If you want to keep your crypto safe, start by getting these basics right. Save this for later.
1) Hardware
- Buy only from the official website or an authorized retailer. Avoid unofficial resellers and shady shortcuts.
- If you open it and find words already written on the seed card, it’s a scam. Discard the whole thing and don’t use it.
- If possible, have it delivered to a pickup point instead of giving out your home address.
- Update firmware only through the official app.
2) Recovery phrases
- If you can, engrave your recovery phrase on a metal plate. Don’t just write it on paper; don’t photograph it, save it to cloud storage, or put it in your notes app.
- Enter your recovery phrase only through the official recovery process for your hardware wallet. Never enter it on a website or in a software wallet.
- Don’t split up your seed yourself. It’s unreliable and easy to mess up. If you really need to split it, use the officially supported Shamir backup, or use multisig.
- Test your backup as soon as you’ve written it down: use the built-in check, or follow the official process to wipe and restore your device. If you haven’t tested it, you don’t have a backup.
- Make two copies and store them in separate places. If your house catches fire and you lose your backup, you lose your assets too.
3) How to divide up your accounts
- Keep large amounts in a cold wallet that never interacts with DApps.
- Use a separate hot wallet for everyday use. Use a separate, small wallet to try new projects, and stop using it afterward.
- Consider adding a passphrase once your holdings get large: the same seed without a passphrase reveals only a small portion of your assets; with the passphrase, you can access your main holdings.
- Back up your passphrase too, and don’t store it in the same place as your recovery phrase. If you lose the passphrase, you can’t recover your crypto.
- If you hold a large amount, use multisig. Don’t put all your assets at risk in one place.
4) Signing (where most people get caught out)
- When checking a transaction, trust what’s displayed on your hardware wallet’s screen—not just what you see on your computer. In the Bybit incident, the web interface had been tampered with, resulting in losses of about $1.5 billion.
- If you don’t understand it, don’t sign it.
- “Gas-free” approvals can still let someone transfer your crypto.
- One malicious EIP-7702 authorization can hand over control of your entire account.
- On Solana, signing the wrong transaction could also change the permissions on your token account. Before signing, use a transaction simulator to see exactly what the transaction will do.
- Review your approvals once a month and revoke any you don’t use.
5) Transfers
- Don’t copy addresses from your transaction history. Scammers can insert fake addresses that look almost identical.
- Check the full address on your device, not just the first and last few characters.
- Before making a large transfer, send a small test amount first.
6) Computer
- Ideally, have a computer used only for crypto. Keep its browser clean and use as few extensions as possible.
- Download wallets only from their official websites. There are lots of fakes in app stores and search results.
- Don’t casually open or run meeting software, game installers, or unfamiliar files sent by strangers.
- Don’t share your screen or install remote-control software. If “support” asks you to install AnyDesk, it’s almost certainly a scam.
- Bookmark the websites you use. Never click search ads.
- Treat unexpected airdrops and NFTs as traps until proven otherwise.
7) Exchanges
- Use a unique, strong password for each site and manage them with a password manager.
- Use an authenticator app or a passkey for two-factor authentication, not SMS.
- Store backup codes offline. Don’t leave them in your email or cloud storage.
- Add a carrier PIN to your mobile account. People are still impersonating others to take over their phone numbers and intercept verification codes.
- Use a separate email address for crypto so it’s harder for people to connect it to you.
- Turn on the withdrawal whitelist.
- Don’t keep crypto you aren’t actively trading on an exchange long-term. If it’s on an exchange, you don’t control the withdrawal keys.
8) Personal safety and privacy
- Don’t post your holdings or setup online. Incidents like home invasions and robberies are becoming more common.
- Support staff will never message you first.
- Ignore phishing emails and use official channels only.
- Plan for inheritance in advance: if you’re gone and the keys are gone too, the crypto is gone as well.
9) Quantum computing (not an issue today, but worth knowing about)
- It’s not a real threat today. Anyone using “quantum is coming” to scare you into buying a product is probably just trying to sell you something.
- BTC: Don’t reuse addresses. Once you’ve sent from an address, its public key is exposed.
- BTC: For long-term holdings, use addresses you’ve never sent from. With Taproot (bc1p) and some older address types, the public key is visible from the start.
- BTC: BIP-360 is developing quantum-resistant addresses, but it hasn’t launched yet. Some have also proposed freezing coins that haven’t been migrated.
- ETH / ERC20: Sending transactions or signing messages can expose your public key. Keep large holdings in a fresh wallet.
- SOL: The address itself is the public key, so it’s exposed from the start. Experimental solutions exist, but ordinary wallets can’t use them yet.
Hardware wallets are rarely hacked. More often, people get caught out by their own mistakes.
