How to secure your crypto funds

Key takeaways #

• You are the first and last line of defence — stolen crypto is almost never recovered.
• Store long-term holdings in a hardware wallet; treat exchanges as a trading float only.
• Your seed phrase is the single most valuable thing to protect. Never store it digitally or share it.
• Enable two-factor authentication (with an app, not SMS) on every exchange account.

If you’re wondering how to secure your cryptocurrency, the short answer is this: you are the security system. Unlike a bank account, there’s no fraud department to reverse a bad transfer — stolen crypto is almost never recovered. That sounds daunting, but the good news is that a handful of straightforward precautions, all of which you can set up in an afternoon, protect against the overwhelming majority of hacks and scams. This guide covers them.

Wallets #

A wallet is the most secure and reliable way to hold your private keys — the secret that proves ownership of your crypto and lets you send it. Web wallets and exchange balances should only be considered for relatively small amounts or for funds you’re actively trading. Larger holdings belong in a hardware wallet — a dedicated device that stores your keys offline and signs transactions without ever exposing them to your computer. For a full comparison, see our guide to hardware wallets vs software wallets.

When buying a hardware wallet:

• Purchase directly from the manufacturer (Ledger, Trezor, BitBox and similar), never from third-party resellers — tampered devices sold through marketplaces are a known attack vector.
• Consider a backup device as well, which lets you restore and verify your recovery phrase works without putting your primary wallet at risk.

Alongside the wallet, secure your seed phrase — the 12 to 24 words that can rebuild your wallet on any device. If someone else obtains it, they can take your funds without ever touching your hardware; if you lose it and the wallet fails, your funds are gone. Write it on paper or engrave it on metal, store copies in separate secure locations, never photograph it or save it in a password manager or cloud note, and never enter it into any website or app that asked you to “verify” it — that is always a scam.

Exchange accounts #

Most Australians start by buying on an AUSTRAC-registered exchange such as Swyftx, CoinSpot or Independent Reserve. Those platforms invest heavily in security, but your individual account is only as secure as you make it:

• Enable two-factor authentication (2FA) immediately. Use an authenticator app such as Google Authenticator or Authy rather than SMS, which is vulnerable to SIM-swap attacks.
• Use a unique, strong passphrase for every exchange — a password manager makes this easy.
• Consider a dedicated email address used only for crypto accounts, so phishing emails aimed at your main inbox stand out.
• Whitelist withdrawal addresses if your exchange supports it, so funds can only ever be sent to wallets you control.
• Never click links in emails or messages claiming to be from an exchange. Type the address yourself or use a saved bookmark.

Spotting scams #

Scams follow the money, and crypto is attractive to fraudsters. Watch for:

• Giveaway scams — anyone promising to multiply crypto you send them is stealing it. See our guide on protecting yourself from Bitcoin address scams.
• Fake support accounts — real exchanges will never ask for your password, 2FA codes or seed phrase.
• Urgent investment opportunities — pressure to act quickly is the signature of a scam, in crypto as everywhere else.

The golden rules #

1. Long-term holdings live in a wallet where you control the keys — “not your keys, not your coins.”
2. Never give your private key or seed phrase to anybody, ever.
3. 2FA on everything, app-based wherever possible.

These steps take an afternoon to set up and are the difference between an annoying phishing email and losing your savings.

Frequently asked questions #

Where should I store my crypto? Small, actively traded amounts can stay on a reputable Australian exchange with 2FA enabled. Anything you’re holding long-term belongs in a wallet where you control the keys — see our comparison of hardware wallets vs software wallets.

Is it safe to keep crypto on an exchange? Reasonably safe for small amounts: AUSTRAC-registered Australian exchanges invest heavily in security. But the exchange holds the keys, not you, and platforms have failed historically — so treat an exchange balance as a trading float, not a savings account.

Should I use SMS or an app for two-factor authentication? Use an authenticator app such as Google Authenticator or Authy. SMS codes can be intercepted through SIM-swap attacks, where a fraudster transfers your phone number to their own SIM.

What should I never do? Never share your seed phrase or private key with anyone, never type them into a website, and never send crypto to someone who promises to return more than you sent. Legitimate services never ask for any of these things.