Wallet and exchange safety for beginners
Most losses happen because of weak passwords, phishing and shared seed phrases, not because a blockchain was hacked. These habits fix that.
- On an exchange, the company holds your coins. In a self-custody wallet, you hold them, and the seed phrase is the only backup.
- Use an authenticator app or a security key for two-factor authentication.
- Never share your seed phrase. Send a small test transfer first.
Exchange or wallet: who holds the keys?
On an exchange (a custodial service), the company holds your coins and you log in to your account. It is convenient, but you depend on the company and on your own account security. In a self-custody wallet, you hold the private keys, so no company can freeze or lose your coins, but if you lose the keys, the coins are gone.
A common approach: keep money you are actively trading on a reputable exchange, and keep larger long-term holdings in self-custody once you are comfortable.
Your seed phrase
- It is a list of words (usually 12 or 24) that can restore your wallet anywhere.
- Anyone with the phrase controls the funds. No legitimate company or person will ever ask for it.
- Write it on paper or metal and store it offline in a safe place. Do not take a photo, store it in notes, email it or save it in a cloud drive.
- Consider keeping a second copy in a separate secure location.
Lock down your exchange account
- Use a unique, long password from a password manager.
- Turn on two-factor authentication with an authenticator app or hardware security key. Text-message codes are weaker because phone numbers can be hijacked.
- Enable an anti-phishing code if your exchange offers one.
- Turn on a withdrawal address allowlist so funds can only go to addresses you have approved.
- Check the website address every time, or use a bookmark.
API keys: connecting apps safely
Some tools ask for an exchange API key. Give the minimum permission needed, which for tracking or journaling is read-only. Never enable withdrawals on a key you give to a third party. Delete keys you no longer use.
Sending crypto safely
- Check the exact network (for example Ethereum, BNB Smart Chain, Tron). Sending on the wrong network can lose the funds.
- Copy the address, then compare the first and last characters after pasting. Clipboard malware can swap addresses.
- Send a small test amount first and wait for it to arrive.
- Then send the rest.
Keep your devices clean
- Keep your phone and computer updated.
- Install apps and browser extensions only from official sources, and keep them to a minimum.
- Do not use public Wi-Fi for crypto accounts without a trusted VPN.
- Use a separate email address for crypto accounts if you can.
Common mistakes
- Storing the seed phrase as a photo or note.
- Using the same password on several sites.
- Choosing SMS as the only two-factor method.
- Sending a large first transfer without a test.
- Giving withdrawal permission to a third-party app.
The short version of all of this on one page.