Crypto Security Checklist

A practical guide to protecting accounts, recovery information and transactions. This is an educational checklist for readers who want to reduce common operational mistakes when using crypto wallets and online services.

Account and device security

• Choose a unique password for each exchange, mailbox or account. Use a reputable password manager if it fits your workflow.
• Enable phishing-resistant multi-factor authentication where available, such as a hardware security key or supported passkey. Avoid relying exclusively on text-message codes when stronger options are supported.
• Keep your operating system, browser, wallet software and security tools updated from trusted sources.
• Review active sessions, login notifications, authorized devices and recovery email settings periodically.
• Treat emails and direct messages as untrusted until you independently verify the sender and destination.

Protect wallet recovery details

A self-custody recovery phrase is a means of restoring control of a wallet. Anyone who obtains it may be able to transfer assets. Never share it with a website, employee, account helper, researcher or purported recovery specialist.

• Create and verify backups using the wallet provider’s documented instructions.
• Store recovery material away from publicly accessible photos, shared cloud folders and casual notes.
• Consider physical resilience: loss, fire, theft and the needs of trusted successors.
• Make sure you know which wallet and network the backup restores before depending on it.
• Never type the recovery phrase into a site merely to check a balance, validate an account or claim a reward.

Before every transfer or approval

Step	Check
Destination	Compare the full address carefully, especially after copying and pasting. Do not rely solely on the first or last characters.
Network	Confirm the source and destination support the same blockchain and asset standard.
Amount and fee	Inspect the token quantity, exchange rate, estimated network fee and any withdrawal charge.
Permission	Read what the signature or contract approval actually authorizes, including spending limits.
Test	When practical, use a small initial transfer before a larger one.
Finality	Do not assume a transaction can be reversed once broadcast or finalized.

API keys, connected apps and token permissions

Some analytics and automation tools can access account data or execute trades when you grant permissions. Grant only the scope required for the intended function. Revoke unused integrations and review token allowances after using decentralized applications. An API key that cannot withdraw funds may still cause financial harm through unauthorized trading.

Recognize common warning signs

• Pressure to act immediately, particularly through private messages or impersonated support staff.
• Requests for recovery phrases, remote-control software or an upfront “release” or “recovery” payment.
• Guaranteed returns, unverifiable balances, fabricated endorsements or fabricated reviews.
• A domain that resembles a known service but contains extra words or subtle spelling changes.
• A transaction prompt that does not match the action you intended to take.

What to do if you suspect compromise

The safest response depends on what was exposed. Stop interacting with suspicious links, preserve useful evidence, and use a device and communication channel you trust to access genuine provider support. If a custodial account is affected, contact the account provider through a verified channel and review sessions, credentials and withdrawal controls.

If a self-custody key or recovery phrase was exposed, treat it as compromised. Seek technically competent help using trusted sources before taking further action; moving remaining assets or revoking permissions may be necessary, but every additional signature or transaction carries risk. Beware of anyone claiming they can reverse blockchain transactions or guarantee recovery for an advance fee.

Next steps

Learn the terminology in the Crypto Glossary, review the learning path in Crypto Academy or use our Platforms & Tools comparison guide.