Protect your keys Protect your digital assets

Create a unique password of at least 16 characters for every crypto related account.

• Use a reputable password manager to generate and store credentials.
• Never reuse a password across exchanges, email, wallets, or cloud storage.
• Protect the password manager itself with strong authentication and a tested recovery method.

Add a second form of authentication wherever it’s available.

• Prefer an authenticator app, hardware security key, or passkey over SMS.
• Store backup codes offline in a secure location.
• Review recovery settings so an attacker can’t bypass your second factor through email.

Keep valuable private keys offline with a reputable hardware wallet purchased from an official source.

• Initialize the device yourself and verify instructions through the manufacturer’s official website.
• Confirm transaction details on the hardware wallet screen before approving.
• Keep the device, PIN, and recovery phrase separate.
• Install firmware updates only through official software.

Your recovery phrase can restore and control the wallet. Treat it as the asset itself.

• Write it down or stamp it into durable metal. Don’t photograph or screenshot it.
• Keep protected copies in separate fire and water resistant locations.
• Test the recovery process privately before relying on the backup.
• Create clear inheritance instructions without exposing the phrase prematurely.

Separate holdings by purpose so one compromised wallet doesn’t expose everything.

• Use an offline vault for long term holdings that rarely signs transactions.
• Use a separate wallet for staking.
• Use a low balance wallet for DeFi, airdrops, and unfamiliar smart contract interactions.

Security patches matter. Keep wallet software, operating systems, browsers, and firmware current.

• Enable trusted automatic updates where appropriate.
• Download updates only from official sources or from within verified applications.
• Never install a wallet update sent through direct messages, email, or advertisements.

For meaningful holdings, consider a device used only for crypto activity.

• Avoid public wireless networks, unnecessary software, casual browsing, and email on that device.
• Enable disk encryption, firewall protection, screen locking, and malware protection.
• Clear the clipboard after copying addresses and keep wallets locked when not in use.

Protect the network and accounts surrounding your wallet.

• Change default router credentials and keep router firmware updated.
• Use a trusted VPN when your normal network can’t be trusted.
• Secure the email account connected to exchanges and wallet services with its own strong authentication.

Early detection can limit damage.

• Enable transaction and login alerts where available.
• Review wallet balances, connected applications, token approvals, and exchange activity regularly.
• Use allowlists and withdrawal delays when a platform supports them.

Assume unsolicited crypto messages, urgent support requests, and unexpected links may be hostile.

• Type or bookmark official URLs and check the domain before connecting a wallet.
• Verify the recipient address and transaction details character by character. Send a small test transaction when appropriate.
• Never trust direct message support, and never install financial apps from ads or unofficial links.
• Limit public information that can connect your identity with your holdings.