Because crypto transactions cannot be reversed and self-custody has no reset button, security is a practical discipline rather than an afterthought. The good news is that a handful of concrete habits stop the overwhelming majority of thefts and mistakes. This guide lays out those habits, from the strongest to the most often overlooked.

Use a hardware wallet for real holdings

For any meaningful amount, a hardware wallet keeps your keys offline and signs transactions inside the device, so keys never touch an internet-connected computer. Buy the device directly from the manufacturer rather than a marketplace reseller, since tampered devices are a known attack. Set it up yourself so that you generate the seed phrase, and never use a wallet that arrived with a pre-printed phrase. This single step neutralizes most remote malware attacks.

Protect the seed phrase offline

Your seed phrase is the master key, so it must be stored offline and never photographed, emailed, or saved to the cloud. Writing it on paper works, but engraving it on metal protects against fire and water for larger holdings. Consider storing copies in more than one secure location so a single accident does not wipe out access. Anyone who reads the phrase controls the funds, so treat it with the same care as physical cash or gold.

Sign carefully and verify addresses

Malware can swap a copied address for the attacker's, so verify the receiving address on your hardware wallet's own screen before confirming. Read what each transaction and token approval actually authorizes rather than clicking through blindly. Periodically revoke approvals you no longer need so a forgotten permission cannot be exploited later. Slowing down for a few seconds before confirming defeats a large class of attacks.

Harden accounts and test recovery

For exchange and email accounts, use unique passwords and app-based two-factor authentication rather than text-message codes, which are vulnerable to SIM-swap attacks. Keep wallet software and device firmware updated from official sources only. Before moving a large balance, test your recovery process with a small amount to confirm your backup actually works. Separating a small hot wallet for spending from cold storage for savings limits the damage if the hot wallet is ever compromised.

Before sending 5,000 dollars of crypto, you paste the recipient address and then check that the address shown on your hardware wallet screen matches character-for-character. Malware had silently replaced the clipboard address, but because you verified on the device, you catch the swap and avoid sending the funds to a thief.

Key takeaways

  • Use a hardware wallet bought directly from the manufacturer for significant holdings.
  • Store the seed phrase offline, never as a photo, email, or cloud file.
  • Verify receiving addresses on the device and read what you sign.
  • Revoke unused token approvals and keep software updated from official sources.
  • Use app-based two-factor authentication and test recovery before funding large amounts.

Common mistakes

FAQ

Is a hardware wallet really necessary?

For small amounts a reputable software wallet may be acceptable, but for meaningful holdings a hardware wallet dramatically reduces the risk of remote theft and is widely recommended.

What is a passphrase or 25th word?

It is an optional extra secret added to your seed phrase that creates a separate hidden wallet, adding protection but also another critical item you must never lose.