How to Keep Your Crypto Safe: A Security Checklist

By [your named analyst + one-line credential] · Crypto Research Australia · Updated [Month Year]

The short answer

Most crypto losses aren't from bad investments, they're from poor security. The good news: a handful of habits prevent the overwhelming majority of thefts and scams. Here's the checklist in one breath:

• Protect your recovery phrase above all, offline, handwritten, never shared, never typed into a website.
• Use app-based two-factor authentication (2FA) on every account, not SMS.
• Use a hardware wallet for meaningful long-term holdings.
• Verify everything, URLs, apps, and addresses, because phishing is the #1 attack.
• Never trust unsolicited contact, "support," giveaways, and "recovery" offers are scams.

In crypto, transactions are irreversible and there's no fraud department to call. That makes prevention everything. Work through the checklist below once, build the habits, and you'll have closed the doors attackers actually use.

Note: This is general educational information, not personal financial or security advice for your specific situation. Self-custody means you are responsible for your own security. If you believe you've been scammed, see the reporting steps at the end. For personal advice, see an ASIC-licensed adviser.

---

Why crypto security is different

In traditional banking, if your card is stolen or you're defrauded, the bank can often freeze, reverse, or refund the transaction. Crypto has none of that. Transactions are irreversible, there's no central authority to appeal to, and self-custodied funds have no government guarantee in Australia. If someone gains access to your crypto, it's typically gone for good.

That sounds alarming, but the flip side is empowering: because attacks rely on a relatively small set of techniques, a relatively small set of defences stops them. Think of it as layers, no single measure is perfect, but stacked together they make you a very hard target.

Figure 1, Defence in depth. (Suggested visual: concentric rings or stacked layers infographic, from outer to inner: device security to strong passwords to app-based 2FA to hardware wallet to seed-phrase protection.)

---

The crypto security checklist

1. Protect your recovery phrase (the #1 rule)

Your seed phrase is the master key to your crypto. Anyone who has it owns your funds; if you lose it, your funds are gone.

• Write it by hand on paper or a metal backup plate; store it offline in a safe, private place (ideally two locations).
• Never store it digitally (photos, screenshots, notes apps, email, cloud).
• Never type it into any website or app except your wallet during genuine recovery.
• Never share it with anyone, for any reason. Every request for your seed phrase is a scam.

2. Use app-based two-factor authentication (2FA)

2FA adds a second lock to your accounts. But not all 2FA is equal:

Enable authenticator-app 2FA on your exchange accounts, email, and anywhere it's offered. Avoid SMS-only 2FA where you can, attackers can hijack your phone number through SIM-swapping and intercept the codes.

3. Use strong, unique passwords (and a password manager)

Use a long, unique password for every crypto-related account, never reused from other sites. A reputable password manager makes this easy and is worth using. If one site is breached, unique passwords stop the damage spreading.

4. Use a hardware wallet for meaningful holdings

For anything beyond small, active amounts, keep your crypto in a hardware wallet where the keys stay offline. This single step removes most online attack vectors. (See our guide on setting up a wallet.)

5. Beware phishing, verify everything

Phishing, fake websites, apps, and messages impersonating real services, is the most common way people lose crypto. Defend against it:

• Type URLs yourself or use your own bookmarks; don't click links in emails, DMs, or search ads to reach your exchange or wallet.
• Download apps only from official sources, fake wallet and exchange apps are rife.
• Check the address bar for the exact, correct domain (scammers use near-identical look-alikes).
• Set anti-phishing codes on exchanges that offer them, so you can spot fake emails.

6. Verify addresses before sending

Malware can swap a copied wallet address for the attacker's. Always check the first and last few characters of an address before sending, verify it on your hardware wallet's own screen, and send a small test amount first for large transfers.

7. Enable withdrawal allowlisting

Many exchanges let you "allowlist" (whitelist) the only addresses funds can be withdrawn to. Turn this on, even if someone breaches your account, they can't send funds to an unknown address.

