Securing your crypto wallet: seed phrase, hardware wallet and 2FA

In short: If you keep crypto in your own wallet, you manage the keys yourself. That gives you control but also responsibility: if you lose your seed phrase or someone else gets it, you can lose your crypto and no one can reverse it.

Step by step

1. Decide how much crypto you want to leave on an exchange and how much to keep in your own wallet.
2. For larger amounts, choose a hardware wallet, and buy it directly from the manufacturer.
3. Write your seed phrase on paper or metal, and keep it offline in a safe place.
4. Turn on two-factor authentication (2FA) on all your exchange accounts, preferably with an authenticator app or security key.
5. Check addresses carefully before you send crypto. If you like, start with a small test amount.
6. Never share your seed phrase with anyone.

Why self-custody matters

At a bank, your money sits in an account the bank manages. With crypto, the private keys decide who can control the crypto. An exchange manages the keys for you. In your own wallet, you manage them yourself. There is a saying: “not your keys, not your coins”.

Both approaches have pros and cons:

Crypto providers can be hacked or go bankrupt. Well-known examples are the collapse of Mt. Gox and FTX, where customers were unable to access their assets for a long time. Crypto is generally not covered by the deposit guarantee scheme or investor compensation. Read what is and is not protected in investor compensation and deposit guarantee.

Hot and cold wallets

• Hot wallet: a wallet connected to the internet, such as an app on your phone or a browser extension. Convenient for regular use, but more vulnerable to phishing and malware.
• Cold wallet: a wallet whose keys are offline, such as a hardware wallet. Less convenient for fast trading, but better protected against attacks via the internet.

Many people use both: a hot wallet or exchange for the amount they use actively, and a cold wallet for the amount they hold for longer. How you split this depends on your amount and your use. Always buy a hardware wallet directly from the manufacturer, not second-hand, to avoid a tampered device.

The seed phrase: your master key

When you create a wallet you usually get a list of 12 or 24 words: the seed phrase (recovery phrase). With it, someone can restore your wallet on any device and control your crypto. No one can reverse this and no one will help you if it goes wrong.

What you had better not do:

• take a photo or screenshot;
• type the phrase into a notes app, an email or a cloud document;
• share it via chat or email;
• enter it on a website, unless you are certain you are restoring your own wallet on an official device or app.

What you can do:

• write the words by hand, on paper or on a metal plate that can withstand fire and water;
• keep a copy in a second safe place, so you do not lose everything in a fire or burglary;
• practise restoring with a small amount a few times, so you know your backup works;
• tell no one. A genuine provider or support agent never asks for your seed phrase.

Securing accounts with 2FA

Two-factor authentication (2FA) asks for a second proof in addition to your password, so a stolen password alone is not enough.

• SMS codes are the weakest form. A scammer can take over your phone number (SIM swap).
• An authenticator app is safer than SMS.
• A security key (hardware key) often offers the best protection against phishing.

Use a unique, long password for every exchange. A password manager can help. Many exchanges also offer a list of trusted withdrawal addresses (whitelist), anti-phishing codes and alerts for logins or withdrawals. Turn these on where you can.

Recognising scams

Scammers target crypto holders. Recognise these signs:

• Promises of guaranteed or very high returns. Trustworthy providers do not guarantee returns.
• Time pressure, such as “deposit today”.
• Requests for your seed phrase or a code you received by text or email. A genuine provider never asks for this.
• Fake websites or apps that look like the real ones. Type the address yourself or use a bookmark instead of clicking a link in a message.
• Unknown providers without a licence. In the EU, crypto service providers fall under the MiCA regulation. Check in the regulator’s register, in the Netherlands the AFM, whether a provider is authorised.
• Messages from “support” that approach you first.

If you fall victim to a scam, report it to your bank and the police. A crypto transaction usually cannot be reversed.

Checklist

• I know how much I leave on an exchange and how much is in my own wallet.
• My seed phrase is offline, in one or two safe places, and I have tried the recovery procedure.
• 2FA is on, preferably not via SMS.
• I use unique passwords.
• I check addresses before sending crypto.
• I share my seed phrase with no one.

Investing in crypto involves high risk: you can lose some or all of your money. This tutorial is information, not investment advice.