guide
How to secure your crypto: accounts, wallets and backups
Protect crypto accounts and backups, plan wallet recovery, verify transfers and respond when login details or wallet secrets are exposed.
Start with who controls access
With an exchange account, the provider controls the wallet keys and you depend on its custody and withdrawal processes. With self-custody, you control the signing keys and recovery arrangements. Either setup can fail. Choose responsibilities you can actually manage before moving money.
Write down three answers: how will I regain access if my phone disappears, where is my recovery information, and who could access it? Keep secrets out of that written plan.
Protect your email and exchange login
Use a unique, long password stored in a password manager for each account, including email. Enable multifactor authentication. Where supported, prefer a phishing-resistant passkey or security key; authenticator codes can still be stolen by a fake login page. Store recovery codes securely and review signed-in devices.
Open the service through a verified bookmark or installed official app. Apply device and app updates. Never approve an unexpected login prompt or give a caller your password, recovery code or one-time code.
Limit what connected tools can do
Enable withdrawal-address restrictions and alerts where available, and understand any activation delay. Review API keys: a portfolio tracker should not need trading or withdrawal access. A trading tool may need trading access, but that does not justify withdrawals.
Delete unused keys and restrict supported keys by IP address or expiry when practical. A key without withdrawal permission can still place losing trades; limited permissions reduce possible harm without making an untrusted tool safe.
Treat the recovery phrase as control of the wallet
For a wallet using a recovery phrase, the words can restore its keys. They are different from an app password or device PIN. Someone who obtains the required recovery information may access funds from another device.
Generate the backup through the official wallet setup. Record it accurately and protect an offline copy from theft, fire and water. Do not photograph it, upload it to cloud storage, paste it into a website, or send it to support. Never use a wallet supplied with a prewritten phrase.
Use the manufacturer’s supported backup-check procedure. Do not wipe a funded wallet to experiment with recovery. If using an optional passphrase, understand that losing it can also lose access.
Choose a wallet by capabilities, not a ranking
Cold storage aims to keep signing keys away from everyday online software. For a hardware wallet, assess the device, its recovery process and the actions you will authorize together.
Confirm support for your exact asset and network, and understand which companion software is required.
Check how you will verify the destination and amount on the device before signing.
Read the update, backup and recovery instructions before funding; a workflow you cannot follow is a practical risk.
Buy through a manufacturer’s verified channel and initialize it yourself. Moving an already exposed recovery phrase into new hardware does not make that phrase secret again.
Remember that a hardware wallet cannot make a malicious transaction or approval safe just because you sign it on a device.
Check every transfer
Confirm the receiving service supports the asset on the chosen network. Compare the entire destination address with the verified receiving screen; include a required memo or destination tag. Check fees and minimum deposits before sending.
For a new, independently verified destination, a small test can help confirm the transfer route. Wait for it to arrive before sending more, then recheck the details. A successful test does not prove the recipient is honest or guarantee a later transfer will succeed.
Match the response to what was exposed
Account login: from a trusted device, secure your email and exchange account, revoke unfamiliar sessions and API keys, and contact the provider through its official channel.
Token approval: follow the wallet’s official instructions to review and revoke unwanted allowances. Disconnecting an app alone does not revoke onchain approvals. Revocation does not recover assets already transferred.
Private key or recovery phrase: changing the app password does not fix the exposure. Use official guidance to create a fresh wallet in a clean environment and move remaining assets if possible. Retire accounts derived from the compromised backup. If a sweeper may be present, do not add funds for gas; seek official wallet guidance first.
Review date
Reviewed 15 October 2026. Check the linked primary sources for current provider instructions and applicable protections.
Frequently Asked Questions
Can support recover a lost recovery phrase?
Derivatives & Leveraged Products — Important Risk Warning
Derivatives and leveraged products are complex and carry a high risk of rapid, substantial losses. Depending on the product and account rules, losses can exceed the initial margin or money committed. A stand-alone purchased option can lose its entire premium plus transaction costs; writing options, exercising into another position, or combining positions can create additional obligations. An uncovered call writer can face unlimited loss. Applicable legal protections can affect the loss boundary.
You should carefully consider whether you understand how derivatives work and whether you can afford to take the high risk of losing your money. This content is for educational purposes only and does not constitute financial advice, investment advice, or a recommendation to trade derivatives.
Legal availability and regulatory protections depend on the product, service, provider and jurisdiction. In the EU, check the applicable investment-services rules, including MiFID II where relevant, and any product restrictions. Before trading, verify with the relevant regulator whether the provider has the permissions required for the service and whether the product may be offered to you. A website being accessible, or a product appearing on this website, does not establish authorization or eligibility.
Continue Learning
Get Started with Kraken
Before registering with Kraken, check the products available in your location, applicable fees and account requirements.
Visit KrakenAd · Digital asset prices are subject to high market risk and price volatility. Don't invest unless you're prepared to lose all the money you invest. Terms & risk disclosure
This page contains affiliate links. We may earn a commission if you sign up, at no extra cost to you.