Crypto Security
Crypto security is not really about cryptography. The cryptography holds. What fails is everything around it — a recovery phrase saved in a notes app, a password reused from an old account, a message from someone who sounds like support.
CryptoVantage surveyed more than 1,000 crypto owners about exactly this. Almost 40% had forgotten a password at some point. A third had been caught by a scam, losing an average of $538 each.
That is where the money actually goes. This hub works through it in the order that matters: who controls your keys, where those keys live, how you back them up, and how the people trying to take them approach you.
Where crypto losses actually come from
The survey numbers are worth sitting with, because they cut against how crypto security usually gets discussed.
- 39.7% had forgotten a password at some point, and 95.6% of them got back in. Forgetting a password on a custodial account is recoverable. Forgetting a recovery phrase is not.
- 32.6% had been caught by a scam, average loss $538. None of that required breaking any encryption.
- Only 61% believed they had made a strong password, and many said they picked memorable over secure.
The practical consequence is that attention spent on exotic threats is attention not spent on the two things that actually take people’s money: losing access to their own keys, and being talked into handing them over.
The full dataset is in the coin storage security survey.
The one rule: whoever holds the keys holds the coins
Every other decision here follows from one question: can someone else move your coins without you?
On an exchange or a custodial wallet the answer is yes. The platform holds the private keys and you hold a claim against the platform. That is not automatically the wrong choice — it is how most people start, and it comes with a password reset, which self-custody does not.
In a non-custodial wallet the answer is no. You hold the keys. Nobody can freeze your funds, and nobody can recover them for you either.
FTX is the clearest illustration of the difference. It was not a hack. Customer funds sat with the platform and were used elsewhere, and people who had treated an exchange balance as savings found out what a claim against a platform is worth when the platform fails.
If the distinction is new, start with public and private keys, then custodial versus non-custodial wallets.
Choosing where your keys live
Once you have decided to hold your own keys, the choice is between hardware and software.
A hardware wallet keeps the private key on a dedicated device that never exposes it to your computer. Ledger Nano X, Trezor Model T, Coinbase Wallet and Zengo are the four I work through in the safest crypto wallets guide.
One limitation that hardware wallet marketing consistently understates: the device protects the key, not your judgement. If you approve a malicious transaction on the device screen, the hardware does exactly what you confirmed. A large share of losses among hardware wallet users are signed approvals, not extracted keys.
Hot wallets — anything connected — are reasonable for the amount you would carry in a physical wallet. Cold storage is for the amount you would put in a safe. Splitting across both is normal rather than paranoid.
Backing up: the part most people get wrong
A backup is the only thing standing between a lost device and a permanent loss. The wallet backup guide covers both account types in full.
For custodial accounts the work is small: a unique password in a manager such as Bitwarden, and two-factor authentication through an app rather than SMS. SMS codes can be intercepted through SIM swapping, which is a well-practised attack rather than a theoretical one.
For non-custodial wallets the work is the recovery phrase, and a few specifics matter more than the general advice.
- A photo of the phrase in your camera roll is in a cloud backup within minutes. So is a note in any app that syncs.
- Paper survives theft but not fire or water. Metal backup plates exist for exactly that reason.
- Two copies in two physical locations removes the single point of failure that one piece of paper is.
If the phrase itself is unfamiliar, what a seed phrase is and how to keep it safe covers it from the beginning.
How scams actually reach you
My guide to spotting crypto scams breaks these down in detail. The recurring patterns are worth knowing by shape rather than by name.
- Exit scams — a project or platform runs normally until it stops and the funds leave. Bitconnect is the reference case.
- Phishing — a message or site imitating something you already trust, aiming for your recovery phrase or a signature.
- Fake support — someone who answers your public complaint faster than the company does.
- Investment schemes — returns paid out of new deposits and presented as trading profit.
- Mining and cloud hashpower contracts — payment for hardware or capacity that does not exist.
- Malware — clipboard hijackers that quietly swap a pasted wallet address for the attacker’s.
The common thread is urgency combined with a request for an address or a phrase.
No legitimate support process will ever ask for your recovery phrase. Not once, not partially, not to verify your identity. That single rule closes most of the attacks above.
Paper wallets: mostly a historical answer
A paper wallet is a printed public and private key pair, generated offline. For a period it was the standard way to hold Bitcoin long term.
It removes online exposure completely and introduces two problems in exchange: the paper is a single point of failure with no recovery path, and generating one safely takes more technical care than most instructions admit.
Hardware wallets have largely replaced them. The paper wallet guide is still worth reading if you hold one, mainly to understand how to move off it without losing anything.
Crypto security FAQ
It keeps your private key away from your computer, which is the single largest improvement most people can make.
It does not stop you approving a transaction you should not have approved, and it does nothing for a recovery phrase you stored badly. The device is one layer of three.
Use an authenticator app, or a hardware key where the platform supports one.
SMS is better than no second factor at all, but SIM swapping is common enough that it should not be the thing guarding an account with real money in it.
If you still have access to the wallet, move the funds to a new wallet with a phrase you have backed up properly, and treat the old one as compromised.
If access is already gone, there is no recovery path and no support line that can help. That asymmetry is the entire argument for backups.
For small amounts, and for people new to this, in practice it often is. A reputable exchange handles security better than someone managing their own keys for the first week, and a forgotten password is recoverable there.
The trade-off is that you are exposed to the platform itself, which is a real risk rather than a theoretical one. The usual compromise is to self-custody the amount you would be genuinely upset to lose and leave the rest where it is convenient.
It protects your connection on untrusted networks, which is worth having. It does nothing for your keys and nothing for on-chain privacy, since blockchain transactions are public regardless of how you connected.
I cover what VPNs do and do not do in the crypto tools hub.
The bottom line
In order, and it is a short list.
Decide what you are holding yourself and what you are comfortable leaving with a platform. Those are different risks, not different amounts of the same risk.
Back up the recovery phrase for anything you hold yourself, on something that survives water, in two places.
Switch two-factor authentication off SMS wherever an app will do.
And treat any message that pairs urgency with a request for a phrase or an address as hostile by default. The survey data is clear that this, not cryptography, is where the money goes.
Latest News
