How to Protect Your Crypto Wealth: A Beginner's Security Checklist

The Basics That Prevent Most Theft

Most crypto theft doesn't come from some sophisticated hack. It comes from weak, reused passwords and accounts with no real second layer of protection. Use a password manager to generate a genuinely unique password for every exchange and wallet, and turn on two-factor authentication everywhere it's offered, using an authenticator app rather than SMS, which can be intercepted through a SIM swap.

Secure Your Email First

Your email account is the master key to everything else, because that's where password resets are sent. Give it your strongest password and an authenticator-app login, and never reuse that password anywhere. Many people keep a separate email address used only for crypto accounts, never shared publicly, so it's harder for anyone to target.

Your Seed Phrase Is the Real Backup

When you set up a wallet, you're given a seed phrase, usually 12 to 24 words, and that phrase, not your password, is what actually restores access if your device is lost or breaks. Write it down on paper and store it somewhere safe offline; never take a screenshot of it or save it to a cloud drive, email or notes app, all of which are exactly where attackers look first.

If you'd like to see what's at stake, what happens if you lose your seed phrase walks through it.

Protect Your Phone Number

In a SIM swap, an attacker persuades your mobile provider to move your number to a SIM card they control, then uses text messages to reset your passwords and approve logins. You can reduce the risk by using an authenticator app instead of SMS codes, adding a PIN or port-out lock to your mobile account if your provider offers one, and avoiding publishing your number alongside your crypto activity.

Spotting Phishing

Phishing is the most common way people lose access. The message or site looks official and pushes you to act quickly. A few checks stop most of it:

• Never click links in emails, texts or direct messages to log in. Use a bookmark you saved yourself.
• Read the address in your browser carefully, one character at a time. Lookalike addresses are common.
• Be suspicious of urgency: “your account will be locked”, “suspicious login detected”.
• Download wallet apps only from the developer's own site or the official app store listing, and check the publisher.
• Never type your seed phrase into a website, an app or a chat window, for any reason.

Safe Habits With Wallets and Approvals

• Send a small test amount before moving anything significant.
• Check the full receiving address, not just the first and last few characters, and confirm you're using the right network.
• Be careful what you connect your wallet to. Connecting is usually harmless, but signing an approval can give a site permission to move your tokens.
• Review and revoke old token approvals you no longer use.
• Keep a separate wallet with a small balance for trying new apps, and keep your main holdings elsewhere.
• With a hardware wallet, check the details on the device's own screen before approving.

Why a Hardware Wallet Is Worth It

A hardware wallet keeps your private keys on a small offline device, so even if your computer is full of malware, the keys never leave the device. Each transaction has to be confirmed on its own screen with a physical button, which stops most remote theft. Buy it directly from the maker, never second-hand, and set it up yourself so that you're the only person who has ever seen the recovery phrase.

Keep Your Devices Clean

• Install updates for your phone, computer, browser and wallet apps promptly.
• Use reputable security software and don't install pirated software or unknown browser extensions; many steal wallet data.
• Consider a separate browser profile that you use only for crypto.
• Avoid doing anything involving money on public Wi-Fi.
• Lock your devices with a strong passcode.

How Much Protection Do You Need?

Your setup should match what's at stake. A rough guide:

• Just starting, with small amounts: a reputable exchange account with a unique password, an authenticator app and a secured email is a solid base.
• Growing holdings: add a self-custody wallet with a written seed phrase backup, and keep only what you actively use on exchanges.
• Amounts that would really hurt to lose: a hardware wallet, backups stored in more than one place, and consider multi-signature.
• Whatever the size: the basics never stop mattering. Most big losses begin with a stolen email or a phishing click, not a clever hack.

A Quick Checklist

Five habits cover almost everything that actually matters:

• A unique, generated password for every platform, stored in a password manager.
• Two-factor authentication via an authenticator app, not SMS.
• Your seed phrase written down offline, never digital, never in the cloud.
• A hardware wallet for anything beyond what you'd spend day to day; see hardware versus software wallets for how to choose.
• Double-checking a site's URL before ever entering login details or a seed phrase.

Security Myths That Get People Caught

“I'm too small to be a target.” Attacks are automated and aimed at everyone, so small holders get hit as often as large ones.

“A VPN makes me safe.” A VPN protects your connection. It doesn't protect you from phishing, fake apps or bad approvals.

“A hardware wallet can't be scammed.” The device is secure, but you can still be tricked into approving a harmful transaction or giving away your recovery phrase.

“I'll remember my seed phrase.” People forget, move house and lose devices. Write it down.

“Antivirus is enough.” It helps, but good habits do most of the work.

Quick Wins You Can Do Today

If this all feels like a lot, start with these five. Together they take less than an hour and block most real-world attacks:

• Turn on authenticator-app two-factor authentication for your email and your exchange account.
• Install a password manager and change your three most important passwords to long, unique ones.
• Write your seed phrase on paper, if you haven't already, and put it somewhere safe.
• Remove browser extensions you don't recognize or no longer use.
• Bookmark the real address of every exchange and wallet site you use.

A Monthly Security Check

Ten minutes once a month keeps things from slipping:

• Close any exchange or wallet accounts you no longer use.
• Check that withdrawal allowlists and security settings are still how you left them.
• Update your devices and wallet apps.
• Confirm your seed phrase backup is still where you left it and readable.
• Revoke token approvals you no longer need.
• Check that your email's recovery options still point to you.

If You Think You've Been Compromised

Act quickly and calmly, and do these from a device you trust:

• Move any funds you still control to a brand-new wallet.
• Change the passwords and reset the two-factor authentication on the affected accounts, starting with your email.
• Contact the exchange or wallet provider and ask them to freeze the account if they can.
• Revoke any approvals you granted to suspicious sites.
• Report it to the police and your country's fraud service.
• Ignore anyone who offers to recover your money for a fee; that's usually a second scam. Our guide to common crypto scams explains how those work.

For larger holdings, it's also worth knowing about multi-signature wallets, which add another layer of protection. None of this requires technical expertise, just a handful of habits built early, before they matter. Crypto Confidence walks through exactly how to protect what you're building as your holdings grow.