Quick answer: Crypto security starts with control of keys, accounts, devices, and every transaction you sign. Use a separate password for each account. Turn on strong multifactor authentication. Keep recovery phrases offline, verify addresses on a trusted screen, and test your recovery plan before you need it.
No wallet, exchange, or security tool removes every risk. The right setup depends on how often you trade, how much you hold, and who can recover access.
Crypto security checklist
- Protect email first. Use a unique password, a password manager, and the strongest MFA your provider supports.
- Separate trading from storage. Keep only the amount needed for near-term use in a connected wallet or exchange account.
- Store recovery words offline. Never email them, photograph them, type them into support chat, or save them in cloud notes.
- Verify before signing. Check the site domain, network, recipient, token, amount, and contract request.
- Limit contract access. Avoid unlimited token approvals when a smaller limit will work. Review old approvals.
- Test backups. Confirm that the backup is readable and that a trusted recovery process exists.
- Prepare for an incident. Keep official support links, account records, wallet addresses, and reporting steps in a safe place.
Start with a simple threat model
A threat model lists what you protect, who can access it, and how that access may fail. It keeps you from buying tools before you understand the risk.
- Exchange account: email takeover, weak MFA, session theft, withdrawal-rule changes, or exchange failure.
- Software wallet: fake apps, malicious browser extensions, device malware, unsafe backups, and bad signatures.
- Hardware wallet: stolen recovery words, supply-chain tricks, fake updates, blind signing, and physical loss.
- DeFi account: harmful approvals, copied sites, unsafe contracts, false tokens, and compromised front ends.
- Team treasury: one-person control, weak review, poor signer separation, and no tested recovery path.
Rank each risk by impact and likelihood. Fix the highest-impact access points first. Email, recovery words, and signing devices often deserve the first review.
Wallet security: hot, cold, and hardware setups
| Setup | Best fit | Main strength | Main risk to manage |
|---|---|---|---|
| Exchange account | Near-term trading | Fast market access and account recovery | Custody, account takeover, and platform failure |
| Software wallet | Regular onchain use | Flexible access to apps and networks | Device, browser, phishing, and approval risk |
| Hardware wallet | Longer-term storage and larger balances | Keys stay isolated from an online device | Recovery-phrase theft, bad signing, and physical loss |
| Multisignature wallet | Teams and high-value treasuries | More than one approval can be required | Bad signer design, lost quorum, and weak procedures |
Ethereum.org says a hardware wallet keeps private keys offline. That reduces online key theft, but it does not make a harmful transaction safe. Read our hardware wallet comparison and wallet setup guide before choosing a device or app.
Protect passwords, MFA, and account recovery
CISA recommends long, random, unique passwords and a password manager. Reusing a password can let one breach expose several crypto accounts.
- Use a unique password for email, exchanges, password managers, and cloud accounts.
- Turn on MFA for every account that offers it. Prefer a security key, passkey, or authenticator app when available.
- Save recovery codes offline. Do not keep the only copy on the device they recover.
- Remove old phone numbers, devices, API keys, and active sessions.
- Use withdrawal allowlists and delay settings when the exchange supports them.
Read CISA’s guides to strong passwords and multifactor authentication.
Recovery phrases and private keys
A recovery phrase can control every account created from that wallet. Anyone who gets it may move the assets. No real support agent needs it.
- Write the phrase down in private. Consider a durable backup for fire or water risk.
- Store separate copies in secure places. Do not label them in a way that helps a thief.
- Never enter the phrase after following a link from email, search ads, direct messages, or support chat.
- Test recovery with the wallet maker’s official process before placing a large balance at risk.
- Plan how trusted people could recover assets after death or incapacity without giving one person easy access today.
How to verify a crypto transaction
- Open the official site yourself. Use a saved bookmark or a known domain. Do not trust an ad or message link.
- Check the network and asset. The same token name can exist on several networks.
- Check the full recipient. Compare more than the first and last characters. Address-poisoning attacks copy those parts.
- Read the request. A signature may log in, approve a token, list an item, or authorize a transfer.
- Limit approval. Set only the spend limit needed for the task when possible.
- Send a test. For a new address or large transfer, send a small amount first and confirm receipt.
- Keep the record. Save the transaction hash and business reason without exposing keys or recovery words.
Ethereum.org advises users to double-check transfers and limit smart-contract spending. Its security guide also warns that no legitimate service will ask for a recovery phrase.
Common crypto scams in 2026
- Fake support: a caller or direct message asks for a phrase, remote access, or a transfer.
- Wallet drainers: a copied site asks for a broad token approval or harmful signature.
- Investment groups: a contact shows false profits, then demands more money to withdraw.
- Recovery scams: someone promises to recover stolen crypto for an upfront fee or secret information.
- Giveaway scams: a post promises to return more crypto after you send a payment.
- Fake apps and updates: a copied wallet or browser extension steals keys or changes transfers.
The FTC warns that crypto payments usually are not reversible and may lack the protections of card payments. Review its crypto scam guidance before sending money to an unfamiliar party.
What to do after a wallet or account compromise
- Stop signing transactions and disconnect the affected wallet from apps.
- Use a clean, updated device. Change email and exchange passwords, then end other sessions.
- Move unaffected assets only if you can verify a safe destination and signing device.
- Revoke risky token approvals. Do not rely on revocation if the recovery phrase itself was exposed.
- Contact the exchange or wallet provider through its official site. Ask about freezes, account locks, or logs.
- Save addresses, transaction hashes, screenshots, dates, and messages. Never publish private keys or recovery words.
- Report fraud to the relevant exchange and authorities. The FTC lists the FTC, CFTC, SEC, and IC3 reporting routes.
Be careful with anyone who contacts you after a loss. Recovery scammers often target people who have already been harmed.
Use Token Metrics without weakening wallet safety
Research tools can help you compare assets and market conditions. They cannot protect a recovery phrase, reverse a transfer, or make an unsafe contract safe.
Use Token Metrics to organize crypto market and risk research
Frequently asked questions
What is the safest way to store cryptocurrency?
There is no risk-free setup. A hardware wallet can keep keys offline. The owner must still protect the recovery phrase, verify transactions, and maintain a tested backup.
Should I keep crypto on an exchange?
An exchange may be practical for active trading. Long-term storage adds custody and account risk. Compare those risks with the duties of self-custody.
What should I do after a suspicious crypto transaction?
Stop signing. Move unaffected assets only from a trusted device. Revoke risky approvals, contact the provider, and save transaction records for reports.
Sources checked
- CISA: Use Strong Passwords — unique passwords and password managers.
- CISA: Turn On MFA — account protection with another authentication step.
- Ethereum.org: Security and Scam Prevention — recovery phrases, hardware wallets, transaction review, and spend limits.
- FTC: Cryptocurrency and Scams — payment risks, common scams, and reporting routes.
Disclosure and disclaimer
Token Metrics may earn revenue when readers buy some products. That revenue does not change this security checklist. This guide is for education. It is not financial, legal, tax, custody, compliance, or security advice. Crypto transactions can be irreversible, and losses may not be recoverable.
