Education, not financial advice. Consumer protection, start to finish.
Before you hold anything
- Decide custody on purpose, not by default. Coins left on an exchange are that company's IOU: an entry on their books, not on the blockchain. Convenience is real, and so is the risk. Choose knowingly.
- Small test first, always. Every new wallet, exchange or address gets a small test transaction before real money follows. The fee is tuition.
- A dedicated email for crypto only, never reused anywhere else and never posted anywhere.
- A password manager and unique passwords. One reused password is one breach away from all of it.
Exchange hygiene, while coins are on one
- 2FA by app or hardware key, never SMS. SIM swaps are a common route to account takeover. Remove your phone number as a recovery method where you can.
- Whitelist your own withdrawal addresses, and turn on the withdrawal delay or lock if the exchange offers one.
- Set an anti-phishing code. The exchange's real emails will carry it.
- Know the exit. Withdraw to your own wallet at least once, so your first real withdrawal is not your first ever.
Wallet setup, the day you take custody
- Get hardware from the manufacturer only. Never marketplace resellers, never "sealed" second-hand units. Tampered devices are a real industry.
- The device generates the seed, never you and never a website. If a seed phrase was ever displayed on a screen connected to the internet, treat it as burned.
- Verify receive addresses on the device screen, not just on the computer. Malware edits clipboards.
- Run a recovery drill before real funds. Wipe the device, restore from your written seed and confirm the same addresses appear. If you can't recover it, you don't own it; you're hoping.
The seed phrase: the five rules
- Paper or steel. Never digital. No photos, no cloud notes, no password manager, no email drafts, no "just this once."
- Two locations, both boring. Fire and flood destroy more seeds than thieves do.
- Nobody legitimate will ever ask for it. Not "support," not a wallet app update, not a validation site. Anyone asking is the scam. There are no exceptions.
- Never type it into anything with an internet connection. The only exception is the recovery flow on the hardware device itself.
- Someone you trust knows it exists, not what it says. Inheritance is a custody problem too.
Transaction habits, every time
- Check the first and last six characters of every address, on the device screen when you sign with hardware.
- Read what you're signing. Keep blind signing off unless you need it and know why.
- Token approvals are standing permissions. Review and revoke old ones periodically, with a revoke tool bookmarked from its official source.
- Bookmark the real sites you use and never click sponsored search results. Lookalike-site ads are the cheapest scam that still works.
Red flags: close the tab
- Anyone who contacts you first about your crypto. Anyone.
- "Validate," "sync" or "migrate your wallet" links. Wallets don't work that way.
- Guaranteed yield, guaranteed anything, countdown timers, "last chance."
- A "support agent" in your messages right after you posted about a problem. That timing is the con.
- Romance and investment advice in the same relationship. That combination has cost people billions.
Twice a year, on the calendar
- The recovery drill still passes.
- Token approvals reviewed.
- Firmware updated, from the official app only.
- Exchange balances are still a deliberate choice.
- This checklist re-run.
The one-line version: the ledger has no password-reset desk. Whoever holds the keys is the owner. This checklist exists so that stays a feature.
Free to share unchanged, with this line intact. Nothing above is financial, legal or tax advice. Found something wrong? Tell us at contact@cryptomanuals.ai; fixes are logged on the Corrections page.