Crypto Security Basics

Why security deserves its own guide

In self-custody, there is usually no institution that can reverse a mistaken or fraudulent transaction. A confirmed transaction is generally final. That makes good security habits a core skill for anyone holding crypto directly, not an optional add-on.

Protecting your private key and seed phrase

A private key or seed phrase is the actual credential that controls a wallet's assets — not a password that can be reset. Anyone who obtains it can move the funds it controls. It should never be typed into a website, sent in a message, or stored in an unprotected digital file such as a plain note or screenshot.

Recognizing phishing

Phishing is an attempt to trick someone into revealing credentials or approving a harmful transaction, often by impersonating a legitimate service, contact, or support agent. Common signs include unexpected urgency, requests for a seed phrase or private key, and links that lead to a site with a slightly altered domain name.

Cold storage and reducing exposure

Cold storage means keeping keys on a device or medium that stays offline, away from internet-connected software that could be compromised remotely. It does not remove every risk, but it meaningfully reduces exposure to remote attacks compared with keys that live only on an always-connected device.

Verifying before you sign

Before approving any transaction, check the destination address, the network, and exactly what permissions are being requested. A familiar-looking interface is not proof that a request is safe — verification is something the user has to do deliberately, every time.

What to remember

• Self-custody transactions are generally final, which makes prevention more important than recovery.
• Never share a private key or seed phrase with anyone, in any context.
• Phishing relies on urgency and impersonation — slow down and verify before acting.
• Cold storage reduces, but does not eliminate, exposure to remote attacks.
• Always verify the destination, network, and requested permissions before signing a transaction.