How to keep your crypto safe: a practical security guide

To keep your crypto safe, protect three things: your exchange login, your recovery phrase and your own judgement when someone pushes you to act fast. Most crypto losses don’t come from broken blockchains. They come from stolen passwords, phished codes, leaked seed phrases and hacks at the platforms that hold coins for you.

This guide covers each risk in the order that matters most for an EU investor, and looks at what the exchange hacks in our data actually show. Good security only protects you from theft and mistakes: crypto prices are volatile, and you can lose all the money you put in even if nobody steals a coin.

The main risks to your crypto

The biggest risks to your crypto are account takeover, scams that trick you into sending coins, losing your own keys through user error, and failures at the exchange that holds your coins. Market risk sits on top of all four.

Crypto is less forgiving than a bank account because blockchain transactions are irreversible. If a thief moves your bitcoin to their own wallet, there is no chargeback. It helps to separate two kinds of risk:

• Custody risk: someone steals or freezes your coins, or you lose access to them. Good habits reduce it.
• Market risk: the price falls. No security step reduces it.

How a crypto wallet works

A crypto wallet doesn’t hold coins; it holds the keys that control them. Your digital assets stay on the blockchain, a decentralized ledger, and the wallet manages the public and private keys that prove they are yours.

• Public key and address: they let people send you crypto, like an IBAN.
• Private keys: they sign transactions. Whoever has your private keys can spend from the wallet.

So every tip in this guide comes back to one question: who can reach your private keys? A bitcoin wallet app on your phone, an exchange account and a hardware wallet each answer it differently.

Choose how to store crypto: custodial wallet or full control

You can store crypto in a custodial wallet at a licensed exchange or hold the keys yourself. A custodial wallet is easier and lets you recover a forgotten password; a self custody wallet gives you full control but no one to help if you make a mistake.

For most beginners, holding crypto in an exchange account with strong login security is the sensible starting point. As balances grow, many crypto investors move long-term holdings to a cold wallet. Either way, crypto has no deposit protection: the €100,000 deposit guarantee covers bank deposits only, and in the Netherlands the investor compensation scheme excludes crypto-assets.

Hot and cold wallets

Hot wallets are connected to the internet: exchange accounts, mobile wallet apps, software wallets and browser extensions. Software wallets are convenient for crypto trading and payments, but any crypto wallet connected to the internet is where online attacks happen. A cold wallet keeps the private keys offline, usually on a hardware wallet, so every transaction needs the device in hand. Paper wallets, a key or seed phrase written on paper, are an older form of cold storage that is easy to damage or lose.

A simple rule works for most people: keep spending money in hot wallets and savings in a cold wallet. Our guide to hot and cold wallets explains each option and how custody works.

Keep your crypto on a crypto exchange? Check the licence first

If you keep crypto on a crypto exchange, first check that it is authorised under MiCA, the EU’s crypto law. Since 1 July 2026 only MiCA-authorised crypto-asset service providers may serve EU residents, and ESMA told unauthorised firms to stop onboarding clients.

You can check a firm in ESMA’s interim MiCA register and in national registers such as those of the AFM in the Netherlands and BaFin in Germany. A licence means a regulator supervises the firm and that it must keep your crypto separate from its own assets. It doesn’t mean the firm can’t be hacked.

Then limit what you leave there. Even a reputable exchange can be hacked, so keep the amount you trade on the exchange, not everything you own, and spread larger holdings rather than trusting a single platform.

What exchange hacks teach us

Exchange hacks are real, large and not limited to small platforms. In the incidents in our provider data, attackers mostly hit the exchange’s own online wallets, and several exchanges covered customer losses; the account-level cases show why your own login matters too.

