The overwhelming majority of crypto theft is not sophisticated. It is a convincing login page, a support agent in a live chat, and a person who did not expect to be targeted that day. This is the checklist that prevents it.
1. The recovery phrase
- Write it on paper. Not a screenshot, not a note in a phone, not a file in a cloud folder.
- Store it somewhere you alone can reach. A locked drawer beats an encrypted note on a device that also holds your email.
- Never enter it into any website. There is no legitimate reason for a site to ask.
- Splitting it into two parts in two places protects against theft and against losing the whole thing at once.
2. Recognising a fake site
Every scheme needs you to go somewhere. Check the address before you type anything: hover the link, read it left to right, and know the real one by heart. Spelling (1vit.com is not 1vlt.com) and character substitution are how these pages work. A bookmark is safer than a link in an email.
3. Never trust a stranger in a chat window
"Send us your phrase and we will recover it" is a scam, every time. Support staff of a real service never ask for a phrase, a password, or a code. Our article on scams lists the patterns that are running now.
4. Turn on two-factor, and use the strongest kind
An authenticator app or a hardware key is far stronger than a code sent by SMS. Set it on every account that holds a balance, including your email — that is the one everything else resets through.
5. Keep the device clean
- Update the operating system and the browser. Most exploits are patched already.
- Install nothing from a link in a message.
- Do not use a shared or public computer for anything that matters.
- Back up the files you need in two places, because a dead drive and a lost phrase look identical from here.
If it already happened: move what is left immediately to a new address with a new key, then change every password on every account that used the compromised device. Speed matters more than tidiness.
One habit that does most of the work
Do nothing on a request that arrives by message. Open the site yourself, type the address yourself, and check with a second channel if it involves money. That one habit prevents the large majority of losses. For what to do when a platform itself is a problem rather than your own device, see choosing an exchange.