Main points
- Never Share Seed Phrase — No legitimate service will EVER ask for it. Period
- Use App-Based 2FA — SMS can be SIM-swapped. Use Google Authenticator or YubiKey
- Hardware Wallets — Required for significant holdings. Ledger or Trezor
- Separate Email — Use a unique email only for crypto exchanges
- Verify Everything — Check URLs, contract addresses, sender addresses. Trust no one
- Metal Seed Backup — Paper burns. Metal survives fire and flood
Know Your Enemy: Common Attack Vectors
Before you can defend, you need to understand how hackers steal crypto:
Contrarian Take
Everyone's worried about Meta's metaverse spending. They should be. But what they miss is that Meta's AI advertising engine is so far ahead, they can burn $10B yearly on moonshots and still dominate.
Security Level Framework
Choose your security level based on your holdings. Higher value = higher security:
- Strong, unique password (16+ chars)
- App-based 2FA on exchange (NOT SMS)
- Write down seed phrase on paper
- Store paper in safe location
- Keep device/OS updated
- All of Level 1 +
- Hardware wallet (Ledger Nano)
- Dedicated email for crypto
- Metal seed phrase backup
- Withdrawal address whitelist
- Password manager (Bitwarden)
- All of Level 2 +
- YubiKey hardware 2FA
- Dedicated device for crypto
- Seed phrase in bank safe deposit
- Multiple hardware wallet backups
- Different wallets for different chains
- All of Level 3 +
- Multisig wallet (2-of-3)
- Geographically distributed keys
- Passphrase (25th word)
- Estate planning for crypto
- Operational security (don't talk about holdings)
Seed Phrase: Your Master Key
Hardware Wallet Guide
If you have more than $1,000 in crypto, a hardware wallet is not optional — it's essential.
- Bluetooth connectivity
- Large screen
- 5000+ coins supported
- Battery lasts weeks
- Great mobile app
- CC EAL5+ certified chip
- Touchscreen interface
- Fully open source
- 1000+ coins supported
- Shamir backup (split seed)
- No closed-source chip
- Strong community
- Most affordable
- USB-C connectivity
- 5000+ coins supported
- Same secure chip as Nano X
- No Bluetooth/battery
- Best for beginners
ONLY Buy Direct from Manufacturer
Never buy hardware wallets from Amazon, eBay, or third parties. Devices can be pre-compromised. Order only from ledger.com or trezor.io. Check tamper-evident packaging.
Two-Factor Authentication (2FA)
2FA is your second line of defense. But not all 2FA is equal:
❌ SMS 2FA
DON'T USE FOR CRYPTO
- SIM swap attacks are easy
- Social engineering carriers works
- SS7 network vulnerabilities
- Hackers specifically target crypto users
✓ App-Based 2FA
RECOMMENDED MINIMUM
- Google Authenticator
- Authy (cloud backup)
- Microsoft Authenticator
- Codes generated locally
🔐 Hardware Keys
BEST OPTION
- YubiKey (industry standard)
- Physical device required
- Phishing-resistant
- Impossible to remotely compromise
2FA Backup Rules
- Save backup codes — Store with seed phrase (offline, secure)
- Screenshot QR during setup — Print and store securely
- Use Authy for cloud backup — But adds attack surface
- Have recovery plan — What if you lose phone? Know the process
Scam Prevention Playbook
"Free" Giveaways
"Send 0.1 ETH, get 1 ETH back" — ALWAYS a scam. Elon Musk is not giving away crypto. Neither is anyone else. Ever.
Fake Support
Real support NEVER DMs first. Scammers create fake support accounts. Always reach out through official channels only.
Malicious Airdrops
Random tokens appearing in your wallet may be scams. Interacting with them can drain your wallet. Ignore unsolicited airdrops.
"Guaranteed Returns"
Any promise of guaranteed returns or "risk-free" profits is a scam. Real investments have real risks. No exceptions.
Urgency Pressure
"Act NOW or miss out!" — Legitimate opportunities don't require instant decisions. Urgency is a manipulation tactic.
Fake Websites
uniswap.org.xyz is NOT Uniswap. Check every character. Bookmark official sites. Never click links in DMs or emails.
"In crypto, assume everyone is trying to scam you until proven otherwise. Verify everything. Trust no one with your keys. This paranoia will save you."
— Security Researcher
Your Security Checklist
Complete this checklist to secure your crypto:
- ✓ Enable app-based 2FA on all exchanges (not SMS)
- ✓ Create dedicated email for crypto only
- ✓ Use unique passwords for every exchange
- ✓ Get a hardware wallet if holding >$1,000
- ✓ Backup seed phrase on paper + metal
- ✓ Store backups in multiple secure locations
- ✓ Enable withdrawal whitelist on exchanges
- ✓ Bookmark official sites — never trust links
- ✓ Check contract addresses before approving
- ✓ Review approvals regularly at revoke.cash
In crypto, you are your own bank. Act like it. Security isn't optional — it's everything.