Year	Exchange	What happened
2019	Binance	7,000 BTC (about $40m) stolen from a hot wallet; Binance covered it from its SAFU fund
2020	KuCoin	Hot wallets compromised in a theft widely reported at about $281m; KuCoin said affected users would be covered
2022	Crypto.com	Attackers bypassed 2FA on 483 accounts and withdrew about $34m; Crypto.com said users were reimbursed
2025	Bybit	About $1.5bn in ETH stolen on 21 February 2025; the FBI attributed it to North Korea
2025	Coinbase	Criminals bribed offshore support staff to obtain data on about 69,000 customers
2026	Bitget	Hot and warm wallets drained on 24 September 2026 (later reported at $387.5m); withdrawals paused

How to weigh these cases:

• A hack doesn’t always mean customers lose money. In most of these cases the exchange said it covered the loss, but that depends on the firm having the reserves to do so.
• A licence and a hack are separate questions. Bybit EU is MiCA-authorised in Austria, while Bitget has no MiCA licence and Binance stopped onboarding EU users on 1 July 2026.
• Data leaks feed phishing. The Coinbase case didn’t drain wallets directly, but leaked names and phone numbers are exactly what scammers use to pose as support staff.
• Proof of reserves helps, a little. Kraken, OKX and Bybit publish Merkle-tree proofs of reserves, with recent snapshots from 30 June 2026, October 2026 and 23 September 2026. A proof shows one day’s balances; it isn’t insurance.

Our list of exchanges with strong security compares licensed platforms on these points.

Secure your exchange account

Your exchange account is only as strong as your email, your password and your second factor, so secure all three. A unique password plus two-factor authentication stops most account takeovers.

Use two factor authentication, ideally a passkey

Enable two factor authentication on every exchange account and pick the strongest method it offers. From strongest to weakest:

1. Passkey or hardware security key: resists phishing, because it only works on the real website.
2. Authenticator app, such as Google Authenticator: a good extra layer, but a fake site can still capture a code in real time.
3. SMS code: the weakest, because of SIM swaps.

The Crypto.com case, where attackers bypassed two factor authentication (2FA) on 483 accounts, shows that 2FA is a layer, not a guarantee. Our 2FA setup guide walks through each method and what to do if you lose your phone.

Use a password manager and strong passwords

Use a password manager to create strong passwords that are long and unique for each exchange. Give your email account its own password and 2FA too: whoever controls your email can reset almost everything else.

Turn on a withdrawal allow-list

A withdrawal allow-list, sometimes called a whitelist, limits withdrawals to addresses you approved in advance. Many exchanges also add a waiting period before a new address works, which gives you time to spot an intruder.

Turn it on, add only your own wallet addresses, and switch on alerts for new logins and withdrawals. Names and options differ per exchange, so look in its security settings. If you connect trading bots, never give an API key withdrawal rights; our API trading guide explains why.

Protect your seed phrase and private keys

Your seed phrase, also called a recovery phrase, is the master key to a self-custody wallet. Anyone who sees it can take everything, and if you lose it nobody can restore access.

• Write it on paper or metal. Never store it as a photo, in cloud storage, in a notes app or in an email.
• Never type it into a website or share it, whatever the reason. No exchange, wallet maker or security team will ever ask for it.
• Keep your private keys offline the same way: the private key and seed phrase give the same power.

Some people keep encrypted backups of a seed phrase in a password manager. Security experts disagree on whether that is wise: encrypted backups beat a plain photo, but any digital copy can leak, so an offline copy should stay your master backup.

Store seed phrases in secure locations

Keep at least two copies in separate secure locations, such as your home and a bank safe deposit box, so one fire or physical theft can’t take both. A stamped metal plate survives fire and water better than paper.

Keep the backups away from the devices you use every day, and make sure physical access to them is limited to people you trust. Our glossary explains how a seed phrase works.

Use a hardware wallet for long-term holdings

A hardware wallet keeps your private keys offline and signs transactions on the device, so malware on your computer can’t read them. Hardware wallets are small physical devices, and they are the usual choice for keeping a crypto wallet safe for coins you plan to hold for years.

• Buy it directly from the maker or an authorised seller, never second-hand.
• Set it up yourself. A device that arrives with a seed phrase already printed on a card is a scam.
• Check the address on the device’s screen, not only on your computer, before you approve a transfer.
• If it breaks or gets lost, restore the wallet on a new device with your seed phrase. A lost hardware wallet without the seed phrase means lost crypto.

