1. Ditch SMS: Use phishing‑resistant 2FA everywhere
If you’re still relying on SMS codes to secure your accounts, you’re leaving yourself exposed.
SIM‑swap attacks remain one of the most common ways criminals drain wallets, and prosecutors continue to seize millions tied to them.
The safer move is phishing‑resistant two‑factor authentication (2FA) (think hardware security keys or platform passkeys).
Start by locking down your most critical logins: email, exchanges and your password manager.
US cybersecurity agencies like the Cybersecurity and Infrastructure Security Agency stress this because it blocks phishing tricks and “push‑fatigue” scams that bypass weaker forms of multi‑factor authentication (MFA).
Pair it with long, unique passphrases (length beats complexity), store backup codes offline and on exchanges and turn on withdrawal allowlists so funds can only move to addresses you control.
Did you know?Phishing attacks targeting crypto users rose by 40 % in the first half of 2025, with fake exchange sites being a major vector.
2. Signing hygiene: Stop drainers and toxic approvals
Most people don’t lose funds to cutting‑edge exploits; they lose them to a single bad signature.
Wallet drainers trick you into granting unlimited permissions or approving deceptive transactions. Once you sign, they can repeatedly drain your funds without asking again.
The best defense is slowing down: Read every signature request carefully, especially when you see “setApprovalForAll,” “Permit/Permit2” or an unlimited “approve.”
If you’re experimenting with new decentralized applications (DApps), use a burner wallet for mints or risky interactions and keep your main assets in a separate vault. Periodically revoke unused approvals using tools like Revoke.cash — it’s simple and worth the small gas cost.
Researchers are already tracking a sharp rise in drainer‑driven thefts, especially on mobile. Good signing habits break that chain before it starts.
3. Hot vs. cold: Split your spending from your savings
Think of wallets the way you think of bank accounts.
- •
A hot wallet is your checking account — good for spending and interacting with apps.
- •
A hardware or multisig wallet is your vault — built for long‑term, secure storage.
Keeping your private keys offline eliminates nearly all exposure to malware and malicious websites.
For long‑term savings, write down your seed phrase on paper or steel: Never store it on a phone, computer or cloud service.
Test your recovery setup with a small restore before transferring serious funds. If you’re confident managing extra security, consider adding a BIP‑39 passphrase, but remember that losing it means losing access permanently.
For larger balances or shared treasuries, multisig wallets can require signatures from two or three separate devices before any transaction is approved, making theft or unauthorized access far more difficult.
Did you know?In 2024, private key compromises made up 43.8 % of all stolen crypto funds.
4. Device and browser hygiene
Your device setup is as important as your wallet.
Updates patch the very exploits attackers rely on, so enable automatic updates for your operating system, browser and wallet apps, and reboot when needed.
Keep browser extensions to a minimum — several high‑profile thefts have resulted from hijacked or malicious add‑ons. Using a dedicated browser or profile just for crypto helps prevent cookies, sessions and logins from leaking into everyday browsing.
Hardware wallet users should disable blind signing by default: It hides transaction details and exposes you to unnecessary risk if you’re tricked.
Whenever possible, handle sensitive actions on a clean desktop instead of a phone packed with apps. Aim for a minimal, updated setup with as few potential attack surfaces as possible.
5. Verify before you send: Addresses, chains, contracts
The easiest way to lose crypto is by sending it to the wrong place. Always double‑check both the recipient address and the network before you hit “send.”
For first‑time transfers, make a small test payment (the extra fee is worth the peace of mind). When handling tokens or non‑fungible tokens (NFTs), verify you’ve got the correct contract by checking the project’s official site, reputable aggregators like CoinGecko and explorers such as Etherscan.
Look for verified code or ownership badges before interacting with any contract. Never type a wallet address manually — always copy and paste it, and confirm the first and last characters to avoid clipboard swaps. Avoid copying addresses directly from your transaction history, as dusting attacks or spoofed entries can trick you into reusing a compromised address.
Be extra cautious with “airdrop claim” websites, especially those requesting unusual approvals or cross‑chain actions. If something feels off, pause and verify the link through official project channels. And if you’ve already granted suspicious approvals, revoke them immediately before proceeding.
6. Social engineering defense: Romance, “tasks,” impersonation
The biggest crypto scams rarely rely on code — they rely on people.
Romance and pig‑butchering schemes build fake relationships and use counterfeit trading dashboards to show fabricated profits, then pressure victims to deposit more or pay fictitious “release fees.”
Job scams often begin with friendly messages on WhatsApp or Telegram, offering micro‑tasks and small payouts before turning into deposit schemes. Impersonators posing as “support staff” may then try to screen‑share with you or trick you into revealing your seed phrase.
The tell is always the same: Real support will never ask for your private keys, send you to a lookalike site or request payment through Bitcoin ATMs or gift cards. The moment you spot these red flags, cut contact immediately.
Did you know?The number of deposits into pig‑butchering scams grew by approximately 210 % year‑over‑year in 2024, even though the average amount per deposit fell.
7. Recovery readiness: Make mistakes survivable
Even the most careful people slip up. The difference between a disaster and a recovery is preparation.
Keep a short offline “break‑glass” card with your key recovery resources: verified exchange support links, a trusted revocation tool and official reporting portals such as the Federal Trade Commission and the FBI’s Internet Crime Complaint Center (IC3).
If something goes wrong, include transaction hashes, wallet addresses, amounts, timestamps and screenshots in your report. Investigators often connect multiple cases through these shared details.
You may not recover funds immediately, but having a plan in place turns a total loss into a manageable mistake.
If the worst happens: What to do next
If you’ve clicked a malicious link or sent funds by mistake, act fast. Transfer any remaining assets to a new wallet you fully control, then revoke old permissions using trusted tools like Etherscan’s Token Approval Checker or Revoke.cash.
Change your passwords, switch to phishing‑resistant 2FA, sign out of all other sessions and check your email settings for forwarding or filtering rules you didn’t create.
Then escalate: Contact your exchange to flag the destination addresses and file a report with IC3 or your local regulator. Include transaction hashes, wallet addresses, timestamps and screenshots; those details help investigators connect cases, even if recovery takes time.
The broader lesson is simple: Seven habits (strong MFA, careful signing, separating hot and cold wallets, maintaining clean devices, verifying before sending, staying alert to social engineering and having a recovery plan) block most everyday crypto threats.
Start small: Upgrade your 2FA and tighten your signing hygiene today, then build up from there. A little preparation now can spare you from catastrophic losses later in 2025.