Learn · Checklist
Is your crypto properly secured?
A list to work through yourself. Tick off what you've already sorted and you'll see straight away what's still left to do. Your ticks stay in this browser; we can't see them.
Your accounts
0/5On an exchange, your crypto sits behind a login. That login is your vault door.
If the password for one site leaks, criminals automatically try it on other sites. With a separate password for each account, the damage stays with that one site.
How to do it
Use a password manager that creates and remembers a password for every account. If you make one up yourself, use a phrase of five random words.
Anyone who gets into your mailbox can request a new password for almost any account. That makes your email the spare key to all your accounts.
How to do it
Give your mailbox its own password and switch on two-factor authentication there too. For your crypto accounts, consider using a separate address that you don't give out anywhere else.
An SMS code can be intercepted if someone gets your number moved to a SIM card of their own (SIM swapping). An app or security key is tied to your own device.
How to do it
In your exchange's security settings, choose an authenticator app, a passkey or a physical security key. Then switch off SMS if you can, and keep the backup codes on paper.
If someone does get into your account, they can't send your crypto straight to an address of their own.
How to do it
Look in the settings for an address list (often called a ‘whitelist’) and a waiting period for new addresses. Not every exchange has this; if yours does, switch it on.
A MiCA authorisation means supervision and rules on how customers' money is kept. It isn't a guarantee, but it is a minimum standard.
How to do it
Look up your exchange's name in our overview of the ESMA register. If you can't find it, also check the website of the regulator in your country: an exchange may be listed under the name of a different legal entity.
Your phone and computer
0/3The device you log in or pay with counts just as much as your password.
Updates close security holes that are already known. A device that hasn't been updated for months is wide open to anyone who knows about those holes.
How to do it
Switch on automatic updates for your operating system, your browser and your crypto apps. If a device no longer gets updates, stop using it for crypto.
A phone without a lock gives a thief instant access to your email, your text messages and your crypto apps.
How to do it
Use a PIN of at least six digits, or face or fingerprint recognition. Also set a separate PIN on your crypto apps if they offer one.
Fake apps with the same name and the same logo pop up in app stores and search engines. Whatever you enter there goes straight to scammers.
How to do it
Go to the website of the exchange or the wallet maker and follow the link to the app store from there. Check the developer's name.
Seed phrase and keys
0/5With your own wallet, you're your own bank. Whoever has your seed phrase (also called a recovery phrase) has your crypto.
Photos, notes and emails get synced and can leak. Anyone who reads your seed phrase can empty your wallet from anywhere in the world.
How to do it
Write the words down by hand, in the right order. No photo, no screenshot, no notes app. A metal plate survives fire and water. More in Seed phrase & private key: how to protect your crypto.
A fire, water damage or a house move can leave you without your only copy. Without your seed phrase, you won't get your wallet back if your device breaks.
How to do it
Keep a second copy in a different place that only you, or someone you trust completely, can open. Not in the same drawer as your hardware wallet.
No helpdesk, no exchange, no wallet maker and no ‘verification site’ needs your seed phrase. Anyone who asks for it is after your crypto.
How to do it
Never type your seed phrase into a website, a form or a chat. Only into your own wallet, and only when you're restoring a wallet yourself.
With a hardware wallet, your keys never touch a computer that's connected to the internet. Malware on your PC can't sign anything without you confirming it on the device.
How to do it
Buy it from the manufacturer itself or an official reseller, never second-hand. If there's already a seed phrase in the box, don't use the device. See Hardware wallets in 2026: the complete beginner guide.
You only spot a mistake in the words you wrote down when you need them. By then it's too late.
How to do it
Use your wallet's built-in check, or restore a wallet with your seed phrase while there's still very little on it.
Sending
0/4A blockchain transaction can't be reversed. A quick check prevents the most expensive mistakes.
Scammers send small amounts from addresses that look like yours or your contacts', so that they show up in your history. If you copy an address from there, you're paying the scammer.
How to do it
Always copy an address from the source, not from your transaction history. Then compare it character by character, and with a hardware wallet, do that on the device's own screen.
A transaction can't be reversed. A test amount costs a little extra in network fees, but it shows that everything's right before the big amount goes.
How to do it
Send a small amount, wait until it has arrived and have the recipient confirm it. Only then do you send the rest.
Many coins exist on more than one blockchain. If you send USDT over one network to an address that only knows another, it's often gone for good.
How to do it
Check which network the recipient has listed, for example Ethereum, Tron or Solana, and pick exactly that network when you send.
An ‘approve’ transaction gives a contract permission to move your tokens, including later on. A fake site or a hacked contract can abuse that.
How to do it
Read what your wallet is asking you to sign, and refuse anything you don't understand. Revoke old approvals in your wallet or with the approval checker on a block explorer.
Spotting scams
0/4Most crypto isn't lost to hackers, but because someone is talked into making the payment themselves.
No genuine exchange promises a fixed return on crypto. ‘Guaranteed 2% a day’ is always a way of getting hold of your money.
How to do it
The higher and surer the promise, the bigger the chance it's a scam. Read How to Spot a Crypto Scam: A Practical Checklist.
Fake support staff on WhatsApp, Telegram or X, and ‘recovery services’ that promise to get your lost crypto back, are standard tricks. Genuine support doesn't start a conversation with you.
How to do it
Contact your exchange yourself through its app or website. If a stranger messages you about investing or romance, read Pig butchering scams: spotting the WhatsApp con in time.
Links in emails, text messages and search ads regularly lead to a fake login page.
How to do it
Save your exchange's address as a bookmark and only use that, or the official app. Don't click ‘log in now’ links in messages, even if they look genuine.
Fake ads featuring famous people and fake articles about a robot that makes money on its own lead to call centres that are after your money.
How to do it
Search for the robot's name together with the word ‘scam’. A well-known example: Bitcoin Code is not Cryptocode: how the trading-robot scam works.
If something happens
0/2A plan for when things go wrong anyway, or for when you're no longer around.
Without instructions, the people you leave behind often can't even find crypto, let alone retrieve it.
How to do it
Write down which exchanges and wallets you use and where your seed phrase is kept. Keep those notes separate from the seed phrase itself, and tell one person you trust where to find them.
The faster you act, the better the chance that an exchange can still stop a withdrawal.
How to do it
Contact your exchange straight away through the official app or website, change your passwords from a different device and report it to the police. Never pay a ‘recovery service’ that promises to get your crypto back.
Where to next
Frequently asked questions
Do you store what I tick?
No. Your ticks are only kept in the browser where you set them, in that browser's local storage. We never get to see them. If you clear your browser data, they're gone.
Am I safe once I've ticked everything off?
Then you've closed the well-known gaps, but there's no such thing as one hundred per cent safe. New tricks keep appearing and your own situation changes. So go through the list again every now and then.
Why isn't SMS good enough for two-factor authentication?
SMS is better than nothing, but an SMS code can be intercepted if someone gets your number moved to a SIM card of their own. An authenticator app, passkey or security key is much harder to steal.
Do I need a hardware wallet?
Not necessarily. If you keep small amounts on an exchange with a MiCA authorisation and good two-factor authentication, that's enough for many people. A hardware wallet becomes worth considering when you want to manage larger amounts yourself.
Sources
- CISA (US government), More than a password: why two-factor authentication with an app or key is stronger than with SMS.
- NCSC (UK government), Turn on 2-step verification for your email: your email as the key to your other accounts.
- ESMA, Markets in Crypto-Assets Regulation (MiCA): the European register of authorised providers.
All sources checked on 18 October 2026.