In the crypto world, security is the first lesson. There's no customer service, no password recovery, no bank bailout. Once stolen, the probability of recovery is near zero.
This article summarizes the security incidents I've seen over the years, giving you a practical security framework.
Layer 1 Protection: Device Security
- Dedicated device: If possible, have a dedicated phone/computer for crypto operations — no games, no clicking unknown links, no jailbreaking/rooting.
- System updates: Update phone and computer systems immediately. Many theft cases happen because known vulnerabilities in old systems were exploited.
- Don't use public WiFi: Operating exchanges or wallets on cafe or airport WiFi makes you vulnerable to man-in-the-middle attacks. Use mobile data or home WiFi.
Layer 2 Protection: Account Security
- 2FA must use authenticator app: Don't use SMS verification (SIM cards can be cloned). Use Google Authenticator or Authy. And backup your authenticator's recovery codes (otherwise you can't log in if you lose your phone).
- Password manager: All exchange and wallet passwords should be different. Use 1Password or Bitwarden to generate and store passwords.
- Email isolation: The email used to register exchanges should not be used to register other websites. If this email is compromised, all exchange accounts are at risk.
Layer 3 Protection: Wallet Security
- Handwrite mnemonic phrase: Never screenshot, never save on computer, never send via WeChat. Handwrite on paper and store in a place only you know.
- Verify receiving address: Every time you withdraw coins, must verify the address on the hardware wallet's screen (not on the computer/phone screen). This prevents clipboard replacement by malware.
- Test with small amount first: First withdraw a small test (e.g., $10-$50) to a new address, confirm it arrives, then withdraw the large amount.
Layer 4 Protection: DeFi Security
- Only authorize needed amount: When authorizing in DeFi protocols, don't click "authorize all", only authorize the amount you intend to use.
- Regularly revoke authorizations: Go to
revoke.cashto view all authorizations for your address, and revoke unused protocol authorizations. - Only use mainstream protocols on Ethereum: Uniswap, Aave, Compound — these have been verified over years and are relatively safe. New projects and anonymous team projects — enter cautiously.
A Checklist (Save for Reference)
□ Mnemonic phrase handwritten and stored in safe place
□ Exchange has 2FA enabled (authenticator app, not SMS)
□ Exchange password and email password generated with password manager (not reused)
□ Large amounts withdrawn to hardware wallet
□ Phone/computer not jailbroken/rooted, no unknown apps installed
□ Checked revoke.cash and revoked unused authorizations