Crypto gives you something traditional finance rarely does: direct control over your own money. That freedom comes with responsibility, because most crypto transactions cannot be reversed and there is no bank fraud department to call when something goes wrong. This guide brings together everything you need to know about crypto security, from locking down your exchange account to handling seed phrases and responding fast if you are ever hacked.
In this guide:
- The most common threats facing crypto holders today
- How to secure your exchange account with strong passwords and the right 2FA
- Choosing between custodial, self-custody, hot and cold wallets
- Seed phrase do’s and don’ts
- Safe buying, DeFi and stablecoin risks
- A red-flag checklist for spotting scams
- A step-by-step plan for what to do if you are hacked
- A 10-point crypto security checklist you can use today
The Crypto Threat Landscape
Attackers rarely “hack the blockchain.” Bitcoin and Ethereum have proven remarkably resilient at the protocol level. Instead, criminals target the weakest link in the chain: people, devices and accounts.
Understanding how these attacks work is the foundation of good crypto security. Once you recognize the patterns, most of them become easy to avoid.
Phishing
Phishing is still the number one way people lose crypto. You receive an email, text or direct message that looks like it comes from your exchange or wallet provider, urging you to “verify your account” or “claim a reward.” The link leads to a convincing copy of the real site that captures your login details or seed phrase.
- Phishing sites often use look-alike domains with swapped letters or extra words.
- Sponsored search ads can point to fake sites, so bookmark the real URLs you use.
- Urgency (“your account will be suspended in 24 hours”) is a classic manipulation tactic.
SIM Swaps
In a SIM swap, a criminal convinces your mobile carrier to move your phone number to a SIM card they control. From that moment, every SMS code and password reset text goes to them.
SIM swaps are why SMS-based two-factor authentication is the weakest option. Ask your carrier about a port-out PIN or account lock, and avoid linking your crypto accounts to SMS whenever a stronger method exists.
Fake Apps and Browser Extensions
Counterfeit wallet apps and browser extensions sometimes appear in official app stores before they are removed. They look identical to the real product but send your keys or funds straight to the attacker.
- Download wallets only from links on the provider’s official website.
- Check the developer name, review count and install history before installing.
- Be wary of “updates” pushed through pop-ups or messages rather than the app store.
Social Engineering
Social engineering covers any scheme that manipulates you into helping the attacker. Common versions include fake support agents in Telegram or Discord, impersonated celebrities promoting giveaways, and long-running romance or “pig butchering” scams that build trust before pitching a fake investment platform.
Remember: legitimate support teams will never ask for your password, 2FA codes, seed phrase or private keys. Bithoex.com will never ask you for any of these, under any circumstances.
Address Poisoning
Address poisoning is a sneaky newer tactic. An attacker sends you a tiny or zero-value transaction from a wallet address that closely matches one you use often, with the same first and last few characters. They hope you will later copy the wrong address from your transaction history.
The defense is simple: never copy addresses from your history. Use a saved address book or withdrawal whitelist, and verify the full address, not just the beginning and end.
Malicious Token Approvals
On networks like Ethereum, decentralized apps ask you to “approve” them to spend your tokens. A malicious site can request unlimited approval and then drain those tokens later, even days after you visited.
- Read every wallet signing prompt carefully before you confirm.
- Prefer limited approvals that match the amount you actually intend to use.
- Periodically review and revoke old approvals using a reputable approval-checker tool.
Account Security: Your First Line of Defense
If you buy or trade on a centralized exchange, your account login is effectively the front door to your funds. Strengthening it takes about 20 minutes and eliminates a huge share of real-world attacks. For a deeper walkthrough, see our guide to 2FA and other exchange security essentials.
Strong, Unique Passwords
Password reuse is dangerous because data breaches are common. If one site leaks your email and password, attackers will try the same combination on crypto exchanges within hours.
- Use a unique password for every crypto account and for the email tied to it.
- Aim for long passphrases of 14 characters or more rather than short complex strings.
- Never store passwords in plain text notes, screenshots or unencrypted files.
Use a Password Manager
A reputable password manager generates and stores strong, unique passwords so you only need to remember one master password. Many also warn you when a site’s domain does not match the saved login, which is a useful extra layer against phishing.
Protect the password manager itself with a strong master passphrase and its own two-factor authentication.
Two-Factor Authentication, Ranked
Two-factor authentication (2FA) requires a second proof of identity beyond your password. The U.S. National Institute of Standards and Technology explains why multi-factor authentication dramatically reduces the risk of account takeover. Not all methods are equal, though.
| Rank | 2FA Method | How It Works | Main Weakness |
|---|---|---|---|
| 1 (Best) | Hardware security key | A physical USB or NFC key that confirms logins cryptographically | Can be lost, so register a backup key |
| 2 | Authenticator app | An app on your phone generates time-based codes offline | Codes can still be phished on a fake site |
| 3 (Weakest) | SMS codes | A one-time code is texted to your phone number | Vulnerable to SIM swaps and interception |
Hardware keys resist phishing because they check the website’s real domain before responding. If your platform supports them, they are the gold standard. An authenticator app is a strong, free alternative, and SMS is better than nothing but should be replaced when possible.
