How to keep your crypto safe: wallets, seed phrases and scams

In crypto there is usually no bank to call if something goes wrong. Transactions are final, and stolen funds are rarely recovered. The good news is that most losses come from a handful of avoidable mistakes.

Custodial vs self-custody

If your coins sit on an exchange, the exchange holds the private keys — this is custodial storage. It is convenient, but you depend on the exchange staying solvent, honest and secure. Several large exchanges have collapsed with customer funds inside.

With self-custody, you hold the keys in your own wallet. Nobody can freeze your funds — but nobody can rescue you if you lose the keys either.

Hot wallets and hardware wallets

• Hot wallets are apps or browser extensions on internet-connected devices. They are easy to use and fine for small amounts.
• Hardware wallets are small devices that keep your keys offline and require a physical button press to approve transactions. They are the standard choice for larger holdings. Only buy them directly from the manufacturer.

Protect your seed phrase

When you create a wallet, you get a seed phrase (also called a recovery phrase) — usually 12 or 24 words. Anyone who has those words has your coins.

• Write it down on paper or stamp it in metal. Never store it as a photo, in cloud notes, in email or in a password-protected document online.
• Keep copies in two secure physical locations.
• Never type it into a website and never share it with anyone — no legitimate company or support agent will ever ask for it.

Lock down your accounts

• Use a unique, strong password for every exchange, stored in a password manager.
• Turn on two-factor authentication with an authenticator app or security key rather than SMS, which can be hijacked through SIM swapping.
• Use withdrawal address allow-lists where your exchange offers them.

The most common scams

• Phishing — fake websites, emails and ads that copy real exchanges or wallets to steal logins or seed phrases. Bookmark the sites you use.
• Fake support — “helpers” who contact you after you post about a problem online. Real support never DMs first.
• Giveaway scams — “send 1 ETH, get 2 back”, often using deepfake videos of famous people. It is always a scam.
• Investment and romance scams — a new online friend introduces you to a “trading platform” showing huge profits that you can never withdraw.
• Malicious approvals — signing a transaction on a shady site that grants it permission to spend your tokens. Read what you sign, and periodically revoke old approvals.
• Address poisoning — scammers send tiny transactions from an address that looks like one you use, hoping you copy it from your history. Always check the full address.