For larger or shared funds, multi signature wallets add stronger security. A multi sig wallet needs two or more keys to authorise transactions, for example two out of three, so one lost or stolen key isn’t fatal. The catch is complexity: a mistake in the set-up can lock you out.

Improve crypto security on your devices

Your phone and computer hold your exchange apps, hot wallets and 2FA codes, so keep them updated and locked. Basic digital security protects your crypto as much as any wallet setting. Most malware relies on old software or apps from the wrong source.

• Install system and app updates promptly.
• Download exchange and wallet apps only from the official app store, using the link on the provider’s own website.
• Use a screen lock and device encryption, and set up remote wipe in case your mobile device is stolen.
• Avoid crypto transactions on public Wi-Fi or a shared computer.
• Keep browser extensions to a minimum.

Avoid phishing, fake apps and crypto scams

Phishing scams are the most common way people lose crypto: a fake email, text, search ad or “support agent” gets you to hand over a login, a code or your seed phrase. The defence is never to act on a link or a call you didn’t start.

• To trade crypto safely, type the exchange’s address yourself or use a bookmark, and don’t click unknown links in emails or texts.
• Real support doesn’t phone you out of the blue, never asks for codes or seed phrases, and never asks you to move coins to a “secure” wallet.
• Walk away from promises of fixed high returns, giveaways that ask you to send crypto first, and “recovery services” that promise to get stolen funds back.
• Treat urgency as a warning sign. Scammers want you to act before you think.

Read more about phishing and other crypto scams in our glossary.

SIM swaps

In a SIM swap, a criminal convinces your mobile provider to move your number to their SIM card, then receives your text codes and password-reset messages. It is the main reason SMS is the weakest form of 2FA.

Remove your phone number as a 2FA method on exchanges where you can, ask your provider about a PIN or lock for number transfers, and avoid revealing sensitive information such as your phone number alongside your crypto activity online. If your phone suddenly loses signal for no reason, call your provider straight away.

Check every transaction before you sign

Before every transfer, check the full receiving address, the network and the amount. Cryptocurrency transactions can’t be undone, so a mistake is as costly as a theft.

• Compare the beginning, middle and end of the address. Scammers send tiny payments from lookalike addresses, hoping you copy the wrong one from your history.
• Send a small test amount to any new address first.
• If you use a self custody wallet with decentralized apps, revoke token approvals you no longer need, and don’t sign a prompt you don’t understand.

Match your set-up to your situation

The right level of crypto security depends on how much you hold and how often you trade. More layers mean more effort, so match where you store crypto to the money at stake.

Your situation	Sensible set-up
Buying €50 to €100 a month	MiCA-authorised exchange, passkey or authenticator app, withdrawal allow-list
Active trading	Only your trading balance on the exchange; savings in cold storage
Several thousand euros held for years	Hardware wallet, seed phrase on metal in two places
Shared or family funds	Multi-sig wallet and written instructions

Plan recovery and succession

If something happens to you, your family can’t reach self-custody crypto without the seed phrase. Write down which exchanges and wallets you use and where the backups are, but keep the seed phrase itself out of that document.

What to do if your account is hacked

Act fast, because a thief will try to withdraw everything within minutes. Use only the exchange’s official app or website, never a number or link someone sends you.

Crypto security checklist

If you only do a few things, do these. Each one blocks a common way people lose crypto.

• Check that your exchange is MiCA-authorised (we checked the register status of the exchanges named here on 23 October 2026).
• Replace SMS 2FA with a passkey or an authenticator app.
• Turn on a withdrawal allow-list and login alerts.
• Keep your seed phrase offline, in two places, and never share it.
• Keep long-term holdings in a hardware wallet.

If you do one thing today, swap SMS codes for a passkey or authenticator app on your exchange account. And remember that no security step protects you from price falls: you can still lose all the money you invest in crypto.