Crypto Security Checklist: 10 Steps to Protect Your Coins
Most crypto losses are not sophisticated hacks — they are avoidable mistakes. Work through this ten-step checklist once, and you will have covered the risks that actually catch people out. Print it, tick it off, and revisit it whenever you set up something new.
The quick version
- Self-custody long-term holdings, secure your accounts with app-based 2FA, and never share your recovery phrase. Everything below is detail on those three ideas.
1. Use a reputable exchange
Start with a platform that passes a basic safety screen — established, transparent, and regulated where you live. Our best exchanges guide only lists ones that clear ours.
2. Turn on app-based two-factor authentication
Enable 2FA on every exchange and on the email tied to it. Prefer an authenticator app or a hardware security key over SMS codes, which can be intercepted via SIM-swap attacks.
3. Use a unique, strong password
A long, unique password for every crypto account, stored in a password manager. Reusing passwords is how one leaked site takes down all your accounts.
4. Move long-term holdings to a hardware wallet
For anything you are not actively trading, get it off exchanges and into a hardware wallet. This is the single biggest upgrade you can make.
5. Back up your recovery phrase offline
Write your seed phrase on paper or metal and store it somewhere safe — never as a photo, screenshot, or cloud note. Full detail in our seed phrase guide.
6. Never share your seed phrase or private keys
No exchange, wallet or "support agent" will ever legitimately ask for them. Anyone who does is a scammer, every time.
7. Bookmark sites and check every URL
Phishing sites copy real ones perfectly. Reach exchanges and wallets via your own bookmarks, and double-check the address bar before logging in or connecting a wallet.
8. Use a dedicated email
Consider an email address used only for crypto accounts, with its own strong password and 2FA. It shrinks your exposure if another account is breached.
9. Keep devices and apps updated
Run updates on your phone, computer, wallet firmware and browser. Many attacks exploit known holes that a simple update would have closed.
10. Stay private and start small
Do not broadcast how much crypto you hold. And whenever you use a new wallet or address, send a tiny test amount first to confirm everything works before moving the rest. When in doubt, slow down — read our guide to spotting scams.
Frequently asked questions
What is the most important crypto security step?
If you only do one thing, move your long-term holdings into self-custody with a hardware wallet, and back up the recovery phrase offline. That single step removes the two biggest risks at once: exchange failure and online account hacks.
Is SMS two-factor authentication good enough?
It is far better than nothing, but SMS can be intercepted through SIM-swap attacks. Where possible, use an authenticator app (or a hardware security key) instead of SMS codes for your exchange and email accounts.
Related reading
This article is general information for Australian and global crypto users, not financial, tax or legal advice. Crypto is volatile and you can lose money. Always do your own research and, where relevant, speak to a licensed adviser or registered tax agent. We may earn a commission from some links, at no cost to you — it never changes what we recommend.