Crypto security: the losses you cannot undo, and how to avoid them
Crypto transactions are final — there is no chargeback and no support line that can reverse a transfer. Keep savings in self-custody with the recovery phrase offline, never type that phrase into anything but the wallet device, use app-based or hardware two-factor authentication, and revoke old token approvals periodically.
Why security deserves more attention than strategy
A bad trade costs you a percentage. A custody failure costs you everything in the wallet, permanently. Transactions are final, there is no chargeback, and no authority can reverse a transfer once confirmed.
That asymmetry should determine where your attention goes, and for most people it does not. People spend hours choosing assets and minutes deciding how to hold them, which is precisely backwards given that the second decision carries the irreversible risk.
It is also the more tractable problem. Market outcomes are uncertain; security outcomes are mostly a function of following a short list of rules that do not change.
Custody: what belongs where
Coins on an exchange are an entry in that company’s database and a claim on a business that may fail. That is acceptable for the amount you are actively trading, and has repeatedly proven unacceptable for savings — several large, apparently reputable venues have failed with customer funds inside.
A reasonable split: keep what you trade on the venue, move the rest to a wallet where you hold the keys. A hardware wallet keeps the private key on a device that never exposes it, so a compromised computer can display a wrong transaction but cannot extract the key.
The device is not the secret, though — the recovery phrase is. A hardware wallet whose phrase is photographed and sitting in cloud backup provides roughly the security of a hot wallet. Write it on paper or metal, store it physically, and never photograph it.
The scam patterns that never change
The surface details change constantly; the structures do not. Guaranteed returns — no legitimate investment guarantees a return, and any fixed daily percentage is either paying early participants with later participants’ money or is fictional. Urgency — genuine opportunities do not expire in an hour; artificial deadlines exist to stop you checking.
Requests for your recovery phrase or private key, which have no legitimate context whatsoever. Upfront payment to release funds, which is the defining mechanic of the withdrawal scam — being told you must pay a tax, fee or gas cost to unlock a withdrawal that then never arrives. And unsolicited contact: nobody genuine finds you first to offer you money.
The most financially devastating version is not technical at all. It builds a relationship over weeks, establishes trust, then introduces a platform showing fabricated profits. Small withdrawals are allowed early to prove legitimacy; larger ones trigger fees that never end. The tell is structural rather than emotional — you were introduced to the platform rather than finding it, the profits exist only inside it, and every withdrawal produces a new cost.
Token approvals: the quiet drain
Most drained wallets were not hacked. The owner signed an approval — permission for a contract to spend a token from their wallet — and the drain happened later, sometimes months later.
Many interfaces request unlimited approval by default because it saves the user from approving again. That permission persists indefinitely, does not expire when you stop using the site, and does not care whether the contract still behaves as it did. A protocol compromised later can use an old approval at any time.
Because the drain can come long after the signature, the connection is invisible and people conclude they were hacked. Set a spending cap rather than unlimited where the interface allows it, revoke old approvals periodically with a revocation tool, and use a separate wallet with limited funds for anything experimental.
Two-factor authentication, and why SMS is the weak option
SMS codes are vulnerable to SIM-swap attacks, where someone persuades a mobile carrier to move your number to a device they control and then receives your codes. This is not theoretical — it is a repeatedly successful attack aimed specifically at crypto holders.
An authenticator app generates codes on your device with no network involved, so there is nothing for a carrier to be tricked into transferring. A hardware security key is stronger still because it verifies the site’s identity, which means a phishing page cannot use a key intended for the real one.
Save the backup codes offline when you enable it, and remove SMS as a fallback where the service allows — leaving it enabled means your security is still only as good as the weakest method. And remember that no second factor protects a recovery phrase you typed into a phishing site; two-factor protects accounts, not keys.
Never miss a move in security
Choose a level worth acting on and let the server do the watching — free to start, delivered by push, Telegram or email, quiet overnight if you want it.
- Fires about a second after the price hits
- Runs on our servers, so it reaches you with the app closed
- Free for 3 alerts — no card, no account
Download the app for real-time notifications
Every guide in security
Keeping your coins and your accounts safe.