Anti-Phishing Codes
Many exchanges let you set a personal anti-phishing code that appears in every genuine email they send. If an email claims to be from your exchange but lacks your code, treat it as fake.
Withdrawal Whitelists and Security Alerts
A withdrawal whitelist restricts withdrawals to addresses you have pre-approved. Even if someone gets into your account, they cannot easily send funds to their own wallet.
- Enable whitelisting wherever it is available and add new addresses only from a trusted device.
- Turn on login and withdrawal notifications so you see unusual activity immediately.
- Review active sessions and connected devices regularly, and log out of ones you do not recognize.
- Secure the email account linked to your exchange with the same care, since it controls password resets.
Choosing and Securing Your Wallet
Where your crypto lives determines who holds the keys and which risks you face. There is no single right answer; most experienced users combine several approaches.
Custodial vs Self-Custody
With a custodial wallet, such as an exchange account, the platform holds the private keys on your behalf. This is convenient for trading and offers account recovery if you forget your password, but you rely on the platform’s security and solvency.
With self-custody, you hold the keys yourself. Nobody can freeze or lose your funds for you, but nobody can recover them if you lose your seed phrase either. The Ethereum Foundation’s overview of wallet types is a helpful neutral primer.
Hot vs Cold Wallets
A hot wallet is connected to the internet, such as a mobile or browser wallet. It is ideal for frequent, smaller transactions. A cold wallet, such as a hardware device, keeps keys offline and is better for long-term savings.
| Feature | Hot Wallet | Cold Wallet |
|---|---|---|
| Internet connection | Always or often online | Keys stay offline |
| Best for | Daily spending and active use | Long-term holdings |
| Main risk | Malware, phishing, malicious approvals | Physical loss, poor seed backup |
| Cost | Usually free | Purchase of a hardware device |
A sensible setup is a small “spending” hot wallet plus a cold wallet for the bulk of your holdings. Our detailed comparison of a hot wallet vs cold wallet walks through setup, costs and use cases.
Hardware Wallet Tips
- Buy directly from the manufacturer or an authorized reseller, never second-hand.
- Generate a fresh seed phrase on the device yourself; reject any device that arrives with one pre-filled.
- Always verify the receiving address on the device screen, not just on your computer.
- Keep firmware updated using the manufacturer’s official software only.
Seed Phrase Handling: Do’s and Don’ts
Your seed phrase (also called a recovery phrase) is typically 12 or 24 words that can regenerate every key in your wallet. Anyone who has it controls your funds, from anywhere in the world. Treat it as the single most sensitive piece of information you own.
Do
- Write it down on paper or stamp it on metal the moment you create the wallet.
- Store backups in at least two secure physical locations to protect against fire, flood or theft.
- Double-check the spelling and order of every word before funding the wallet.
- Test your backup by restoring a wallet with a small amount before you rely on it.
- Plan for inheritance so a trusted person can access your assets if something happens to you.
Don’t
- Don’t photograph it or store it in cloud drives, email, notes apps or password managers synced online.
- Don’t type it into any website, form or “wallet validation” tool.
- Don’t share it with anyone, including people claiming to be support staff.
- Don’t use a seed phrase someone else generated or that came printed with a device.
- Don’t split it casually (for example, half here and half there) without understanding that this can weaken security.
If anyone, anywhere, asks for your seed phrase, it is a scam. No exception.
Buying and Trading Safely
Security starts before your first purchase. Choosing a reputable platform, verifying you are on the genuine site and understanding what you are buying all reduce your risk. Our step-by-step guide on how to buy Bitcoin safely covers the process in detail.
- Type exchange URLs directly or use bookmarks instead of clicking links in emails or ads.
- Avoid peer-to-peer deals with strangers who insist on gift cards, wire transfers or moving off-platform.
- Start with a small test transaction when sending to a new address.
- Never trade on public Wi-Fi without a trusted VPN, and keep your devices updated.
- Do not trust guaranteed-profit trading signals or “account managers” who offer to trade for you.
If you are new to markets, our crypto trading for beginners guide explains order types and risk management, while the guide to buying, selling and trading Bitcoin and altcoins goes deeper into building and managing positions. When you are ready, you can explore secure crypto trading on Bithoex.com with the protections described in this guide switched on.
DeFi and Stablecoin Risks
Decentralized finance and stablecoins open up powerful new options, but they come with risks that differ from simply holding Bitcoin on an exchange. You can browse more on these topics in our DeFi and Web3 hub.
DeFi Risks
DeFi applications run on smart contracts, which are code that executes automatically on a blockchain. If you are new to the space, start with our beginner-friendly explainer What Is DeFi? before connecting a wallet to any protocol.
- Smart contract bugs: Even audited code can contain flaws that attackers exploit.
- Rug pulls: Anonymous developers may abandon a project and drain its liquidity.
