In digital assets, security is not a background feature handled by someone else. Because transfers are irreversible and there is no chargeback process, most losses are not caused by markets — they are caused by a lost backup, a reused password, or a convincing message. The good news is that the defenses are simple, cheap and largely one-time work.

Custodial vs non-custodial: who holds the keys?

Every crypto balance is controlled by a private key. Whoever can use that key can move the funds. The first decision you make is who holds it.

Custodial means a third party — typically a licensed exchange or custodian — holds the keys on your behalf. You log in with an email and password, and the platform executes your instructions.

Non-custodial (self-custody) means you hold the keys yourself, usually in the form of a recovery phrase. No one else can move your funds. No one else can help you recover them either.

You will hear "not your keys, not your coins." It is a fair reminder that a custodial balance is a claim on a company, not direct possession — but it is not the full picture. Self-custody transfers the risk rather than removing it, and that risk lands entirely on your own operational habits. Many people sensibly use both: a regulated platform for trading and fiat access, self-custody for long-term holdings.

Hot vs cold storage

Hot wallets are connected to the internet — browser extensions, mobile apps, desktop software. They are convenient and appropriate for the amounts you actively use. Their weakness is the device: malware, a malicious browser extension or a phishing site can reach them.

Cold storage keeps the private key on a device that never exposes it to the internet. A hardware wallet is the standard approach: the key is generated and stays inside the device, transactions are signed internally, and you physically confirm each one on the device screen. Even on a compromised computer, the key does not leave the hardware.

A common structure is to treat a hot wallet like a physical wallet — small amounts, everyday use — and a hardware wallet like a safe.

Your recovery phrase is the wallet. When you set up a self-custody wallet you receive 12 or 24 words (a "seed phrase" or "mnemonic"). Those words can regenerate every key in the wallet, on any compatible device. Anyone who reads them owns your funds.

Practices that matter:

• Write it on paper or stamp it into metal. Never as a photo, note, screenshot, password manager entry, cloud document or chat message.

• Store copies in two separate physical locations. Fire, flood and moving house account for real losses.

• Test recovery once, with a small amount, before you rely on the backup.

• Never type it into a website, form or "wallet validation" tool. There is no legitimate reason to enter a recovery phrase anywhere except your own wallet software during setup or restore.

• Consider a passphrase (sometimes called the 13th/25th word) for an additional layer — but only if you are certain you will not lose it, because it cannot be recovered.

• Order hardware wallets from the manufacturer directly, and never use a device that arrives with a pre-printed recovery phrase. That is always a scam.

Account security essentials

For a custodial account, these steps prevent the overwhelming majority of takeovers.

Use a unique, long password generated and stored by a password manager. Credential reuse is the single most common cause of account compromise, because breached password lists from unrelated websites are tested against exchanges automatically.

Choose the strongest second factor available. They are not equivalent:

• SMS codes — weakest. Vulnerable to SIM-swap attacks, where an attacker persuades a mobile carrier to move your number to their device. Avoid where an alternative exists.

• Authenticator app (TOTP) — a good default. Codes are generated on your device with no carrier involved. Back up the setup keys when you enroll.

• Hardware security key (FIDO2/U2F, e.g. YubiKey) or a passkey — strongest. The key verifies the site's real domain before responding, so it does not authenticate to a phishing page even if you are fooled. If you hold meaningful balances, this is the upgrade worth making — and register two keys, so losing one does not lock you out.

Turn on withdrawal address whitelisting. Withdrawals are then only possible to addresses you have pre-approved, usually with a cooling-off period before a new address becomes usable. Even if an attacker gets into your account, there is nowhere for the funds to go.

Set an anti-phishing code. This is a personal phrase the platform includes in every genuine email it sends you. An "urgent" email without your code is fake — and this catches even well-crafted forgeries.

Keep the device clean. Update your operating system and browser, install extensions sparingly and only from official stores, avoid pirated software (a frequent carrier of clipboard-hijacking malware that silently swaps a copied wallet address), and use a dedicated email address for financial accounts.

If you use API keys, grant the minimum permissions needed, disable withdrawal permission unless it is genuinely required, restrict keys to specific IP addresses, and rotate them periodically.

The scams that actually catch people

Scams in this industry are not exotic. They rely on urgency, authority and the promise of a fix.

Phishing. Fake versions of exchange or wallet sites, delivered by email, SMS, social media ads or even paid search results at the top of a search page. Defense: reach financial sites only through your own bookmark, never a link in a message, and check the domain character by character before you log in.

