the contract has been audited (look for audit reports on their site)
- Never interact with contracts linked from Discord DMs or unsolicited Twitter messages
- Use a separate "hot" wallet for DeFi with only the funds you're willing to lose — keep your main holdings in cold storage
Revoke permissions regularly: Use revoke.cash to see all smart contract approvals connected to your wallet and revoke ones you no longer use. An old approval to a compromised protocol can drain your wallet even years later.
What to Do If You've Been Hacked
If you suspect your wallet or exchange account is compromised:
Exchange account compromised:
- Immediately change your password and 2FA
- Contact exchange support to freeze the account
- Remove all API keys
- Check for unauthorized withdrawal requests pending
Software wallet compromised:
- If funds are still there, create a new wallet immediately (new device if possible)
- Transfer all funds to the new wallet as fast as possible
- The compromised wallet and seed phrase are permanently compromised — never use them again
Hardware wallet seed phrase exposed:
- Same as above — create a new wallet, transfer everything immediately
- The speed of your response matters. If you believe exposure just happened, act within minutes.
Security is not optional. The decentralized nature of crypto means there's no customer support line to call and no fraud department to reverse transactions. You are your own bank, which means you have to be your own security team.
Ten minutes setting this up correctly today will protect everything you build in this space.
Recommended hardware wallets:
Related reading: