The crypto investing basics that matter most are not about picking assets but about security: new holders most often lose funds to preventable failures like a lost seed phrase, a phishing link, or an exchange that later fails. Setting up security from day one also lays the groundwork for crypto estate planning so assets can actually be transferred to heirs. This guide covers the foundational security and record-keeping practices to put in place from day one.
What Makes Crypto Different From a Bank Account
With a traditional bank, the institution holds your money and you hold login credentials. Forget a password and you reset it. Unauthorized transaction? File a dispute.
Crypto works differently. Ownership is controlled by a private key, a cryptographic credential held by you, not an intermediary. Whoever controls the private key controls the asset. There is no customer service to reverse a transaction, no fraud department to recover stolen funds. This direct ownership is the core property of crypto assets, and it means security is entirely your responsibility.
How to Secure a Crypto Account: Step-by-Step
Enable two-factor authentication (2FA) on every exchange account. Use an authenticator app (Google Authenticator, Authy) rather than SMS. SIM-swapping attacks allow bad actors to intercept SMS codes by fraudulently porting your phone number to their device.
Write your seed phrase on paper, not digitally. When you create a non-custodial wallet (a software wallet or hardware wallet), you receive a 12- or 24-word seed phrase. This is the master key. Write it on paper with a pen. Store it in a fireproof location, a home safe or bank safe deposit box. Make a second copy stored separately.
Never type your seed phrase into anything except the official wallet recovery screen. Legitimate wallet providers never ask for your seed phrase through a website, email, Discord message, or support ticket. Any request for your seed phrase is a theft attempt.
Separate holdings by purpose. Keep long-term holdings in cold storage (a hardware wallet that stays offline). Use a hot wallet (software wallet connected to the internet) only for active transactions or DeFi interactions. Keep actively traded amounts on an exchange only if you need exchange access.
Keep a written inventory of your holdings. Record what you own, which wallet or exchange holds it, wallet addresses, approximate amounts, and purchase dates. Update it periodically. This record matters both for your own organization and for tax reporting, every sale is a taxable event in the US (verify current IRS guidance with your tax advisor).
Keep wallet software and device firmware updated. Security patches address known vulnerabilities. Outdated software exposes you to exploits that have already been publicly disclosed and fixed.
Use a unique password for every crypto account. A password manager makes this manageable. If one platform suffers a data breach, credential-stuffing attacks will test leaked passwords against every exchange.
Wallet Types Compared
| Wallet Type | Connection | Best For | Key Risk |
|---|---|---|---|
| Hardware wallet (cold storage) | Offline | Long-term holdings | Physical loss or damage if seed phrase not backed up |
| Software wallet (hot wallet) | Online | DeFi interactions, active transfers | Device compromise or phishing |
| Exchange account | Online (custodial) | Active trading | Exchange failure, hack; you do not hold the keys |
Common Scams to Recognize
Fake support contacts. Impersonators on Discord, Twitter/X, or Telegram claim to represent major exchanges or wallet providers. They direct you to a site where you "verify" your wallet. Any unsolicited contact claiming to be exchange support should be treated as a scam.
Phishing sites. Sites with URLs resembling real exchanges capture login credentials. Always type exchange URLs directly rather than clicking links from messages or search ads.
Guaranteed return offers. Offers to "double" your crypto or provide guaranteed returns are consistently fraudulent. No legitimate investment can promise guaranteed returns.
Wallet-draining approvals. Fake giveaways, airdrop claims, or free token offers direct users to connect their wallet and approve a transaction that transfers all assets to the attacker.
Airdrop traps. Unknown tokens appearing in your wallet may be bait. Visiting the project's site to "claim" them can trigger a wallet-draining approval.
The consistent signal across all these scams: an urgent request to connect your wallet, approve a transaction, or provide your seed phrase.
Record-Keeping for Tax Purposes
Every cryptocurrency sale or exchange is a taxable event under US federal tax law (IRS Notice 2014-21, updated guidance). Track:
- Date of acquisition and sale
- Cost basis (what you paid)
- Sale proceeds
- Which wallet or exchange held the asset
Poor records create problems when preparing returns. See Crypto Tax Records Checklist for a complete template. If records are incomplete, see How to Reconstruct Crypto Cost Basis.
Thinking About Estate Planning from Day One
A seed phrase stored only in your head or a single physical location creates an estate planning problem. If you become incapacitated or die, heirs may have no path to recovery. This is covered in depth at Seed Phrase Storage for Estate Planning and What Happens to Crypto When You Die?.
For larger holdings, the question of whether to hold crypto personally, in an LLC, or in a trust becomes relevant. See Should Crypto Be Held Personally, in an LLC, or in a Trust? and Common Crypto Estate Planning Mistakes.
Related Questions
Is it safe to keep crypto on an exchange long-term?
Leaving substantial holdings on an exchange means the exchange holds the private keys, not you. Exchange failures have resulted in complete customer fund losses (a major exchange that collapsed in 2022, for example). For long-term holdings not being actively traded, most security guidance recommends moving assets to a wallet you control. The tradeoff is that self-custody shifts all responsibility for key management to you.
What should I do if I think I've been scammed?
If you sent crypto to a fraudulent address, transactions are irreversible, recovery is generally not possible. If you disclosed your seed phrase, move any remaining assets to a new wallet immediately using a device you trust. Report the incident to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and to the FTC. Document everything for potential law enforcement use.
Do I need to report crypto I haven't sold?
Under current IRS guidance, simply holding crypto is not a taxable event. Taxable events generally include sales, exchanges (swapping one crypto for another), and using crypto to purchase goods or services. Staking rewards and mining income may have different treatment. Consult a tax professional familiar with digital assets for your specific situation, Crypto Planning for CPAs covers the advisor coordination angle.
How complicated should my seed phrase backup be?
Complexity in backups creates its own risks. A seed phrase split across three locations requires all three parts to recover, if one is lost or inaccessible, the wallet is unrecoverable. Encoding schemes that seem clever today may be impossible to decode years later. Most security practitioners recommend a straightforward physical backup in a secure location, with a second copy elsewhere, over elaborate schemes.
Sources
- IRS Notice 2014-21, "IRS Virtual Currency Guidance", irs.gov
- IRS FAQ on Virtual Currency (updated periodically), irs.gov/businesses/small-businesses-self-employed/virtual-currencies
- FBI Internet Crime Complaint Center (IC3), ic3.gov
- FTC Consumer Information on Crypto Scams, consumer.ftc.gov
- CISA guidance on multi-factor authentication, cisa.gov
Compliance Note
This page is educational only and does not constitute investment, legal, or tax advice. Cryptocurrency investments involve significant risks, including the potential for complete loss of principal and extreme price volatility. The security practices described here reduce but do not eliminate risk, and they do not guarantee protection against future threats, the threat landscape evolves continuously. No specific asset, return, or outcome is recommended or guaranteed. Tax treatment of digital assets is general and subject to change; verify current IRS guidance and consult a qualified tax professional. Advisory services are provided by DAG Wealth, LLC, an SEC-registered investment adviser; DAG Wealth is a brand pending a Form ADV update. Registration does not imply a certain level of skill or training.