Crypto Security: The Complete Guide to Not Losing Your Coins

Nobody has ever brute-forced a Bitcoin private key. The mathematics holds, and it will keep holding. Yet people lose crypto every day — and when you read the post-mortems, the same four causes appear over and over: a signature approved without being understood, a phishing site that looked right, a backup that was never made properly, and a company that held the coins and stopped honouring withdrawals.

That gap between the theoretical threat and the actual one is the whole subject. This guide is organised around what really happens, in the order the risks are likely to reach you. Work through it once and you will have closed the routes that account for the overwhelming majority of losses.

First: decide what is worth protecting

Security is a set of trade-offs, and the right trade-off depends on the amount. A £200 balance protected by a procedure so elaborate you never use it is worse than a £200 balance in a phone wallet. A £200,000 balance in a phone wallet is negligence.

Split your holdings into two mental buckets before you do anything else. Spending money is what you actively trade, swap or pay with; it lives somewhere convenient and you accept that convenience carries risk. Savings is what you intend to still hold in three years; it goes behind a hardware wallet and you touch it rarely. The mistake almost everyone makes at the start is running one bucket for both.

The custodial question, answered honestly

Leaving coins on an exchange is not automatically wrong. An exchange with a real licence, segregated client assets written into its terms and a verifiable proof of reserves is a reasonable place for money you are actively trading. What it is not is a savings account: you hold a claim on a company, not the asset, and the sector's history is a long list of companies whose claims turned out to be worth less than customers assumed.

If you do keep a balance on a venue, choose one whose custody arrangements you can read. Our best crypto exchanges table scores exactly that: what the terms say about segregation, whether reserves are published in a form you can verify, and what happened the last time something went wrong. And enable a hardware security key for two-factor authentication rather than SMS, which is defeated by a SIM swap.

Self-custody: the two things that actually matter

When people move to self-custody they usually focus on the device. The device matters, but two other things decide whether the setup survives contact with reality.

The first is what the screen shows before you sign. A hardware wallet's job is not only to keep a key offline — it is to display, on a screen your computer cannot alter, what you are about to authorise. If the device shows an unreadable hash and you approve it, the key never leaked and the coins still left. This is why devices with larger screens and proper transaction decoding score higher in our hardware wallet table than the specifications alone would suggest.

The second is the backup. Every hardware wallet reduces to a recovery phrase, and that phrase is the wallet. Written badly, stored in one place, photographed for convenience — each of those turns a strong device into a weak system. The seed phrase backup problem deserves its own treatment, because it is where more coins are quietly lost than to any attacker.

Approvals: the drain that does not need your keys

This is the mechanism most newcomers have never heard of, and it is behind a large share of wallet losses on EVM chains. To trade a token on a decentralised exchange, you grant a contract permission to move that token on your behalf. Many interfaces request an unlimited allowance, and that permission persists — for months, for years — until you revoke it.

An attacker who gets you to sign a malicious approval does not need your seed phrase, your password or your device. They need one signature, which often costs no gas and looks like every other confirmation you have clicked. Later, at a time of their choosing, they use the permission you granted.

• Review your approvals periodically and revoke the ones you no longer use — a habit, not a one-off.
• Use a wallet that simulates transactions and shows resulting balance changes before you sign; our self-custody wallet table scores exactly this.
• Treat any request to sign while you are in a hurry as hostile. Urgency is the attacker's main tool.
• Keep long-term holdings in an address that never touches a decentralised application at all.

Phishing has moved on from bad spelling

The modern version is not a clumsy email. It is a sponsored search result for the exact wallet you use, a support account that replies within seconds of you posting a problem publicly, or a counterfeit hardware wallet mailed to your home address — a tactic that followed the 2020 breach of Ledger's e-commerce database, which exposed customer names, addresses and phone numbers and has fuelled targeted attacks for years since.

The defences are dull and effective. Reach wallet and exchange sites through your own bookmarks, never a search result or a message. Assume nobody legitimate will ever ask for your recovery phrase, because nobody legitimate ever does. Verify a device's firmware through the vendor's published process before you generate a seed on it. And treat unsolicited contact about your crypto — by email, phone or post — as an attack until proven otherwise.

The interface is part of the attack surface

February 2025 provided the clearest demonstration the industry has produced. Attackers compromised a developer machine at Safe{Wallet} and served tampered JavaScript that showed Bybit's signers a routine transfer while altering the transaction underneath. Roughly $1.5bn left — the largest theft in the sector's history. Investigators found no flaw in the smart contracts.

The lesson generalises past multisig treasuries. What you see in a web interface is a rendering, and a rendering can lie. For anything that matters, verify the details on a hardware device's own screen, where the display is produced by firmware the website cannot touch. That is the entire reason the device has a screen.

What the numbers say about where risk actually sits

Industry tallies for the first half of 2026 recorded a record number of incidents — over 200 — while total stolen value stayed below $1bn, with North Korea-linked actors accounting for roughly two thirds of the funds taken. Read that shape carefully: more attacks, better contained, and heavily concentrated in a small number of very large operations against protocols and companies rather than individuals.

For an individual holder, that means the headline hacks are mostly not your threat model. Your threat model is an approval you forgot, a phishing page you visited while distracted, a backup that turns out to be incomplete, or a platform that fails. Those are the four doors, and all four have locks.

A setup that holds up

• Savings on a hardware wallet, seed backed up on metal in two separate physical locations, never photographed or typed into anything.
• A separate spending wallet with a small balance, used for anything that involves connecting to a website.
• Exchange balances limited to what you are actively trading, on a venue whose custody terms you have actually read.
• A hardware security key for two-factor authentication everywhere it is supported.
• A quarterly routine: revoke stale approvals, confirm you can still read your backup, check that your devices' firmware is current.

None of that is exotic and none of it requires technical skill. It requires doing the boring version consistently, which is the only version that works. If you do one thing after reading this, make it the backup — it is the failure that no amount of later diligence can undo.