1) Hardware
- Buy only from the official website or an authorized retailer. Avoid unofficial resellers and shady shortcuts.
- If you open it and find words already written on the seed card, it’s a scam. Discard the whole thing and don’t use it.
- If possible, have it delivered to a pickup point instead of giving out your home address.
- Update firmware only through the official app.
2) Recovery phrases
- If you can, engrave your recovery phrase on a metal plate. Don’t just write it on paper; don’t photograph it, save it to cloud storage, or put it in your notes app.
- Enter your recovery phrase only through the official recovery process for your hardware wallet. Never enter it on a website or in a software wallet.
- Don’t split up your seed yourself. It’s unreliable and easy to mess up. If you really need to split it, use the officially supported Shamir backup, or use multisig.
- Test your backup as soon as you’ve written it down: use the built-in check, or follow the official process to wipe and restore your device. If you haven’t tested it, you don’t have a backup.
- Make two copies and store them in separate places. If your house catches fire and you lose your backup, you lose your assets too.
3) How to divide up your accounts
- Keep large amounts in a cold wallet that never interacts with DApps.
- Use a separate hot wallet for everyday use. Use a separate, small wallet to try new projects, and stop using it afterward.
- Consider adding a passphrase once your holdings get large: the same seed without a passphrase reveals only a small portion of your assets; with the passphrase, you can access your main holdings.
- Back up your passphrase too, and don’t store it in the same place as your recovery phrase. If you lose the passphrase, you can’t recover your crypto.
- If you hold a large amount, use multisig. Don’t put all your assets at risk in one place.
4) Signing (where most people get caught out)
- When checking a transaction, trust what’s displayed on your hardware wallet’s screen—not just what you see on your computer. In the Bybit incident, the web interface had been tampered with, resulting in losses of about $1.5 billion.
- If you don’t understand it, don’t sign it.
- “Gas-free” approvals can still let someone transfer your crypto.
- One malicious EIP-7702 authorization can hand over control of your entire account.
- On Solana, signing the wrong transaction could also change the permissions on your token account. Before signing, use a transaction simulator to see exactly what the transaction will do.
- Review your approvals once a month and revoke any you don’t use.
5) Transfers
- Don’t copy addresses from your transaction history. Scammers can insert fake addresses that look almost identical.
- Check the full address on your device, not just the first and last few characters.
- Before making a large transfer, send a small test amount first.
6) Computer
- Ideally, have a computer used only for crypto. Keep its browser clean and use as few extensions as possible.
- Download wallets only from their official websites. There are lots of fakes in app stores and search results.
- Don’t casually open or run meeting software, game installers, or unfamiliar files sent by strangers.
- Don’t share your screen or install remote-control software. If “support” asks you to install AnyDesk, it’s almost certainly a scam.
- Bookmark the websites you use. Never click search ads.
- Treat unexpected airdrops and NFTs as traps until proven otherwise.
7) Exchanges
- Use a unique, strong password for each site and manage them with a password manager.
- Use an authenticator app or a passkey for two-factor authentication, not SMS.
- Store backup codes offline. Don’t leave them in your email or cloud storage.
- Add a carrier PIN to your mobile account. People are still impersonating others to take over their phone numbers and intercept verification codes.
- Use a separate email address for crypto so it’s harder for people to connect it to you.
- Turn on the withdrawal whitelist.
- Don’t keep crypto you aren’t actively trading on an exchange long-term. If it’s on an exchange, you don’t control the withdrawal keys.
8) Personal safety and privacy
- Don’t post your holdings or setup online. Incidents like home invasions and robberies are becoming more common.
- Support staff will never message you first.
- Ignore phishing emails and use official channels only.
- Plan for inheritance in advance: if you’re gone and the keys are gone too, the crypto is gone as well.
9) Quantum computing (not an issue today, but worth knowing about)
- It’s not a real threat today. Anyone using “quantum is coming” to scare you into buying a product is probably just trying to sell you something.
- BTC: Don’t reuse addresses. Once you’ve sent from an address, its public key is exposed.
- BTC: For long-term holdings, use addresses you’ve never sent from. With Taproot (bc1p) and some older address types, the public key is visible from the start.
- BTC: BIP-360 is developing quantum-resistant addresses, but it hasn’t launched yet. Some have also proposed freezing coins that haven’t been migrated.
- ETH / ERC20: Sending transactions or signing messages can expose your public key. Keep large holdings in a fresh wallet.
- SOL: The address itself is the public key, so it’s exposed from the start. Experimental solutions exist, but ordinary wallets can’t use them yet.
Hardware wallets are rarely hacked. More often, people get caught out by their own mistakes.