Free Guide
Keeping Your Crypto Safe
Plain English, no jargon. The handful of habits that stop almost every theft — and how to spot the scams that target people after they've been hit.
Free · no sign-up · read in 5 minutes
The one rule that matters most: your seed phrase IS your money.
Anyone who has your 12–24 recovery words can empty every wallet it controls, on every chain, instantly — no password needed. Protect the seed and you've won most of the battle.
1. Your seed phrase (recovery words)
Written once when you create a wallet. Treat it like the deed to your house.
✗Never type it into a website, app, or chat — real wallets never ask you to re-enter it.
✗Never store it in a photo, screenshot, notes app, email, or cloud drive. Malware hunts for exactly that.
✗Never tell it to "support", a "wallet validation" site, or anyone who contacts you.
✓Write it on paper (or steel) and store it offline, ideally in two separate places.
✓Assume any device that ever displayed or stored the seed is a risk — the most common leak isn't a hack, it's a stored copy.
2. Use a hardware wallet for real money
A hardware (cold) wallet keeps the keys on a device that never touches the internet.
✓Keep anything you'd hate to lose on a hardware wallet (Ledger, Trezor). Approve each transaction on the device screen.
✓Use a hot wallet (browser/phone) only for small, spending-money amounts.
✓Buy hardware wallets direct from the maker — never second-hand or off a marketplace.
3. Address poisoning — check every address
Scammers send tiny "dust" transactions from an address that looks like one you use, hoping you'll copy it from your history next time.
✗Never copy a wallet address from your transaction history.
✓Verify the full address (not just the first/last few characters) on your hardware wallet's own screen.
✓Send a small test amount first when moving large sums to a new address.
4. Phishing, fake apps & fake "support"
✗Don't click wallet/exchange links in emails, DMs, or ads — type the address or use a saved bookmark.
✗Don't download wallet apps or "updates" from search ads or random links — use the official site / app store and check the developer.
✗Nobody from support ever DMs you first. Real support doesn't ask for your seed, password, or remote access.
✓Be extra careful with anything urgent — "act now or lose your funds" is the scammer's favourite line.
🚨 The scam that targets theft victims: "recovery" services
If crypto is stolen from you, a second wave of scammers appears within days — "recovery agents", fake investigators, even fake police or lawyers — promising to get your coins back for an up-front fee.
Stolen crypto cannot be un-sent. No legitimate service can reverse a blockchain transaction. Anyone who contacts you promising recovery, or asks for a fee (or your seed phrase) to "unlock" funds, is stealing from you a second time.
What you can legitimately do is trace and report the theft — so exchanges can freeze the thief's addresses and authorities have evidence.
5. Lock down your accounts
✓Use an authenticator app (Google Authenticator, Authy) for 2FA — not SMS, which can be SIM-swapped.
✓Use a password manager and a unique password for every exchange and email.
✓Protect your email above all — it's the reset key to everything else.
6. On exchanges
✓Turn on a withdrawal address allowlist so funds can only leave to addresses you pre-approved.
✓If you use API keys, disable withdrawals on them and IP-allowlist where you can.
✓Don't leave more on an exchange than you're actively trading — not your keys, not your coins.
7. If you think you've been compromised
✓Move any remaining funds immediately to a brand-new wallet on a clean device — the old seed is burned.
✓Rotate every password and re-secure your email; treat suspect devices as compromised until wiped.
✓Report it where you live: ReportCyber (cyber.gov.au) in Australia, the FBI's IC3 (ic3.gov) in the US, Report Fraud (reportfraud.police.uk) in the UK, or your local police elsewhere. Also report it on chainabuse.com, and flag the thief's addresses with the receiving exchanges.
✗Don't engage anyone who contacts you offering to recover the funds (see the red box above).
Been hit? Get the evidence to file.
Our Stolen Crypto Tracer follows the funds across the blockchain and builds a forensic report you can hand to police and exchanges. We trace — we never promise recovery.
Open the Stolen Crypto Tracer →