How to Store Cosmos (ATOM) Safely
Buying ATOM is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store Enjin Coin (ENJ) Safely
Buying ENJ is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store yearn.finance (YFI) Safely
Buying YFI is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Polygon (MATIC) Safely
Buying MATIC is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the pa…
How to Store Jupiter (JUP) Safely
Buying JUP is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Neo (NEO) Safely
Buying NEO is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Litecoin (LTC) Safely
Buying LTC is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Uniswap (UNI) Safely
Buying UNI is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Compound (COMP) Safely
Buying COMP is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store NEAR Protocol (NEAR) Safely
Buying NEAR is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
Exchange API Key Leaked? How Accounts Get Drained
A leaked exchange API key can empty an account with no withdrawal, through trades in thin markets. How it works, what to…
How to Store Synthetix (SNX) Safely
Buying SNX is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Chainlink (LINK) Safely
Buying LINK is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store Theta Network (THETA) Safely
Buying THETA is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the pa…
How to Store Gala (GALA) Safely
Buying GALA is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store Filecoin (FIL) Safely
Buying FIL is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Flow (FLOW) Safely
Buying FLOW is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store Maker (MKR) Safely
Buying MKR is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store ApeCoin (APE) Safely
Buying APE is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Algorand (ALGO) Safely
Buying ALGO is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
How to Store Render (RENDER) Safely
Buying RENDER is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the p…
How to Store BNB (BNB) Safely
Buying BNB is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store GMX (GMX) Safely
Buying GMX is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Solana (SOL) Safely
Buying SOL is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the part…
How to Store Oasis Network (ROSE) Safely
Buying ROSE is the easy part. Holding it through a full market cycle without losing it to a mistake or a scam is the par…
Two-Factor Authentication for Crypto: Not All Methods Are Equal
Enabling two-factor authentication is the standard advice. Which kind you enable matters more than the advice suggests.…
How to Spot a Rug Pull Before It Happens
The warning signs are visible before the exit, and most of them can be checked in under ten minutes without technical sk…
Which Permissions Should a Crypto App Actually Need?
A price or alert app needs notifications and a network connection. What else crypto apps ask for on your phone, exchange…
Token Approvals: The Quiet Way Wallets Get Drained
Most drained wallets were not hacked: the owner signed an approval and the drain came later. How approvals and permits w…
Sent Crypto to the Wrong Network? What Can and Cannot Be Recovered
Some of these are recoverable and some are permanently gone, and the difference comes down to whether anyone controls th…
Hot Wallet vs Cold Wallet: Which Do You Actually Need?
The distinction is simply whether the private key touches an internet-connected device. Everything else follows from tha…
How to Check Whether a Crypto App Is Real Before You Install It
Fake apps reach both official stores regularly. Four checks take under a minute and eliminate nearly all of them.…
What to Do If Your Exchange Is Hacked or Freezes Withdrawals
Exchange hacked, withdrawals frozen, or your own account drained? The steps differ. What to do in the first hour, what t…
How to Spot a Crypto Scam: The Patterns That Never Change
The surface details change constantly; the underlying structures do not. Learn the five structures and you will recognis…
What "Read-Only" Crypto Tracking Means (And Why It Matters)
You can monitor any wallet on earth using only its public address. Understanding why that is safe — and why anything ask…
Crypto Security Checklist: 12 Things to Do This Week
Most crypto losses are not sophisticated hacks. They are preventable mistakes, and this list covers the ones that actual…
How to Spot a Crypto Scam: The Patterns Behind Every One
Scams change costume constantly but reuse the same handful of psychological levers. Learn the levers and the costume sto…
Frequently asked questions
Is it safe to share my wallet address?
Yes. A public address is a destination — it is what you give someone so they can pay you, and it is visible on a public blockchain by design. Knowing it lets anyone read balances; it does not let them move anything, because spending requires the private key.
What is the single most important security rule?
Never type your recovery phrase into anything other than the wallet device itself. No exchange, tracker, tax tool, airdrop or support agent has any legitimate reason to ask for it, which is what makes the rule absolute and therefore useful.
Should I use SMS two-factor authentication?
Only if nothing better is available. SMS is defeated by SIM-swap attacks, which target crypto holders specifically. An authenticator app or a hardware security key is materially stronger.
My wallet was drained but I never shared my keys — how?
Most likely an old token approval. Granting a contract permission to spend a token persists indefinitely, so a protocol compromised months later can still use it. Revoke unused approvals periodically.