Traders spend months refining entries and almost no time on the part of the process where the largest single-event losses occur. Exchange failures, wallet drains and lost seed phrases have destroyed more crypto capital than bad trading ever has, and unlike a losing trade, none of it is recoverable.
This guide is about the operational side of holding crypto. It is not exciting, and it is the highest-return hour you will spend.
The custody spectrum
Every storage choice sits somewhere between convenience and control.
Exchange custody. The exchange holds the keys. Convenient for trading, and your balance is an entry in their database. If they fail, freeze withdrawals or get hacked, you are a creditor rather than an owner.
Hot wallet. Software on an internet-connected device. You hold the keys, but they exist on a machine that can be compromised.
Hardware wallet. Keys generated and stored on a dedicated device that never exposes them to your computer. Transactions are signed on the device itself.
Deep cold storage. Keys generated on a device that has never touched the internet, with the recovery phrase stored physically. Maximum security, minimum convenience.
Nobody should pick one. The right structure uses several.
A workable structure for a trader
Split holdings by purpose rather than by asset.
Trading capital stays on the exchange, because you cannot trade what you cannot access. Keep this to the amount you are genuinely willing to lose to an exchange failure. For most people that is a small fraction of total holdings.
Working capital sits in a hardware wallet you use regularly. This funds new positions and receives withdrawals. It is connected often enough to be practical.
Long-term holdings sit in a separate hardware wallet that interacts with almost nothing. No token approvals, no unfamiliar contracts, no signing messages from sites. This wallet's job is to sit still.
The separation is the point. A compromise of the wallet you use daily should not reach the one holding the bulk of your capital.
Seed phrases
Your recovery phrase is the wallet. The hardware device is a container; the phrase is what actually controls the funds. Anyone who reads it owns your crypto, permanently.
What not to do
- Photograph it. Phone photos sync to cloud storage automatically.
- Type it into anything. Password managers, notes apps and spreadsheets are all networked eventually.
- Email it to yourself. Email accounts are the most commonly compromised thing you own.
- Store the only copy in one place. House fires, floods and moves happen.
What to do
Write it on paper to begin with, then transfer it to metal. Steel backup plates cost a modest amount and survive fire and water, which paper does not.
Keep at least two copies in physically separate locations. A bank deposit box and a home safe is a common arrangement. The risk you are managing is not only theft; it is loss of the single copy.
Consider a passphrase, sometimes called the twenty-fifth word. It creates an entirely separate wallet from the same seed, so someone who finds your phrase does not automatically get your funds. The cost is that forgetting the passphrase loses the wallet permanently, so it needs its own careful storage plan.
Test your backup before you rely on it. Restore the wallet from your written phrase onto a device and confirm the addresses match. A backup you have never tested is a hope, not a backup.
Token approvals
This is the mechanism behind a large share of wallet drains, and most people do not know it exists.
When you interact with a decentralised exchange or protocol, you grant that contract permission to move a token on your behalf. Many interfaces request unlimited approval by default, because it saves the user a transaction later.
That approval does not expire. If the contract is later compromised or was malicious from the start, it can move that token out of your wallet at any point in the future, without any further action from you.
Two defences. Review and revoke approvals periodically using a revocation tool for your chain. And use a separate wallet for interacting with new or unfamiliar protocols, funded only with what that interaction needs.
How drains actually happen
The attacks that work are rarely technical breaks of cryptography. They are social.
Fake support. You post a problem in a public channel. Someone messages you claiming to be support and walks you through a process that ends with entering your seed phrase. Real support never asks for it. Nobody legitimate ever will.
Malicious signature requests. A site asks you to sign a message to log in. The message is actually an approval or an order granting someone else control of your assets. Read what you are signing; hardware wallets that display transaction details exist for this reason.
Airdrop bait. Unexpected tokens appear in your wallet. Interacting with them, particularly attempting to sell them, triggers a contract that drains you. Leave unsolicited tokens alone.
Clipboard hijacking. Malware watches for a pasted wallet address and swaps it for the attacker's. Always verify the first and last characters of a destination address after pasting.
Fake wallet applications. Downloaded from search advertisements or unofficial app listings. Only install from the official site, typed directly, and verify the download where the vendor publishes checksums.
Account security around the wallet
Your exchange account is a target too, and the weakest link is usually the phone number.
SIM swapping, where an attacker convinces a carrier to move your number to their device, defeats SMS two-factor authentication entirely. Use an authenticator application or a hardware security key instead, and remove SMS as a recovery method where the platform allows it.
Use a unique password per exchange, generated and stored in a password manager. Enable withdrawal address allowlisting where it is offered, which limits withdrawals to addresses you have pre-approved with a time delay on additions.
Keep a dedicated email address for financial accounts, not the one you use for newsletters and sign-ups.
Inheritance and the problem nobody plans for
Self-custody has an awkward implication: if something happens to you, the keys go with you.
Families have lost substantial sums because nobody else knew a wallet existed, let alone how to access it. Plan for this. That might mean a sealed letter with a lawyer describing where backups are held and how to use them, or a multi-signature arrangement where a trusted party holds one key.
Whatever you choose, the instructions need to be understandable by someone who does not know what a seed phrase is. Write them for that person.
A checklist to run this week
- Move anything above your trading allowance off exchanges.
- Confirm your seed phrase backup exists, is legible, and is stored in more than one place.
- Restore from that backup onto a device to prove it works.
- Review and revoke old token approvals.
- Replace SMS two-factor authentication with an app or hardware key.
- Enable withdrawal allowlisting on every exchange that supports it.
- Write instructions for someone who would need to recover these funds without you.
None of this improves your trading. All of it protects the results of your trading, which amounts to the same thing over a long enough period.