The threat model
Nobody steals crypto by breaking cryptography. They steal it by convincing you to sign something, by tricking you into revealing your seed phrase, or by taking over an account that guards your exchange balance. Your defence is therefore behavioural, not technical.
Layer one: keys
Store the seed phrase offline, in physical form, in at least two places. Use a hardware wallet for anything you consider savings. Keep a separate hot wallet with only the amount you are willing to lose for experiments, mints and new protocols.
- Never type a seed phrase into a website, even one that looks identical to your wallet.
- Never share a screen while your wallet is open.
- Never store the phrase as a photo, note, email or cloud document.
- Support agents never ask for it. The request itself is proof of fraud.
Layer two: approvals and signatures
On EVM chains, buying a token often requires an approval that lets a contract spend it. Malicious contracts request unlimited approvals and drain the wallet later, sometimes weeks after you forgot the site existed. Review approvals regularly with a revoke tool and cancel everything you no longer use.
Read what you sign. A blind signature request with an unreadable payload, an unexpected 'set approval for all', or a transaction that simulates a negative balance change is a stop sign, not a formality.
Layer three: accounts and identity
Use an authenticator app rather than SMS for two-factor authentication, because SIM-swap attacks are cheap and common. Use a unique password per exchange, stored in a password manager. Enable withdrawal address whitelists. Consider a dedicated email address used only for crypto accounts and never published anywhere.
Layer four: habits
Bookmark the sites you use and reach them only through those bookmarks; search-engine ads regularly point at cloned domains. Do not click links in Telegram or Discord direct messages, ever. Assume any 'support' account that writes to you first is an attacker. Take five extra seconds before every signature — that pause is the cheapest insurance in this industry.