How to Protect Your Crypto: Security Guide
Self-custody means you are responsible for your own security. This guide covers how to store your seed phrase, when to use a hardware wallet, how to spot scams and phishing, and what to do if something goes wrong.
Why Crypto Security Matters
In traditional finance, a bank holds your money. If your card is stolen, you call the bank and the charges are reversed. Crypto works differently. When you hold crypto in a self-custodial wallet, you are the bank. There is no fraud department, no chargeback and no password reset. If someone gets your private keys, the funds are gone for good.
The scale of theft is large. According to the Chainalysis Crypto Crime Report, about $3.8 billion was stolen in crypto hacks in 2022, the worst year on record at the time, and about $1.7 billion in 2023. The Ronin bridge hack of March 2022 (about $625 million) and the Wormhole exploit of February 2022 (about $325 million) showed that even well-funded projects with professional teams can be breached. Chainalysis publishes updated yearly figures (see Sources).
Those figures cover protocol hacks. Individual losses from phishing, seed phrase theft, SIM swaps and social engineering come on top; the FBI Internet Crime Complaint Center (IC3) reports yearly totals for fraud complaints involving crypto (see Sources). The good news is that most attacks on individuals rely on a handful of mistakes, and this guide shows how to avoid them.
Phishing Attacks
Fake websites, emails and direct messages that trick you into revealing your seed phrase or signing a malicious transaction.
Smart Contract Exploits
Bugs in DeFi protocol code that let attackers drain funds. Bridges and lending protocols have been the most targeted.
Social Engineering
Impersonation, fake support agents, romance and investment scams that exploit trust rather than code.
Securing Your Wallet
Your wallet security starts with how you handle your seed phrase (also called a recovery phrase or mnemonic). This 12 or 24 word phrase is the master key to every account derived from it. Anyone who obtains it can empty every token on every chain linked to that wallet. There is no second factor, no verification and no recovery once it leaks.
Seed Phrase Storage: The Golden Rule
Never store your seed phrase digitally. Not in a notes app, not in a screenshot, not in cloud storage, not in an email draft, not in a password manager. Anything digital can be reached remotely through malware, a cloud breach or a compromised account. Password managers and cloud services have suffered real breaches in which encrypted vaults were stolen and attacked offline afterwards.
Write the seed phrase on paper and keep it somewhere secure. For long-term storage, use a metal backup (stamped or engraved plates), which survives fire and water. Consider keeping two copies in separate secure places, such as a home safe and a bank safety deposit box.
Never share your seed phrase with anyone. No legitimate service, support agent or developer will ever ask for it. If someone asks for it, it is a scam, every time.
Strong Passwords & Password Management
Use a unique, long password for every crypto-related account (exchanges, email, wallet browser extensions). Length matters more than special characters: NIST guidance favours long passphrases over complex short ones (see Sources). Never reuse a password. When one service is breached, attackers try the leaked credentials on every exchange.
Use a reputable password manager (such as 1Password or Bitwarden) to generate and store unique passwords. Protect the manager itself with a strong master password and a hardware key. Your email account matters most of all: whoever controls your email can reset the passwords on your exchange accounts.
Two-Factor Authentication (2FA)
Enable 2FA on every account that supports it. Not all 2FA methods are equal. From strongest to weakest:
Hardware security keys (FIDO2 or WebAuthn keys such as YubiKey or Google Titan): physical devices that must be plugged in or tapped. They resist phishing, SIM swaps and remote attacks because the key only answers the real domain.
Authenticator apps (Google Authenticator, Authy and similar): time-based codes generated on your phone. Much better than SMS, but a code can still be phished, and malware on the phone can read it.
SMS-based 2FA: the weakest option. It is vulnerable to SIM-swap attacks, where an attacker convinces your mobile carrier to move your number to their SIM, and NIST classes SMS as a restricted factor for this reason. Avoid SMS 2FA for crypto accounts.
If you use an authenticator app, save the recovery codes offline. Lose the phone without them and you may be locked out of your accounts for good.
Hardware Wallets: Your Best Defense
A hardware wallet is a physical device that stores your private keys offline, isolated from your computer and the internet. Even if your computer is infected, the keys never leave the device. Every transaction must be confirmed on the device itself, so an attacker cannot sign remotely.
A hardware wallet is the single most effective step for protecting cryptocurrency. If you hold more than you could afford to lose, treat it as essential rather than optional.
