Your Keys Your Crypto

To own your crypto you need to own the private key. If your crypto is on an exchange, you do not own it and you therefore do not own your crypto. Many CEXs are insured for a certain amount during a hack or other event where crypto can be stolen. However, this amount is almost never enough to pay everyone.

Depending on your investment, a reputable hardware wallet such as the Ledger Nano S can be a wise choice. A ledger is already available for about € 60. By storing your private keys on this you own your crypto and you can sell it whenever you want (something that is not always possible on exchanges).

Acces To Your Crypto

Hardware wallet:

1. Write down your recovery phrase. Definitely don't take a screenshot of this! There are now malwares that recognize the words from the recovery phrase and forward them. Save your recovery phrase in two places that are preferably known only to you. Depending on the value of the wallet, a special metal backup plate may be sensible. In the event of a fire, the code remains legible.
2. Test your recovery seed phrase you wrote down. Nothing is more stupid than a wrong recovery phrase when you need it. You can test the recovery phrase simply by resetting your wallet.
3. Makes sense, but don't leave your hardware wallet lying around and make sure that no one can see your hardware wallet PIN code.

CEX:

1. Choose a well-known exchange. It is likely that a larger exchange has better security than an unknown party. In the event of a hack, they are probably also better insured.
2. Use an email address that is well secured. Make sure that the password consists of enough characters and is not the same as that of the exchange. Preferably change your password periodically. Also set a 2FA (more later). Many email providers nowadays have a recovery code, write it down as well.
3. Choose a password that you only use for the crypto exchange! It happens too often that people access accounts through previously leaked passwords, prevent this by using a unique password.
4. Set a phone number. In some countries it is easy for scammers to transfer a phone number to another SIM. In that case, use another 2FA method such as Google Authenticator.
5. Set an IP lock. Some exchanges (e.g. Kucoin) have the option to set an IP lock. If enabled, when your login IP changes, the account protection mechanism will be immediately triggered and you will be logged out automatically.
6. Set a safety phrase. This phrase is visible in the emails you receive from the exchange. This makes recognizing fake emails child's play.
7. One of the most important steps is to set up a 2FA method like Google Authenticator. This security is considered by many people to be the better option over SMS verification because it is more difficult for hackers to access. Please note that once you lose access to the app, you will no longer have access to the codes. It is wise to also make a backup of your 2FA account. In Google Authenticator this can be done by generating a QR code under 'Transfer Account'. Preferably don't make a screenshot of this either, I simply copied it directly by placing my mobile on the printer. A great alternative to use is Authy.

Common sense

Possibly the most important mechanism you need. If it seems too good to be true then it is. There is no one who is going to double your deposit if you send it to him, there is also no prince in Nigeria who wants to give you money. Always check the website you log in to and never, ever leave your recovery seed phrase behind. Preferably do not trade crypto on public WiFi networks. With videos on social media, always think about the interests of the person in the video before you do anything. And finally, never tell online and preferably not in real life how much crypto you have. Talk about profit in percentages instead of money.

Simply doing these things will prevent most scams.

​

P.S. Not really to do with security, but it is often also possible to backup your portfolio (e.g. in Delta under Settings -> Device and Data -> Generate Recovery Code).

​

EDIT1: Forgot to mention Authy as great alternative to Google Authenticator. Thanks to /u/subcow for reminding me.