Security 101

Why Crypto Security Matters More Than Bank Security

In traditional banking, if someone steals your credit card or hacks your account, the bank can reverse the transaction and restore your funds. In crypto, there is no bank, no customer service, and no chargebacks. If someone gains access to your private key or seed phrase, your funds are gone permanently — no institution can reverse a blockchain transaction. This is why personal security is the single most important skill in crypto.

Essential Security Steps for Everyone

1. Enable 2FA (two-factor authentication) on every crypto account — use an authenticator app like Google Authenticator or Authy, never SMS-based 2FA (vulnerable to SIM swapping)
2. Write your seed phrase on paper and store it in a secure physical location — never take a photo, screenshot, or store it digitally
3. Use a hardware wallet (Ledger, Trezor) for any holdings worth more than a few hundred dollars
4. Bookmark the official URLs of exchanges and dApps — phishing sites with nearly identical URLs are the most common attack
5. Never click links in crypto-related emails, DMs, or social media messages

Common Scams to Watch For

• Phishing websites — fake exchange or wallet sites that steal your login credentials
• Fake customer support — scammers posing as exchange support staff in Telegram, Discord, or Twitter DMs
• Too-good-to-be-true yields — any project promising 100%+ APY is almost certainly a scam or Ponzi scheme
• Airdrop scams — fake free token claims that ask you to connect your wallet and approve a malicious contract
• Romance/pig butchering scams — long-running social engineering where scammers build trust before directing victims to fake investment platforms

Hardware Wallet Best Practices

A hardware wallet is the cornerstone of crypto security. It keeps your private keys on a dedicated secure chip that never exposes them to your computer or the internet. Even if your computer is compromised with malware, a hardware wallet protects your keys. However, hardware wallet security only works if you follow proper practices — a hardware wallet paired with a seed phrase stored in a cloud note defeats the entire purpose.

1. Buy only from the manufacturer's official website — never from Amazon, eBay, or third-party sellers (risk of tampered devices)
2. Set up the device on a clean computer, ideally one that is not your daily-use machine
3. Write down the seed phrase on the included recovery card and immediately store it securely
4. Always verify transaction details on the hardware wallet's screen before confirming — malware can alter what you see on your computer
5. Use a passphrase (25th word) for additional protection — even if someone finds your seed phrase, they cannot access funds without the passphrase

Seed Phrase Storage Strategies

• Paper backup — write on the included card, store in a fireproof safe. Simple but vulnerable to fire, flood, and physical theft
• Metal backup — stamp or engrave onto steel plates (Cryptosteel, Billfodl). Survives fire and water damage. Recommended for significant holdings
• Split storage — divide the seed phrase and store portions in separate secure locations. Reduces single-point-of-failure risk
• Safe deposit box — bank safe deposit boxes provide physical security, but access depends on bank hours and your local jurisdiction's laws

Operational Security (OpSec) for High-Value Holdings

As your crypto holdings grow, your security practices must scale accordingly. Sophisticated attackers use social engineering, SIM swapping, physical threats, and supply chain attacks. Operational security (OpSec) is the discipline of protecting sensitive information by thinking like an attacker and systematically eliminating vulnerabilities.

Advanced Security Architecture

• Multi-sig setup (2-of-3 or 3-of-5) using Gnosis Safe for large holdings — no single compromised key can move funds
• Geographic distribution — store signing keys in different physical locations (home safe, bank deposit box, trusted family member)
• Dedicated devices — use a separate laptop (ideally air-gapped) exclusively for crypto transactions, never for browsing or email
• Hardware security keys (YubiKey) for 2FA on exchanges and email — phishing-proof unlike TOTP authenticator codes
• Unique, strong passwords per service using a hardware-encrypted password manager
• Separate email address used only for crypto accounts — never publicly associated with your identity

Protecting Against Social Engineering

In 2025-2026, AI-generated phishing has become extremely sophisticated — deepfake video calls impersonating exchange CEOs, AI-written emails indistinguishable from legitimate communications, and voice clones of trusted contacts. The defense is process-based: never take security-critical actions based on a single communication channel. Always verify through a separate, pre-established channel. If someone calls claiming to be from your exchange, hang up and call the official number yourself.

Incident Response Plan

1. If you suspect a seed phrase is compromised: immediately transfer all assets to a new wallet generated from a new seed on a known-clean device
2. If an exchange account is compromised: contact exchange support immediately, provide identity verification, and request an account freeze
3. If you clicked a suspicious link or approved a malicious contract: revoke all token approvals immediately using Revoke.cash, then transfer remaining assets to a clean wallet
4. Document everything with timestamps for potential law enforcement reporting
5. Consider engaging a blockchain forensics firm (Chainalysis, TRM Labs) for significant losses

Shamir's Secret Sharing and Advanced Key Management

Shamir's Secret Sharing (SSS), implemented in the crypto space as SLIP-39, splits a seed phrase into multiple shares where only a threshold number of shares are needed to reconstruct the original secret. For example, a 3-of-5 scheme creates 5 shares and requires any 3 to recover the seed — meaning you can lose 2 shares and still recover, while an attacker needs to obtain 3 separate shares from different locations. Unlike naive seed splitting (dividing 24 words into groups), Shamir's method is cryptographically secure: any fewer than the threshold shares reveal zero information about the original seed. Trezor hardware wallets natively support SLIP-39 backup, and tools like SSKR (Sharded Secret Key Reconstruction) from Blockchain Commons provide an open standard for this approach.

• SLIP-39 (Shamir Backup) — splits a seed into M-of-N shares using Shamir's Secret Sharing; natively supported by Trezor; any subset below the threshold reveals nothing
• Multisig vs. SSS — multisig (Gnosis Safe) distributes signing authority on-chain with M-of-N keys; SSS distributes recovery capability off-chain. Multisig is transparent on-chain but costs more gas; SSS is invisible on-chain but requires trust during reconstruction
• Advanced OpSec layers: use a dedicated email with ProtonMail, route crypto traffic through a VPN or Tor, use separate browser profiles for each DeFi ecosystem, and never reuse wallet addresses across identities
• Threat modeling: consider your specific adversaries (opportunistic hackers, sophisticated state actors, physical threats, insider risk) and scale defenses accordingly — a $10K portfolio needs different protection than a $10M one
• Dead man's switch and inheritance planning: use services like Sarcophagus (decentralized dead man's switch) or Casa's inheritance protocol to ensure trusted heirs can access funds if you become incapacitated, without giving them access during your lifetime