Ledger
Ledger devices use a certified secure element chip, the same kind of chip found in bank cards and passports, to protect private keys. They pair with MetaMask, Rabby and most DeFi applications, and Ledger Live manages accounts and firmware. Current models, supported assets and prices are on ledger.com (see Sources).
Important: buy directly from the manufacturer or an authorised reseller listed on its site, never second-hand. Tampered devices shipped with a pre-written seed phrase have been used to steal funds. A genuine device arrives with no seed phrase; you generate it yourself during setup.
Trezor
Trezor takes an open-source approach: its firmware and hardware designs are published, so the security community can check that the device does what it claims. Trezor devices pair with MetaMask and popular DeFi front ends. Current models and supported assets are on trezor.io (see Sources).
Both Trezor and Ledger support a passphrase (sometimes called the "25th word"). It creates a hidden wallet that cannot be reached with the seed phrase alone, which adds a strong extra layer for high-value holdings. Lose the passphrase and that wallet is gone, so back it up as carefully as the seed phrase.
How to Set Up a Hardware Wallet
Buy directly from the manufacturer (ledger.com or trezor.io). Check the packaging on arrival and follow the manufacturer's genuine-device check during setup.
Initialise the device and write the seed phrase on paper (or stamp it on metal). Check each word. The device asks you to confirm the words before it finishes.
Set a PIN on the device. It protects against physical access if the device is stolen. Ledger devices reset after three wrong attempts; Trezor devices add a growing delay after each wrong attempt (see the manufacturers' docs in Sources).
Connect the device to MetaMask or your preferred wallet interface. Send a small test amount first and confirm you can send it back out before moving larger holdings.
Keep the seed phrase backup in a different physical place from the device. If both are in the same drawer during a fire or a burglary, you lose both.
Secure Your Stablecoins While Earning Yield
Once your security basics are in place, put your USDC to work with Coinstancy. Earn 7.50% APY on USDC with Dollar Savings. Interest accrues every second and is automatically reinvested. No lock-up period, withdraw anytime.
Earn 7.50% APY on USDCAvoiding Scams & Phishing
Phishing is the most common way individuals lose crypto. Unlike a protocol hack, which exploits code, phishing exploits you. Attackers build convincing fake websites, impersonate project staff, and use urgency and fear to get you to hand over your seed phrase or sign a malicious transaction. Here are the usual tactics and how to counter them.
Fake Websites
Scammers build near-identical copies of popular DeFi sites (Uniswap, OpenSea, MetaMask) on domains that look almost right. Common tricks: swapping characters (un1swap), adding words (app-uniswap.org) or using a different top-level domain (.io instead of .org). Fake airdrop pages imitating well-known protocols have drained wallets by getting visitors to sign approval transactions.
Defence: bookmark the official URL of every protocol you use. Do not follow links from Discord, Telegram, social media ads or sponsored search results. Check the domain in the address bar before you connect a wallet or sign anything.
Discord & Telegram DMs
If someone messages you on Discord or Telegram offering "support", a "giveaway" or an "airdrop", it is a scam. Legitimate projects do not start support conversations by direct message. Scammers copy the profile pictures and usernames of admins, moderators and founders. Official project channels have also been hijacked to post fake mint links, so even a message in the right server deserves a second look.
Defence: disable direct messages from server members in your Discord privacy settings. Do not click links sent by direct message. If someone claims to be support, verify through the project's official channel or website.
Airdrop Scams & Dusting Attacks
Scammers send tokens you never asked for that appear to have value. When you try to swap or sell them, the token's smart contract may take your tokens through a hidden approval, or the token name points you to a phishing site. Some are built to be unsellable: they show a high value in explorers but every sell fails.
Defence: ignore unexpected tokens. Do not interact with them, do not try to sell them, and do not visit any website in the token name or description. If a token appeared without you buying it, treat it as malicious and hide it.
Approval Phishing
This is the most technical common attack. A malicious site asks you to sign what looks like a normal transaction, but you are actually granting a smart contract permission to spend an unlimited amount of your tokens. The attacker then calls the contract and empties your wallet whenever they like. Losses from approval phishing and wallet drainers run to hundreds of millions of dollars a year according to Chainalysis (see Sources).
Defence: read what you are signing. If a site asks for an unlimited token approval, edit it down to the amount you need. Use a wallet or extension that simulates transactions before you sign, such as Rabby or MetaMask's built-in transaction insights, and stop if the preview shows an unexpected transfer or approval.
