Crypto security advice often sounds like a personality test: are you a “cypherpunk” or a “normie”? Ignore that. You are a person using software that can move value irreversibly. The goal is to reduce the number of ways a bad afternoon can become a permanent loss.
You will not eliminate risk. You can stop the common failures. That is already a large improvement on how many first-time users behave — which is: download an app, copy an address from a chat, skip the test transaction, and store the phrase in the same phone that has the wallet.
Before you receive anything of value
Update the phone or laptop. Turn on the vendor’s official two-factor method for any exchange account — an authenticator app, not SMS if you can help it. Bookmark official sites yourself. The first result in a search ad is not a source of truth.
If you self-custody, create the wallet, write the recovery phrase on paper, and confirm you can restore it on a spare device or after a reinstall. Do this while the balance is zero. A backup you have never tested is a story you tell yourself.
Sending: the five-second look that saves people
Check the asset. Check the network. Check the full address, not the first and last four characters in a screenshot someone else provided. Malware exists that swaps addresses on the clipboard. A hardware wallet that shows the destination on its own screen is helpful because it is harder for the laptop to lie to you.
Send a small test, wait for it to arrive, then send the rest. It feels unsophisticated. It is how professionals avoid sophisticated embarrassment.
Never type a recovery phrase into a website to “validate” a wallet.
Never let a stranger remote-control your screen to “help recover funds”.
Never approve a contract signature you do not understand; read the wallet’s warning.
Approvals, airdrops, and “free” tokens
On account-based chains like Ethereum, you can grant a contract permission to move tokens later. Attackers love unlimited allowances. Revoke approvals you do not use. Ignore surprise tokens in the wallet; they are often bait to make you visit a malicious site that asks for a signature.
Giveaways that require you to send coins first are not giveaways. Support agents who message you first are not support. Urgency is the tell.
Physical world, still in play
Phones get stolen. Houses flood. People die without leaving instructions. If you hold a meaningful amount, think about a boring inheritance plan: a sealed envelope with a lawyer or a trusted person, or a multi-person setup you actually understand. Clever schemes you cannot explain to your future self will fail your future self.
What this checklist is not
It is not a guarantee. It is not a recommendation to hold crypto at all. Exchanges can fail. Hardware can fail. You can still be phished on a day you are tired. If a sum would change your life if it vanished, treat the process with the same seriousness you would treat a large wire. If that sounds like too much process, that is also useful information — perhaps this asset class is not for that sum.
Device hygiene, the unfashionable half
Keep the operating system current. Separate a “money phone” from the one that installs every new game, if you can. Browser extensions that want wallet access should be treated like strangers with a house key. Download apps from the vendor’s site or the official store listing you verified twice, not from a sponsored result that bought the brand name.
Public Wi-Fi plus a hot wallet is a combination you can survive and need not seek out. A password manager for exchange logins is not optional if you reuse passwords anywhere else in your life — and most people do.
When something already feels wrong
If you signed a bad approval, revoke it from a known-good machine, then move remaining funds to a fresh wallet whose phrase never touched the compromised device. If an exchange login looks off, change the password and freeze withdrawals from another device if they offer that. If you sent to the wrong address, assume it is gone unless the recipient is a honest service with a recovery process — many are not.
Write down what you clicked. Screenshots of the transaction hash help support more than a panic paragraph. Then stop. Tired people sign the second trap.
EasyCryptoGuides publishes education, not a security audit of your life. When in doubt, slow down. The chain will still be there in twenty minutes. The fake support chat will not.