8. Keep devices and software secure

Keep your phone and computer updated, use antivirus where appropriate, lock your devices, and be cautious on public Wi-Fi (use a trusted network or a VPN for sensitive actions). A compromised device undermines everything else.

9. Never trust unsolicited contact

This is where many Australians lose money. Treat as a scam, every time:

• Anyone contacting you offering investment "opportunities," help, or support.
• "Support staff" asking for your password, seed phrase, or remote access.
• Giveaways asking you to "send 1 coin to receive 2", always fake.
• "Recovery services" promising to retrieve lost/stolen crypto for a fee, a scam that preys on victims twice.
• Romance or "investment mentor" contacts steering you to a platform or app.

---

Spotting a scam: a quick test

When something feels off, run it through this: Did they contact you unsolicited? Are they asking for your seed phrase, password, or remote access? Are they promising guaranteed returns or pressuring you to act fast? Any "yes" is a high scam risk.

Figure 2, Anatomy of a phishing attempt. (Suggested visual: an annotated example of a fake exchange email/SMS, with callouts pointing to the red flags, wrong domain, urgency, a link to click, a request for credentials. Use a clearly-fictional example.)

If anything trips a red flag, stop and verify independently, contact the company through its official website (that you typed yourself), never through the contact details in the suspicious message. (Our full guide on spotting and avoiding crypto scams covers the major scam types in detail.)

---

If you think you've been scammed (Australia)

Act fast, and don't be ashamed, these scams are sophisticated. In Australia:

• Contact your bank and exchange immediately, they may be able to halt transfers.
• Report to ReportCyber (cyber.gov.au), the official channel for cybercrime, and to Scamwatch (scamwatch.gov.au) run by the National Anti-Scam Centre.
• Contact IDCARE (1800 595 160) if your identity may be compromised.
• Beware "recovery" scammers who target victims promising to get the money back, they're a second scam.

---

Secure your email first, it's the real master key

People obsess over wallet security and forget the account that quietly controls everything: your email. Your email can reset passwords on your exchange and most other accounts, so if an attacker controls your inbox, they can work their way into much else. Treat it as critical infrastructure:

• Use a strong, unique password and app-based 2FA on your email account.
• Consider a dedicated email address used only for crypto, not shared publicly or reused on random sites.
• Watch for phishing targeting your email login, not just your exchange.

Locking down your email closes a door that many people leave wide open.

Build a five-minute monthly habit

Security isn't one-and-done. A quick monthly check keeps you ahead:

1. Confirm your seed-phrase backups are still safe and legible in their locations.
2. Check that 2FA is active on your exchange and email (and is app-based).
3. Review recent account activity for anything unfamiliar.
4. Install any pending software/security updates.
5. Move any crypto that's accumulated on an exchange beyond what you need into your hardware wallet.

A few minutes a month is a tiny price for protecting holdings that took real money to build.

Don't forget a backup plan

Security isn't only about keeping others out, it's also about making sure you, or someone you trust, can still access your crypto when needed. If something happened to you, would anyone be able to find and recover your holdings, or would they be lost forever? Self-custody makes this your responsibility. Without revealing your seed phrase while you're alive, it's worth having a plan so your crypto isn't lost to your family, our guide on crypto estate planning in Australia covers how to do this safely. A little planning prevents holdings you worked hard for from simply disappearing.

Be careful on public Wi-Fi and when travelling

Public Wi-Fi (airports, cafes, hotels) is convenient but riskier for sensitive actions. Avoid logging into exchanges or moving funds on untrusted networks; if you must, use a reputable VPN. When travelling, be wary of "shoulder surfing," keep your hardware wallet and seed-phrase backup physically secure, and never carry your only seed-phrase copy with you. Treat sensitive crypto activity like online banking, somewhere private, on a network you trust.

---

Common security mistakes

• Storing the seed phrase digitally instead of offline.
• Using SMS 2FA (vulnerable to SIM-swaps) instead of an authenticator app.
• Clicking links to reach exchanges/wallets instead of typing the URL.
• Downloading fake apps from ads or links.
• Reusing passwords across sites.
• Trusting unsolicited "support," giveaways, or recovery offers.
• Not verifying addresses before sending.
• Keeping large holdings on an exchange or hot wallet instead of a hardware wallet.

