The 15-point crypto security checklist

Security fails at the boring steps, not the exotic ones. Nearly every case on our blacklist, and every "how did this happen" thread, traces back to a skipped basic: an untested backup, a reused password, a domain typed by hand from memory. This checklist is the complete first week of self-custody — it assumes you've picked a device from our wallet reviews, and each point links the deeper guide where one exists.

Device (points 1–4)

1. Buy from the official store, inspect the seal. Every counterfeit story starts with a reseller. Order from the manufacturer's domain directly — our wallets page links only official stores — and check the tamper evidence before powering on. A device that arrives pre-seeded is an attack, not a convenience.
2. Verify firmware on first boot. Genuine devices run a signed-firmware check at startup. Let it complete, and install the companion app from the vendor's own site — never a search-result ad. If verification fails, stop and contact the vendor; don't "try again later" with funds involved.
3. Generate the seed on the device, offline. The words must be produced by the hardware itself, shown on its screen. Anything that asks you to import or "validate" an existing phrase during setup is the counterfeit pattern — see the fake-site guide.
4. Send a test transaction first. Receive a small amount, send a small amount, and read both on the device's screen. This proves the whole chain — address, signing, verification — before it carries real value.

Words (points 5–8)

5. Write the words by hand, in order. No photos, no cloud, no password manager, no file. Paper or steel only — the full storage doctrine lives in the seed phrase guide.
6. Wipe and restore before funding. The unglamorous fifteen minutes that proves everything: reset the device, restore from your written words alone, confirm your test balance reappears. An untested backup is a hypothesis; a tested one is a plan. (Why the checksum makes this test reliable.)
7. Make a second copy in a second location. One copy is one fire away from zero. Two geographically separate locations — and steel for meaningful amounts — turn single disasters into inconveniences.
8. Add a passphrase for meaningful holdings. The 25th word creates a wallet that cannot be opened even with your seed phrase, which neutralizes the entire stolen-backup scenario. Just rehearse recovery with it, because it has no reset.

Accounts (points 9–12)

9. Unique email and unique password for every financial account. A dedicated email address for exchanges breaks the breach-chaining that makes credential leaks so expensive. A password manager generates and remembers the rest — you memorize exactly one master passphrase.
10. App-based 2FA everywhere; SIM protections at your carrier. Authentication apps over SMS, always — SIM-swap attacks defeat text codes by construction. Call your carrier and add a port-out PIN; it's a five-minute call that closes the most common account-takeover route.
11. Whitelist addresses and withdrawals. Every major exchange supports address whitelisting with a time delay. The delay is the feature: it turns "attacker with your password" into "attacker who can also survive a 24-hour window and a new-device email."
12. Bookmark the domains you use — then only use the bookmarks. Typed URLs and search-result ads are how phishing happens. Bookmarks are how it doesn't. Verify each bookmark once, carefully, using the routine in spotting fake websites, and let muscle memory take over from there.

Habits (points 13–15)

13. Check unfamiliar names against the blacklist. Ten seconds per name: search the domain on the blacklist page, or automate it with the API if you run anything with users. The documented cases — BitConnect, Forsage, the fake-bot networks — all have the same five tells, catalogued in the case files.
14. Never discuss holdings publicly; treat urgency as an alarm. The "your account is compromised, act now" email, the friend with a can't-lose opportunity, the countdown timer on a mint — manufactured urgency is the universal precursor. Real institutions can survive you taking an hour; scams can't.
15. Review quarterly. Firmware updates, a fresh recovery test, a glance at token approvals on contracts you no longer use, and a check that your succession letter still matches reality. Fifteen minutes a quarter keeps the whole system honest — security isn't a state you achieve, it's a maintenance interval you keep.

Fifteen points, one afternoon, and a quarterly fifteen minutes. That's the entire overhead of self-custody done properly — and it covers every loss pattern we've documented except one: the scam you almost fell for anyway. For that last line of defense, keep the blacklist one tab away and trust the check over the vibe.

Every habit on this list exists because someone, somewhere, lost money skipping it. You get to learn from their tuition instead of paying your own.