Smart Contract Safety
Every time you use a DeFi protocol, you trust a smart contract with your funds. Once you approve a contract, it can move your tokens without asking again. Managing those permissions is a core part of crypto security.
Check & Revoke Token Approvals
Every DeFi action that spends your tokens (swapping, depositing, staking) needs a token approval. Over time a wallet collects dozens of them, each one a contract allowed to move your tokens. If any of those contracts is exploited or was malicious from the start, your funds are exposed.
Use revoke.cash to review approvals across chains. Connect your wallet, go through each active approval and revoke the ones you no longer use. Make it a monthly habit. Each revocation costs a small gas fee and removes one way in. Etherscan's Token Approval Checker does the same for Ethereum mainnet (see Sources).
Limit Token Approval Amounts
Many DeFi front ends request an unlimited approval by default. That lets the contract spend your entire balance of that token at any time. Approve only the amount you intend to use instead. MetaMask lets you edit the approval amount before you confirm (see the MetaMask support docs in Sources).
You will need to approve again next time, and each approval costs gas, but the trade-off is worth it. In December 2021, the Badger DAO front end was compromised: users who had granted approvals to the injected contract had their funds drained. Open-ended approvals are a standing liability.
Verify Contracts on Block Explorers
Before using a new protocol, look up the contract address on Etherscan (or the explorer for that chain). Legitimate contracts have verified source code, so you can read what is deployed. Unverified code is a red flag. Check that the address matches the one in the project's official documentation.
Look for proxy patterns (upgradeable contracts). They are common in DeFi but add risk because the team can change the logic. Check whether upgrades sit behind a multisig or a timelock, which means changes need several signatures and a waiting period.
DeFi Security Checklist
Before depositing into any DeFi protocol, run through this checklist. Looking legitimate is not the same as being safe. Rug pulls, badly written code and economic exploits can all end in total loss. The due diligence is yours to do.
| Check | What to Look For | Risk Level if Missing |
|---|---|---|
| Security Audits | At least one audit by a recognised firm (for example Trail of Bits, OpenZeppelin, Spearbit or Cantina). Read the report and check that the findings were fixed. | Critical |
| Total Value Locked (TVL) | Higher TVL usually means code that has been tested with real money for longer. Be careful with protocols that hold very little. Check TVL history on DefiLlama. | High |
| Team & Track Record | A public team with verifiable identities. Anonymous teams are higher risk. Look at their prior projects and reputation. | High |
| Time in Market | A protocol live for more than a year without incident is lower risk. One launched a few weeks ago carries much higher risk. | High |
| Open-Source Code | Verified source code on the block explorer. Unverified contracts can hide backdoors or fee mechanisms. | Critical |
| Oracle Security | Uses reliable price oracles (Chainlink, Pyth). Protocols that rely on a single thin on-chain price source are exposed to price manipulation. | Critical |
| Start Small | Deposit a small test amount first. Wait a few days. Check that you can withdraw before committing more. | Best Practice |
Exchange Security
Centralized exchanges (Coinbase, Kraken, Binance) are convenient for buying, selling and trading. But, as the saying goes, "not your keys, not your crypto". Funds on an exchange depend on that company's security and solvency. Mt. Gox (hacked, 2014), QuadrigaCX (collapsed in 2019 after its founder died holding sole access to the wallets) and FTX (bankrupt in November 2022 with customer funds missing) are reminders of that risk.
If you keep funds on an exchange for trading, harden the account with these measures.
Enable Hardware Key 2FA
Use a FIDO2 or WebAuthn hardware key (YubiKey, Google Titan) for login and withdrawal confirmation. It removes the SIM-swap and code-phishing risks. Most major exchanges support hardware keys; check your exchange's security settings.
Withdrawal Whitelist
Enable address whitelisting so withdrawals can only go to addresses you approved in advance. Most exchanges apply a waiting period before a new address becomes active, which gives you time to react if your account is compromised.
Anti-Phishing Code
Set up an anti-phishing code where the exchange offers one. Every genuine email from the exchange then includes your code. An email without it is a phishing attempt.
Minimize Exchange Holdings
Keep on the exchange only what you need for active trading. Move long-term holdings to a hardware wallet. Treat exchanges as on-ramps and off-ramps, not storage.
