How to keep crypto safe
Lesson 28 · practical guide
Crypto security is a chain: email, device, exchange, wallet, private key and transaction approval. One weak link can expose funds, and a shared seed phrase cannot be recovered by customer support.
What you will learn
Protect crypto by managing keys, devices, permissions and recovery as separate risks.
Key terms
- Seed phrase — a human-readable backup that can recreate wallet control.
- Hardware wallet — a device designed to keep signing keys isolated from a general computer.
- Allowance — permission granted to a smart contract to spend a token.
Follow these steps
- Use a password manager for exchange passwords and app-based or hardware two-factor authentication.
- Keep seed phrases offline, private and duplicated in secure locations; never photograph or type them into a website.
- Check transaction network, recipient, amount and smart-contract permissions before signing.
- Create a recovery plan and test it with a small amount before holding more.
Practical advice
Security is a process, not a brand. A legitimate-looking site can still request a dangerous signature, and a lost seed phrase may be irreversible.
Long-form explainer
The full guide
Read this lesson as a chapter: understand the mechanism, test the assumptions and apply the idea with a clear risk limit.
Security is a chain of separate controls
A seed phrase can recreate wallet control, so anyone who obtains it may be able to move the assets. A hardware wallet can isolate signing keys, but it does not protect against a user approving a malicious transaction or losing the recovery backup. Token allowances create another permission: a contract may be authorised to spend a token on your behalf.
Each control solves a different problem. Device security protects the interface, the hardware wallet protects key exposure, transaction review protects approvals and the recovery plan protects access after loss. No single product replaces the others.
Reduce the blast radius
Use separate wallets or accounts for different activities, keep software updated and verify downloads from the official source. Review old allowances and revoke permissions that are no longer needed. Confirm the network, destination and amount on the signing device, not only in a browser tab.
Store recovery material offline and in a way that trusted heirs could understand without exposing it to online attackers. Test recovery with a small balance before depending on it. Security is successful when a single mistake is contained rather than multiplied.
What usually goes wrong
The most common error is protecting the wallet and ignoring the email account behind it. Email is the recovery route for exchanges, cloud backups and password resets, so an attacker who controls it frequently does not need anything else. The second mistake is using SMS codes as the main second factor, since phone numbers can be transferred away from you by someone with enough of your personal details.
People also reuse one device for everything: browsing, downloading, testing new applications and holding significant balances. The third failure is granting token approvals and never reviewing them; a permission given to a contract months ago can still be used. The last mistake is a security setup only you can operate. If the recovery phrase exists in exactly one place, in one head, with no instructions and no redundancy, an accident is indistinguishable from theft in its result. Plan for illness, loss and fire, not only for hackers, because the boring failures are more common than the dramatic ones.
How it works
Use a unique password, password manager, strong two-factor authentication, updates, screen lock, withdrawal alerts and allowlists where available. Consider cold storage for long-term funds only if you can manage recovery safely.
Separate everyday use from long-term custody. Bookmark official sites, inspect domains, verify transaction details and keep recovery backups offline. After a suspected compromise, use a clean device and act quickly.
Worked example
Numbers make an idea concrete. Here is a small, illustrative one — not a forecast.
If a message says your exchange closes in ten minutes, open the bookmarked exchange yourself and inspect alerts. Urgency is a reason to verify, never a reason to skip verification.
Before you act
Run through these questions before you commit any money or make a decision based on this lesson:
- Is email protected separately?
- Where is the offline recovery backup?
- Do I verify contracts and networks?
- What happens if my device is lost?
Practice this lesson
Reading is a start; doing the exercise is what makes the idea stick.
Draw the path from email to withdrawal. Mark each attack point and add one control: 2FA, update, backup, allowlist, test transfer or cold storage.
Further reading
Educational content only: This guide is not personal financial, legal or tax advice. Markets involve risk, including the possible loss of capital. Verify current rules, fees and product availability in your country.