There Is No Fraud Department: How to secure your cryptocurrency, and the three ways people lose it.
Crypto has one feature that changes everything about how you protect it. Transactions can't be undone, and nobody can undo them for you.
There is no fraud department. No chargeback. No branch manager who can stop the transfer. If someone moves your coins, or you send them to the wrong place, or you lose the ability to prove the coins are yours, then your coins are gone.
So, the goal is simple. Don't let any of those three things happen.
Where the risk sits now
For years, when people pictured crypto theft, they pictured a big exchange getting hacked. That still happens. But thieves have shifted toward individuals, because individuals are easier.
Chainalysis reported more than $3.4 billion stolen across all of crypto in 2025 in its 2026 Crypto Crime Report. About $713 million of that came straight out of personal wallets, through recovery phrases typed into fake websites, software that quietly copied private keys, and browser add-ons that emptied accounts in the background. The same report found attacks on personal wallets went from roughly 54,000 in 2022 to about 158,000 in 2025, with the number of people hit doubling from 40,000 to at least 80,000.
Exchanges spent those years tightening their security. Individuals mostly didn't.
The real question isn't "is crypto safe." It's "where is mine, and what's the specific way that setup goes wrong."
The three places your crypto can live
All three are legitimate. All three fail differently.
On an exchange. The company holds the coins and you hold a claim against the company. It fails when the company gets hacked, runs out of money, or someone breaks into your account. FTX taught that lesson expensively. This suits smaller amounts, active traders, and anyone honest with themselves about not wanting to manage a key. For a lot of people, it's the right answer, and being told otherwise by the internet has cost people real money.
In a wallet app on your phone or browser. You hold the keys, but the device is online. These are called hot wallets, and they fail through fake websites, malicious software, and approving something you didn't read closely. Treat it as the cash in your pocket, not the money in your account.
On a hardware wallet, kept offline. A small physical device that keeps your keys away from the internet. Called cold storage. It fails when you lose the recovery phrase, store it somewhere a thief finds it, or buy a device that was tampered with. This is for money you plan to hold long-term.
There's a fourth setup some investors consider. A spot Bitcoin ETF in a brokerage account gives you exposure to the price with no keys to manage, inside an account type that already has clear procedures for custody and for passing assets to heirs. It carries a different set of risks rather than fewer. You get the full price swings, you pay an annual fee, the fund relies on an outside company to hold the coins, and you can't move or spend what you own..
Don't keep it all in one place
The most common mistake is keeping everything in one spot. Spending money, trading money, and long-term savings all together. One bad click and all of it is gone at once.
Split it by how often you need to reach it. Spending money in the phone wallet, at a balance where losing it would be irritating rather than devastating. Money you actively move on an exchange with strong login protection. Long-term savings on a hardware wallet you set up once and rarely connect to anything. The point of that third bucket is that it has no history, so there's nothing for an old mistake to come back through.
If you keep it on an exchange
Switch from text-message codes to an authenticator app or a physical security key. Don't just turn text codes off, because no second step is worse than a weak one. Text codes get beaten by SIM swapping, where someone talks your phone carrier into moving your number onto their phone. If your carrier offers a PIN to prevent that, turn it on.
Use a password you have never used anywhere else. Thieves buy lists of passwords from old breaches and try them everywhere.
Turn on withdrawal address allowlisting if your platform offers it, with the delay setting on. Someone who gets into your account still can't send money to a new address right away.
If you hold your own keys
Your recovery phrase is everything. Those twelve or twenty-four words aren’t a backup of your wallet. They are your wallet. Anyone who reads them owns your crypto, permanently, from anywhere in the world. Write it on paper or stamp it into metal. Never photograph it, never type it into a computer, never put it in cloud storage, a notes app, or email. There's software built specifically to hunt for recovery phrases on people's devices.
No real company or support person will ever ask you for it. Not to help you, not to verify you, not to fix anything. Every single request is a theft attempt. This is the one rule worth memorizing.
Buy hardware wallets straight from the maker. Devices bought from resellers have been tampered with before being sold.
Test your recovery before you trust it. Put a small amount on the device, erase it, and restore it from your written phrase. A backup you have never tested is a guess, and the day you need it is the worst day to find out you wrote a word down wrong.
Check the address every time you send. Thieves plant addresses in your history that look almost identical to ones you use, hoping you copy the wrong one. Never copy an address out of your transaction history and send a small test amount first.
The tricks that work
Almost all of them target you, not the technology. Fake support people who contact you first. Copycat websites one letter off from the real one. AI voice calls. Fake urgent update notices. Letters claiming a product recall means you need to verify your recovery phrase.
The defense is a habit, not a gadget. Never act on a message that came to you. Close it and go to the site yourself. Slow down when you feel rushed, because the rush is the trick.
One more reason to be careful about what you share. In May 2025,
Coinbase disclosed in an SEC filing that criminals had gained access to customer records through support personnel. Tens of thousands of customers had names, home addresses, phone numbers, government ID images, and account balance snapshots exposed. No passwords, no money moved. That sounds like a lucky escape, but what got out was a list of people known to own crypto, how much they own, and where they live. Thieves build target lists from records like that, from social media, and from public blockchain activity. Don't talk about what you own or how much.
The failure nobody plans for
This one has nothing to do with criminals. It's the third item from the top of this article, the one where you lose the ability to prove the coins are yours, and it's the situation people are least likely to have planned for.
If you hold crypto yourself and you're the only person who knows how to get to it, you haven't created an inheritance. You've created a loss with a timer on it. Your executor can't subpoena a blockchain. Your spouse can't call customer service.
Three questions fix it. Does anyone know it exists, not the phrase but the fact? Is there a written path to get to it, clear enough for someone who understands none of this, kept somewhere a thief can't reach but your family can? And do your estate documents cover digital assets, with your executor given the legal authority to deal with them?
Have an estate attorney draw this up. We are not a law firm and cannot prepare those documents, but it's worth raising at your next review, and it's the part of crypto security that a security blog will never handle for you.
Common questions
What happens if I lose my recovery phrase?
It's gone. There's no password reset, no support line, and no legal help. This is the single biggest cause of permanent loss.
Is crypto on an exchange insured?
Generally not the way a bank account is. FDIC insurance does not cover digital assets, and SIPC protection does not cover crypto held directly on most exchange platforms. Some exchanges carry private insurance on part of what they hold, with limits that vary a lot. This differs from ETF shares in a brokerage account, which are securities and do fall under SIPC coverage. SIPC protects you if the brokerage firm fails, never against the price going down.
What should I do first if I think I have been hacked?
Move whatever is left to a brand new wallet you have never used, ideally from a different device. Treat the old recovery phrase as burned. Change the password on any account that shared it. Then report it to the platform and to the FBI at ic3.gov.