---

Frequently asked questions

What's the single most important thing for crypto security? Protecting your recovery phrase (seed phrase). It's the master key to your crypto, anyone who obtains it can take everything, and if you lose it, your funds are unrecoverable. Write it down by hand, store it offline in a safe place, never store it digitally, and never share it or type it into a website. No legitimate service will ever ask for it. Get this one thing right and you've prevented the most catastrophic and common form of crypto loss; the other measures build on top of it.

Is SMS two-factor authentication safe for crypto? It's better than no 2FA, but it's the weakest form because of SIM-swap attacks, where a criminal hijacks your phone number and intercepts the codes. Wherever possible, use an authenticator app instead, which generates codes on your device and can't be intercepted by taking over your phone number. A hardware security key is stronger still. Reserve SMS 2FA for accounts that offer nothing better, and prioritise upgrading your most important accounts, your exchange and your email, to app-based 2FA.

How do I avoid crypto phishing scams? Phishing relies on fake websites, apps, and messages impersonating real services. Defend yourself by never clicking links to reach your exchange or wallet, type the URL yourself or use your own bookmark, and downloading apps only from official sources. Check the address bar shows the exact correct domain, since scammers use look-alikes. Enable anti-phishing codes where offered, and treat any unsolicited message with urgency or a request for your details as a scam. When unsure, verify independently through the company's official channels.

Can my crypto be stolen if I just hold it and don't do anything? Crypto held securely, ideally in a hardware wallet with your seed phrase protected offline, is very safe at rest; thefts almost always require you to be tricked into revealing keys, approving a malicious transaction, or downloading something harmful, or require your account/device to be compromised. The risk rises when funds sit on exchanges (which can be hacked) or hot wallets on compromised devices, and when you interact with scam links or apps. Good storage plus good habits make passive holding low-risk; carelessness with keys or scams is what causes losses.

Someone from an exchange's "support" is asking for my details, is that normal? No, treat it as a scam. Legitimate exchange and wallet support will never ask for your password, your recovery phrase, or remote access to your device. Scammers impersonate support staff (often after you post a problem publicly, or via fake numbers and emails) precisely to exploit trust. If you need support, contact the company only through its official website that you've navigated to yourself. Never act on support details provided in an unsolicited message, and never share credentials with anyone claiming to help.

What should I do if I've already been scammed? Act quickly: contact your bank and exchange immediately, as they may be able to stop transfers. In Australia, report to ReportCyber (cyber.gov.au) and Scamwatch (scamwatch.gov.au), and contact IDCARE (1800 595 160) if your identity may be at risk. Document everything. Critically, ignore any "recovery service" that contacts you promising to retrieve your funds for a fee, these prey on victims and are a second scam. Recovering stolen crypto is often not possible, but reporting helps authorities and may assist others.

Do I really need a hardware wallet, or is my exchange account secure enough? A reputable exchange with strong security and app-based 2FA is reasonable for small, active amounts, but it's not equivalent to self-custody for meaningful holdings. Exchanges can be hacked or fail, and funds on them have no government guarantee in Australia. A hardware wallet keeps your keys offline and in your sole control, removing most attack vectors. The larger and longer-term your holdings, the stronger the case for a hardware wallet. It's one of the highest-value security steps you can take once you're holding more than a small amount.

How often should I check my crypto security? A quick monthly review is a good rhythm: confirm your seed-phrase backups are safe and legible, check that app-based 2FA is active on your exchange and email, scan recent account activity for anything unfamiliar, install pending updates, and move any crypto that's built up on an exchange into your hardware wallet. Beyond that, stay alert to phishing and unsolicited contact year-round. A few minutes monthly is a small price for protecting real holdings.

---

Want an expert to sanity-check that your crypto security and storage are actually sound, before something goes wrong? Get an independent review with no token holdings and no conflicts. Book a free portfolio review call.

Next in the how-to hub: put it into practice with how to send, receive and swap crypto without costly mistakes.