Download the report now
You will also receive our daily newsletter
By entering your email address, you agree to be subscribed to our daily newsletter where you will get the latest crypto news and trends. You can unsubscribe anytime.
Menu
Home > Best Crypto Security Practices
Best Crypto Security Practices
Lesson 1: Why You Need to Secure Your Crypto
Lesson 2: Passwords, 2FA and Hardware Wallets
Lesson 3: Hardware Wallets, Seed Phrases and Securing your Browser
Lesson 4: Always be Careful
Best Security Practices
While crypto transactions per se are essentially secure, cryptocurrencies can get stolen depending on where they are kept. A centralized exchange, for example, is still vulnerable to attacks as it has a single point of failure by design, which is why hackers tend to target exchanges. If you keep your cryptocurrencies on an exchange or an online wallet, you risk having your valuable assets stolen from you.
And so, as a crypto holder, you need to take certain precautionary measures to keep your cryptos safe.
Lesson 1
Why You Need to Secure Your Crypto
Securing your crypto accounts does take a lot of time. It’s not only that you need time to audit your personal security system but you may also need time to change your current behaviour or habits. But if you’re in it for the long term and value your financial well-being, you need to start taking this seriously. Stop making excuses like you’re not used to taking full control of your assets or that the odds of losing cryptos to some hacker is low. It’s an absolute necessity to secure your crypto accounts once you start investing in cryptocurrencies.
As a crypto holder or investor, it’s your responsibility to keep your cryptos safe and navigate the digital world securely.
Lesson 2
Passwords, 2FA and Hardware Wallets
Tip 1. Never reuse passwords
The most common thing that many people do when signing up to different website services is to use the same password for all of them so that they wouldn’t have to remember too many passwords. However, this is a risky thing to do because certain websites could have leaked your password and hackers would take advantage of this. It’s only a matter of time until your password is compromised and your accounts get hacked. Therefore, always use unique passwords. If you would like to know whether your password has been leaked, visit https://haveibeenpwned.com
Tip 2. Use a password manager
Creating a unique password for each website can be tough — how could you possibly remember them all? To make it easy for you, use a password manager like 1Password or LastPass that would generate a long and strong password for each account. You would only have to remember the master password and let the password manager do the rest.
Tip 3. Secure your mobile phone
This is particularly for those in the United States where there have been many incidences of SIM-jacking. Telco providers don’t usually have a top notch security level and with your personal information that can be obtained through the Internet, perpetrators could convince telcos to transfer your phone number to a new SIM card. Once transferred, hackers could obtain your passwords especially if you enable SMS-based 2FA. Follow this excellent guide from Kraken on how to secure your mobile number as well as the email address associated with your telco account.
Tip 4. 2FA everything
You should use 2-factor authentication (2FA) for every service that offers it. Use apps like Google Authenticator or Authy instead of SMS-based 2FA as it’s not secure. Hackers can do a SIM swap which is tricking mobile carriers into porting your phone number to a new device. If you use Authy, make sure you install it on another backup device and then disable the multiple device feature for an added security measure.
Tip 5. Consider using hardware-based 2FA
If you have the funds, consider upgrading to a hardware-based 2FA like Yubico, Google Titan, and Thetis. This changes your 2FA from an app to a physical USB device that you will need to authenticate before logging in. Hardware-based security keys are based on the FIDO U2F standard, a security protocol that is difficult to intercept. They provide a fast, no-fuss way to use 2FA without relying on the app on your phone.
Lesson 3
Hardware Wallets, Seed Phrases and securing your Browser
Tip 6. Use a crypto hardware wallet
When starting to invest in crypto, most people would store crypto on MetaMask or other online wallets. Because those wallets are still connected to the Internet, there’s still the risk of attack. It’s highly encouraged that you start using a hardware wallet like Trezor or Ledger unless you’re happy to let a hacker take away all your coins one day. A hardware wallet may be costly, but it would be worth the expense especially when you invest in crypto over time and know that they will be safe from hackers.
Tip 7. Secure your Wallet Seed Phrase
You may choose the traditional way of storing your seed phrase offline by writing it down in your notebook. But paper has its limitations as it could be destroyed or made ineligible by water, coffee, fire or acid. To mitigate this, you may want to consider using a metal storage tool like Cryptosteel or Cobo which is designed to protect your seed phrase under nearly all robust circumstances.
Tip 8. Uninstall all Chrome extensions
Chrome extensions are useful to help improve productivity. However, they can act as keyloggers that can have access to your data, passwords or other confidential information. Hackers would take advantage of this to steal your crypto. So unless you absolutely trust the extension developer, uninstall them all. It’s not worth the risk.
If you must use a Chrome extension for whatever reason, then separate out your MetaMask extension to its own browser profile. You can create multiple profiles for all the different wallet extensions you need to use. This prevents hackers from reading and acquiring your data from other chrome extensions.
Tip 9. Limit smart contract approvals
When you interact with smart contracts, don’t allow unlimited token approvals. This would allow the smart contract to drain all your tokens if it gets hacked. To set limits on your wallet, click ‘Edit’ on Permission and change the spending limit to the amount you want to send. You can use Etherscan’s token approval checker to see which smart contracts that you have assigned an unlimited spending limit. Then, connect your wallet via Web3 and click the ‘Revoke’ button.
Tip 10. Don’t dox yourself
When you want to send crypto funds to someone else, be sure to use a crypto exchange platform. If you send funds straight from your wallet, you risk doxing your crypto balance as well as your entire transaction history (past and future). You may use FTX exchange which allows zero-fee transfer with some FTT staking.
Lesson 4
Always be Careful
Tip 11. Don’t click on ads
Make it a habit to never click on ads — especially Google Search ads. Now that Google has reversed the ban on crypto ads, it’s likely that more scam ads would appear. If you want to visit a website, ignore the phishing ads and look at the sites listed below them.
Tip 12. Never download or open files from strangers
You never know which file will end up installing a keylogger. If you’re using a Windows laptop, configure it to always show file extensions. Don’t open ZIP files from random strangers because they may contain dangerous files mixed with other types of files. Instead, learn to distinguish between data files (documents that you can open, edit, save and delete) and executable files which you would want to avoid.
File extensions you should avoid if they aren’t from trusted sources are:
bat, bin, cmd, com, cpl, exe, gadget, inf, ins, inx, isu, job, jse, lnk, msc, msi, msp, mst, paf, pif, reg, rgs, scr, sct, shb, shs, u3p, vb, vbe, vbs, vbscript, ws, wsf, wsh
Tip 13. Be careful of giveaway tweets and DMs
There are tons of scam giveaway messages via tweets, DMs, Youtube ads, Facebook comments, and many more. Ignore them all. Don’t waste your time and energy moderating or policing scam messages. If it’s too good to be true, it probably is!
Tip 14. Be careful with cold emails
Scammers can be slick. They can imitate existing crypto sites’ domain names and send you a scam email. If you’re not paying close attention, you wouldn’t notice the very tiny difference in the domain name or email address. Can you spot the difference in the email address below compared to CoinGecko’s? Notice how there is no dot on the “i” in coingecko.com. This actually happened and shows that scammers can easily add special characters representing crypto domains which are very difficult to spot. This is a scam email — don’t fall for it.
Tip 15. Use VPN on public WiFi
When you’re working in a public area, avoid using public WiFi. Instead, use a Virtual Private Network (VPN) such as ExpressVPN or NordVPN, which connects to the Internet via an encrypted tunnel that protects your data and identity. With a VPN, you’re connected to a server from another location that would access the Internet on your behalf. So not only that your data is protected but your location is hidden as well.