Crypto security isn’t about one thing — it’s about layers. A strong security plan uses multiple layers so that if one fails, the others protect you.
This is your complete crypto security checklist. Follow every step.
Layer 1: Seed Phrase Security
Your seed phrase (12 or 24 words) is the master key to your crypto. Anyone with these words controls your funds.
- Written on paper (not digital — no screenshots, no cloud, no notes app)
- Stored in a fireproof safe or safety deposit box
- Never typed into any website or app
- Backup copy stored in a second location (different building)
- Tested by recovering a small amount first
Do NOT:
- Store seed phrase in Google Docs, iCloud, or any cloud service
- Take a photo of your seed phrase
- Email it to yourself
- Enter it into any website claiming to be “wallet recovery”
Layer 2: Hardware Wallet
- Own a hardware wallet (Ledger or Trezor) for holdings over $1,000
- Purchase directly from the manufacturer (not Amazon or eBay — risk of tampered devices)
- Set up PIN code on the device
- Verify the device is genuine (Ledger Live checks this)
- Test sending and receiving with a small amount first
Layer 3: 2FA (Two-Factor Authentication)
- Authenticator app (Google Authenticator, Authy) on ALL exchange accounts
- Hardware security key (YubiKey) for primary email and largest exchange account
- Backup codes saved securely (not on phone)
- SMS 2FA disabled wherever possible
Layer 4: Email Security
Your email is the gateway to resetting passwords on exchanges.
- Strong unique password (20+ characters, random)
- 2FA enabled (authenticator app, not SMS)
- Recovery email also secured with 2FA
- No forwarding rules set up (attackers add hidden forwarding to intercept password resets)
- Login alerts enabled
Layer 5: Device Security
- Operating system updated (no pending security updates)
- Antivirus/malware protection active (Windows Defender, Malwarebytes)
- Browser extensions minimized (fewer extensions = lower attack surface)
- No pirated software (common source of malware)
- Separate browser for crypto activity (no random browsing)
- Ad blocker installed (uBlock Origin)
Layer 6: Network Security
- No public Wi-Fi for crypto transactions (coffee shops, airports, hotels)
- Home Wi-Fi secured with WPA3
- VPN used when on untrusted networks
- Router firmware updated
Layer 7: Exchange Security
- Only use major exchanges (Coinbase, Kraken, Binance)
- Withdraw crypto immediately after purchase
- Whitelist withdrawal addresses (new addresses blocked for 24-48 hours)
- Withdrawal limits set to minimum practical amount
- No more than 1-2% of portfolio left on exchanges
Layer 8: Social Engineering Protection
- Never share seed phrase with anyone (including “support,” “family,” “investors”)
- Verify all communication claiming to be from exchanges
- Ignore DMs about “helping with your account” or “investment opportunities”
- No personal information shared in crypto forums
- Family members educated about crypto scams targeting you
Emergency Response Plan
If you suspect you’ve been compromised:
- Don’t panic — Quick actions are often wrong actions
- Transfer remaining funds to a new wallet (create a new seed phrase)
- Change passwords on all exchanges
- Revoke all wallet connections (use Revoke.cash for EVM wallets)
- Scan device for malware
- Contact exchange support if funds were stolen
- File a police report (may help with tax loss claims)
Security Levels by Portfolio Size
| Portfolio | Minimum Security Setup |
|---|---|
| Under $500 | App password + 2FA on exchanges |
| $500 - $5,000 | Hardware wallet + authenticator app + unique passwords |
| $5,000 - $50,000 | Hardware wallet + YubiKey + dedicated device for crypto |
| $50,000+ | Hardware wallet + multisig + legal structure + professional audit |
Weekly Security Checklist
- Check that no unauthorized withdrawals have occurred
- Verify exchange login history
- Check for unusual account activity
- Confirm all 2FA devices are still accessible
Verdict
Crypto security is simple but requires discipline:
Seed phrase offline. Hardware wallet for storage. 2FA on everything. Email locked down. Exchanges only for buying.