What to Do If You Are Hacked
If you suspect your wallet is compromised, speed matters. The attacker may be draining it as you read. Follow these steps in order.
Revoke All Token Approvals Immediately
Go to revoke.cash, connect the wallet and revoke every active approval, starting with the tokens worth the most. This stops drains that rely on approvals. If the seed phrase itself leaked, skip straight to step 2: the attacker does not need approvals.
Transfer Remaining Funds to a Safe Wallet
Create a new wallet on a clean device (ideally a hardware wallet). Move everything left in the compromised wallet to the new one. If the seed phrase leaked, every address derived from it is compromised, on every chain.
Secure Your Accounts
Change the passwords on your email, exchange accounts and any service linked to the wallet. If you suspect malware, do not use that computer for any crypto account until it has been wiped and reinstalled.
Report & Document
File a report with the police, or with the FBI Internet Crime Complaint Center (IC3) in the United States (see Sources); you will need it for any legal action. Keep the transaction hashes and the attacker's addresses. If the funds went to a centralized exchange, contact that exchange's support or compliance team at once: it may be able to freeze the account.
Blockchain Forensics
For a large loss, consider a blockchain analytics or investigation firm. They can trace stolen funds across chains, and some victims have recovered assets through legal action once the funds reached an identifiable exchange account. Be wary of anyone who contacts you promising recovery for an upfront fee: recovery scams target people who have just been robbed.
Security-First Yield on USDC
Earn 7.50% APY on USDC with Coinstancy Dollar Savings. Savings deposits first enter a multisignature wallet managed by Coinstancy’s team, then are allocated to the relevant on-chain strategy. Interest accrues every second and is automatically reinvested. No lock-up, withdraw anytime.
Start Earning on CoinstancyFrequently Asked Questions
What is the safest way to store cryptocurrency?
Can stolen crypto be recovered?
Is it safe to keep crypto on an exchange?
What should I do if I clicked a phishing link?
What is a token approval and why is it dangerous?
Is two-factor authentication enough to protect my crypto?
Continue Learning
Explore more guides on wallets, smart contracts, and DeFi fundamentals.
How to Use MetaMask
Set up MetaMask, connect to DeFi apps, and manage your tokens securely with this step-by-step guide.
Read GuideWhat is a Smart Contract?
Understand how smart contracts work, why they matter for DeFi, and how to interact with them safely.
Read GuideWhat is APY in Crypto?
Learn how APY works in DeFi, the difference between APR and APY, and how compounding grows your returns.
Read GuideProtect Your Crypto and Grow It
Now that your security fundamentals are in place, put your USDC to work. Earn 7.50% APY on USDC with Coinstancy Dollar Savings. Interest accrues every second and is automatically reinvested. No lock-up period, withdraw anytime.
Start Earning on CoinstancySources and further reading
The figures and claims on this page rest on the documents below. Time-sensitive figures (rates, yields, fees, market data) move: check the live value at the source before acting on it.
- Ethereum.org, Security and scam preventionethereum.org
Seed phrase handling, hardware wallets, common scam patterns and how to check what you sign.
- Ethereum.org, Walletsethereum.org
What a self-custodial wallet is and how private keys and recovery phrases work.
- Ledger Supportsupport.ledger.com
Device setup, the secure element, PIN behaviour after wrong attempts, passphrase and buying only from official channels.
- Trezor Learntrezor.io
Open-source firmware, device setup, PIN protection and the passphrase (hidden wallet) feature.
- MetaMask Supportsupport.metamask.io
Editing token approval amounts, hardware wallet pairing and phishing warnings in MetaMask.
- Chainalysis, Crypto Crime Reportchainalysis.com
Yearly figures on funds stolen in hacks, including the 2022 total of about $3.8 billion and the 2023 total of about $1.7 billion.
- FBI Internet Crime Complaint Center (IC3)ic3.gov
Yearly reports on cryptocurrency fraud losses reported by the public, and where US victims file a complaint.
- NIST SP 800-63B, Digital Identity Guidelinespages.nist.gov
Password length over complexity, and the weakness of SMS as a second factor.
Last reviewed: September 2026. External links open in a new tab; Coinstancy is not responsible for their content.
Stay Secure, Earn Confidently
With strong security practices in place, earn 7.50% APY on USDC with Coinstancy Dollar Savings. Interest accrues every second and is automatically reinvested, and you can withdraw anytime.