- Malicious approvals: Fake front-ends can trick you into signing away your tokens.
- Unsustainable yields: Extremely high returns often depend on new deposits or token inflation.
- Bridge risk: Cross-chain bridges have historically been frequent targets for large exploits.
Use a separate hot wallet for DeFi experiments, keep only what you can afford to lose in it, and revoke approvals when you are done.
Stablecoin Risks
Stablecoins aim to hold a steady value, usually one U.S. dollar, but “stable” does not mean risk-free. Our article Stablecoins Explained covers how different designs work.
- De-pegging: A stablecoin can fall below its target value during market stress.
- Reserve risk: Fiat-backed coins depend on the issuer actually holding adequate reserves.
- Algorithmic risk: Coins backed mainly by code and incentives have failed dramatically in the past.
- Freezing: Some issuers can freeze tokens at specific addresses.
How to Recognize a Crypto Scam
Scams evolve constantly, but their underlying tactics stay remarkably consistent. The U.S. Securities and Exchange Commission’s investor resource on crypto assets highlights many of the same warning signs.
Red-Flag Checklist
- Guaranteed returns or “risk-free” profits.
- Pressure to act immediately or keep the opportunity secret.
- Requests for your seed phrase, private keys, passwords or 2FA codes.
- Giveaways promising to “double” any crypto you send.
- Unsolicited contact from someone you met online who steers conversations toward investing.
- A platform that lets you deposit easily but invents fees or “taxes” before you can withdraw.
- Support agents who contact you first through direct messages.
- Websites with look-alike domains, typos or recently registered addresses.
- Requests to install remote-access software so someone can “help” you.
- Payment demanded in crypto, gift cards or wire transfers to resolve a “problem.”
If you spot even one of these signs, stop, disconnect and verify through an official channel you find yourself.
What to Do If You Are Hacked
Speed matters. The minutes after you notice suspicious activity are when you can still limit the damage. Follow this incident plan in order.
- Stay calm and act fast. Panic leads to mistakes, including falling for “recovery” scammers who prey on victims.
- Secure your email first. Change its password from a clean device and enable strong 2FA, since email controls most password resets.
- Lock down your exchange account. Change your password, reset 2FA, log out all sessions and contact the platform’s official support through its website.
- Move remaining funds. If a self-custody wallet is compromised, transfer what is left to a brand-new wallet with a freshly generated seed phrase on a clean device.
- Revoke token approvals. Use a reputable approval-checker to cancel any suspicious permissions.
- Scan or reset your devices. Run reputable security software, or wipe and reinstall if you suspect malware.
- Contact your mobile carrier if you suspect a SIM swap, and add a port-out PIN.
- Document everything. Record transaction IDs, wallet addresses, screenshots and timelines.
- Report the incident. File reports with the relevant authorities in your country, such as the FBI’s IC3 in the United States, and with the platforms involved.
- Ignore “recovery services.” Anyone promising to recover stolen crypto for an upfront fee is almost certainly running a second scam.
Your 10-Point Crypto Security Checklist
Use this checklist to audit your setup today, and revisit it every few months.
- Every crypto account and linked email uses a unique, strong password.
- Passwords are stored in a reputable password manager.
- 2FA is enabled using a hardware key or authenticator app, not SMS.
- An anti-phishing code is set on your exchange account where available.
- Withdrawal whitelisting and security alerts are switched on.
- Long-term holdings are kept in cold storage.
- Your seed phrase is written offline and stored in at least two secure places.
- Exchange and wallet URLs are bookmarked, and you never log in from email links.
- Token approvals are reviewed and revoked regularly.
- You have a written incident plan and know exactly who to contact.
Risk reminder: Crypto assets are volatile and can lose value quickly; only invest what you can afford to lose.
Frequently Asked Questions
What is the most important crypto security step?
Protecting your seed phrase and enabling strong two-factor authentication are the two highest-impact steps. Together they defend against the majority of account takeovers and wallet thefts.
Is it safe to keep crypto on an exchange?
Keeping funds on an exchange is convenient for active trading, but you depend on the platform’s security. Many users keep trading balances on an exchange and move long-term holdings to a cold wallet they control.
Is SMS two-factor authentication good enough?
SMS is better than no 2FA, but it is vulnerable to SIM swaps. Upgrade to an authenticator app or, ideally, a hardware security key whenever your platform supports it.
Can stolen crypto be recovered?
Recovery is rare because blockchain transactions are generally irreversible. Report the theft quickly to the platform and authorities, and be extremely cautious of anyone offering paid recovery services.
Final Thoughts
Crypto security is not a one-time task; it is a set of habits. Strong unique passwords, phishing-resistant 2FA, careful seed phrase storage and a healthy skepticism toward unsolicited messages will protect you from the vast majority of threats.
Start with the 10-point checklist, then explore the rest of our crypto security hub for deeper dives on each topic. When you are ready to put these practices to work, Bithoex.com is built to help you buy, sell and trade cryptocurrencies securely and easily, and keeping your own defenses strong is what makes that security complete.