Address poisoning. An attacker sends you a tiny or zero-value transaction from an address whose first and last characters match one you use often. Later, you copy an address from your transaction history and send to theirs. Defense: never copy an address from your history. Use your address book or copy from the source each time.

Malicious smart contract approvals. When you connect a wallet to a site, you may be asked to approve a token — permission for a contract to move that token on your behalf. A malicious site requests unlimited approval, then drains the balance later, with no further interaction from you. Signature requests can do the same thing without any visible transaction. Defense: read what you are signing, be suspicious of any request for unlimited spending, decline signatures you do not understand, and periodically review and revoke old approvals using a reputable revocation tool.

Fake customer support. You post a problem publicly and within minutes receive direct messages from "support" on Telegram, X, Discord or WhatsApp. Legitimate support never initiates contact by DM, never asks for your recovery phrase, password or 2FA code, and never asks to install remote-access software such as AnyDesk or TeamViewer. Any of those three requests, from anyone, is conclusive proof of a scam.

"Pig butchering" investment scams. The most costly category by dollar value. Contact begins as a wrong number, a dating app match or a friendly professional connection, and builds trust over weeks with no mention of money. Eventually you are introduced to an "exclusive" trading platform or arbitrage opportunity. Small early withdrawals succeed. The dashboard shows steady gains — the numbers are simply drawn on a screen. When you try to withdraw a large amount, you are told to pay a "tax," "fee" or "unlock deposit" first. There is nothing to withdraw. Defense: never take investment instructions from someone you met online, and treat any platform recommended by a new online acquaintance as fraudulent by default.

Giveaways, impersonation and "recovery" services. No one credible doubles crypto you send them. And after a loss, "fund recovery experts" who ask for an upfront fee are a second scam targeting the same victim.

Universal red flags: guaranteed or fixed returns; time pressure; a request for your recovery phrase, password or 2FA code; a request for remote access; instructions to move funds to a "safe" wallet; a link to a platform you did not find yourself; and a demand to pay a fee before you can withdraw your own money.

Depositing and withdrawing safely

Most transfer losses come from two avoidable mistakes.

1. Choosing the wrong network. The same ticker often exists on several blockchains. USDT, for example, circulates on Ethereum (ERC-20), Tron (TRC-20), BNB Smart Chain (BEP-20), Solana and others. These are separate networks; the token is not interchangeable between them.

The rule: the network you withdraw on must be the network the receiving platform supports for that asset. Read the deposit page of the destination, select the matching network at the source, and check that fees and minimums line up. Sending on an unsupported network usually means the funds are unrecoverable, and where recovery is technically possible it is slow and not guaranteed.

2. Omitting a memo or destination tag. Some networks — XRP (destination tag), Stellar/XLM (memo), TON (comment/memo), Cosmos/ATOM, EOS — use one shared deposit address for many users, and identify the account with a short memo or tag. Send without it, and the funds arrive in the platform's pooled wallet with nothing to indicate they are yours. Recovery is a manual support process at best and impossible at worst. If a deposit page shows a memo or tag field, it is mandatory, not optional.

A short pre-send routine:

• Copy the address from the destination's deposit page; never retype it and never reuse an old one.

• Verify the first four, last four and several middle characters against the source. Clipboard malware and poisoned addresses both defeat a first-and-last check.

• Select the network deliberately. Confirm it matches what the destination expects.

• Enter the memo or tag if one is shown.

• Send a small test amount first for any new address, network or counterparty. Confirm it arrives, then send the rest.

• Expect a delay: funds need network confirmations, and the destination may require several before crediting.

• For a token you have not held before, verify its contract address from an authoritative source. Identical names and logos are trivial to copy.

Security checklist

• Unique password from a password manager

• Hardware security key or passkey enabled, with a backup key registered

• Withdrawal address whitelisting on

• Anti-phishing code set

• Recovery phrase written offline, stored in two locations, never digital

• Recovery tested with a small amount

• Hardware wallet for long-term holdings

• Old token approvals reviewed and revoked

• Site reached only via your own bookmark

• Small test transfer before every first-time send

Disclaimer: This article is provided for general educational and informational purposes only. It is not investment, financial, legal or tax advice, nor a recommendation or solicitation to buy, sell or hold any digital asset. Digital assets are highly volatile; their value can fall as well as rise, and you may lose the entire amount you commit. Third-party products, protocols and tools are named for illustration only and are not endorsed. Security practices reduce but cannot eliminate risk. Availability of products and services varies by jurisdiction and eligibility. Please conduct your own research and consider seeking advice from an independent, licensed professional before making any decision.