In crypto, you are the bank, the security team and the customer support line. There's no fraud department that reverses a transaction. That's the trade-off of self-custody: nobody can freeze your funds, and nobody can get them back for you either.
The good news is that most losses come from a handful of predictable mistakes. Avoid those and you've beaten most attackers.
Know what you're protecting
A crypto wallet doesn't hold coins. The coins live on the blockchain. The wallet holds the private keys that prove you control an address and let you sign transactions.
Most wallets generate those keys from a seed phrase (also called a recovery phrase): usually 12 or 24 words. Anyone with the seed phrase controls every account derived from it, on any device, forever. That makes the seed phrase the single most important thing you own in crypto.
Seed phrase rules
- Write it down on paper or metal. Store it somewhere safe from fire, water and curious visitors. Consider a second copy in a separate secure location.
- Never type it into a website, a form or a chat. No legitimate support agent, airdrop or wallet "sync" will ever need it.
- Never store it in photos, cloud notes, email or a password-protected file on your laptop. Those get synced, backed up and breached.
- If anyone asks for it, it's a scam. No exceptions worth learning.
Hot wallets vs. cold storage
A hot wallet is software connected to the internet: a browser extension or mobile app. It is convenient and fine for small amounts and daily use.
Cold storage keeps keys offline. The most common form is a hardware wallet, a small device that signs transactions internally so your private key never touches your computer. Even if your laptop has malware, an attacker can't sign a transaction without physical access to the device and its PIN.
A sensible setup for most people:
- A hardware wallet for long-term holdings.
- A hot wallet with a small balance for experimenting, games and new apps.
- Exchanges only for what you are actively trading. An exchange account is not self-custody; you're trusting the exchange.
Buy hardware wallets directly from the manufacturer or an authorized reseller, and set them up yourself. Never use a device that arrives with a seed phrase already written down.
Understand what you're signing
Most wallet drains don't steal keys. They trick you into signing something.
Token approvals. When you use a DeFi app, you often approve it to spend a token on your behalf. Many apps ask for unlimited approval. If that contract is malicious or later exploited, it can take every unit of that token from your wallet. Approve only what you need when possible, and periodically revoke old approvals with a reputable revoke tool or your block explorer's approval checker.
Signature requests. Some signatures, like "permit" style messages, authorize transfers without a normal transaction. If a site you don't fully trust asks you to sign something you can't read, don't.
Simulate before signing. Many wallets now preview what a transaction will do: which tokens leave and which arrive. Read it. If the preview says your whole balance is leaving in exchange for nothing, believe the preview.
Common scams to recognize
- Phishing sites. Fake versions of real apps, often promoted through ads, DMs or replies on X. Bookmark the sites you use and go through your bookmarks.
- Fake support. Someone "from the team" DMs you to help. Real teams don't open with a DM.
- Address poisoning. Attackers send tiny transactions from an address that looks like one you've used, hoping you'll copy it from your history next time. Always check the full address, not just the first and last few characters, and use an address book.
- Fake airdrops and NFTs. Random tokens appear in your wallet with a website to "claim" them. Interacting with them is the trap. Ignore them.
- Recovery scams. After a loss, people offering to "recover" your funds for a fee. They can't.
Basic hygiene
- Use a unique password and an authenticator app or security key for exchange accounts. Avoid SMS codes where you can, because SIM-swap attacks target them.
- Keep your wallet software and device firmware updated from official sources.
- Use a separate browser profile for crypto, with as few extensions as possible.
- Send a small test transaction before moving a large amount to a new address.
- Double-check the network. Sending a token on the wrong chain can make it difficult or impossible to recover.
The bottom line
Guard the seed phrase like it's the money, because it is. Keep long-term funds in cold storage, read what you sign, revoke approvals you no longer need, and assume any unexpected DM, airdrop or "support agent" is an attempt to rob you. Boring habits. Very effective.
Related: How to spot a rug pull and the glossary entries for seed phrase and token approval.
Educational content only. Not financial advice.