Follow this checklist, and you’ll be safer than 99% of crypto users. Most losses come from skipping these basics.
Related: What Is Two-Factor Authentication? | Hot Wallets vs Cold Wallets | Common Phishing Attacks | What Is a Seed Phrase?
Security is the most discussed topic on BitcoinTalk. The veterans all follow some version of this checklist. Newbies who skip these steps are the ones posting “I’ve been hacked” threads.
What matters most
Build the plan by working through these layers in order, since each protects what comes after it. Start with the seed phrase — the master key to everything you self-custody — and keep it only on paper or metal, never in any digital form. Then put holdings above a few hundred dollars on a hardware wallet bought directly from the manufacturer. Turn on authenticator-app 2FA across every exchange, add a hardware security key for your email and biggest account, and treat your email inbox as a vault by using a strong unique password, 2FA, and alerts. Keep your devices clean and your browser extension count low, avoid public Wi-Fi for transactions, use a VPN on untrusted networks, and restrict the exchanges you use to the major, well-regarded ones — withdrawing your crypto promptly rather than leaving it on the platform.
None of these layers is unbreakable on its own, which is the point. If a phishing email slips through your filters, the 2FA on your exchange still blocks the login. If your laptop gets malware, your hardware wallet refuses to sign the transaction until you confirm on the device. If someone finds your seed, the passphrase still protects the funds. The security plan works because an attacker now has to defeat several different defences at once rather than one. The human factors — forgetting your own recovery details or trusting a fake support message — are the weakest links, so the plan is deliberately built to survive mistakes.
A practical setup routine
You can establish this security plan in a single focused session. Begin offline with your seed phrase: generate it on the hardware wallet, write or stamp it onto metal, and place backups in two separate buildings. Add a passphrase, memorise it, and store it apart from the seed. Install 2FA on every exchange account with an authenticator app, save your backup codes somewhere not on your phone, and set up a hardware key like a YubiKey for your primary email and largest account. Clean up your email: change to a long random password, enable 2FA, remove any forwarding rules, and turn on login alerts. Sweep your device — apply pending updates, run a malware scan, and remove unneeded browser extensions. Then set up a dedicated crypto browser or profile, whitelist your withdrawal addresses on exchanges, and set withdrawal limits. Finally, write your inheritance plan and a short “what to do if compromised” card. After that, the weekly checklist of checking for unauthorised withdrawals and reviewing 2FA devices keeps the whole thing maintained.
What to avoid
The failures that wipe out users are usually avoidable habits. Storing a seed phrase digitally in any form — screenshot, cloud doc, notes app, or a mirror to yourself — hands your master key to anyone who reaches those accounts. Entering that seed into a website that claims to offer wallet recovery is a direct gift to scammers. Reusing a password across exchanges means one breach opens every door. Skipping 2FA, or relying on SMS against a SIM swap, leaves a gap that is easy to exploit. Buying a hardware wallet from a marketplace reseller risks a tampered device. Leaving crypto on an exchange beyond a small working balance turns a self-custody problem into a platform risk. And ignoring your email’s forwarding rules can let an attacker silently intercept password resets. Guard the weakest links deliberately, and never let convenience or “just this once” reasoning erode the layers.
Building habits that last
A security plan only helps if you maintain it, so make review a scheduled habit. Weekly, confirm there are no unauthorised withdrawals, check exchange login history, and verify your 2FA devices still work. Monthly, revisit your browser extensions, revoke unused dApp approvals, and confirm your seed backups are untouched. As your holdings grow, move up the security level table — the plan that suits $500 is dangerously thin at $50,000, where multisig, a dedicated device, and a legal structure become appropriate. Test your recovery process with a small amount so a real emergency is a routine you have already practised. Review your inheritance instructions whenever your wallet setup changes. Done consistently, this becomes the quiet background habit that keeps your crypto secure across years of market ups and downs, and it lines up with the wider guidance on phishing, wallet security checklists, and two-factor authentication covered in the rest of the safe-crypto section.