If you hold any cryptocurrency, now is the time to run through a crypto security checklist. On October 29, 2026, attackers drained about $6.3 billion from Binance in roughly 20 minutes. It’s the largest crypto theft on record. Blockchain analytics firms TRM Labs and Chainalysis attributed it to TraderTraitor, a North Korean hacking group, and Binance says it will cover its users’ losses.

But the hack isn’t the biggest risk to your coins. According to the FBI, Americans reported a record $11.4 billion in crypto fraud losses in 2025, up 22% from the year before. Most of that money wasn’t stolen by elite hackers. It was handed over by people who were tricked.

The good news is that most of these losses are preventable. Below are 15 practical steps to protect your crypto, plus what to do if something goes wrong.

Why most crypto losses are scams, not hacks

Big exchange hacks make headlines, but they’re rare, and the exchange usually carries the loss. Scams are different. They target you directly, and when you send crypto to a scammer, there’s usually no one to reverse it.

The FBI’s 2025 numbers make this clear. Investment scams alone, such as fake trading platforms and online “relationship” scams, cost Americans $7.2 billion. People aged 60 and over lost about $4.4 billion. Crypto ATM scams, where callers pose as police or banks and demand payment in crypto, cost $389 million, up 58% in a year.

And big hacks create new openings for scammers. Within hours of the Binance news, security researchers were warning about fake “Binance support” messages, fake compensation pages and fake “withdrawals reopen now” deadlines, all designed to catch worried users off guard.

That’s why a good crypto security checklist covers both sides: making your accounts hard to break into, and making yourself hard to trick.

The crypto security checklist: lock down your accounts

1. Stop using SMS for two-factor authentication

Text-message codes can be stolen through SIM swapping, where a scammer convinces your mobile carrier to move your number to their phone. Switch every exchange to a stronger option. From strongest to weakest: a hardware security key, a passkey, then an authenticator app. Use SMS only if nothing else is offered.

2. Secure the email account behind your crypto

Whoever controls the email linked to your exchanges can often reset everything else. Give that email a unique, long password and app-based 2FA or a passkey. Many people use a separate email address only for crypto accounts and never share it publicly.

3. Add a port-out PIN or number lock with your carrier

Ask your mobile carrier to add a PIN, number lock or SIM lock to your account. It makes SIM swapping much harder. If your phone suddenly loses signal for no reason, treat it as a warning sign and check your accounts.

4. Use a password manager and unique passwords

Reused passwords are one of the easiest ways in. A password manager lets you use a different long password for every exchange and email account. Check whether your email appears in known data breaches, and change any password you’ve reused.

5. Clean up your devices and browser extensions

Keep your phone and computer updated, remove browser extensions you don’t use, and install wallet apps only from links on the official website. Never install remote-access software like AnyDesk or TeamViewer because a “support agent” asked you to. If you run a business too, the same habits apply there; see our cybersecurity basics for small business.

Protect your exchanges and wallets

6. Keep only what you actively trade on exchanges

Treat an exchange like a checking account, not a vault. Keep only the money you actively trade there, and move longer-term holdings to a wallet you control. Spreading funds across more than one platform also means a single outage or freeze doesn’t lock you out of everything. Our guide to choosing a crypto trading platform covers what to look for.

7. Turn on the withdrawal address allowlist

Most major exchanges let you restrict withdrawals to addresses you’ve saved in advance, often with a waiting period after you add a new one. If someone gets into your account, they can’t send your coins to their own wallet.

8. Set an anti-phishing code and clean up API keys

An anti-phishing code is a word you choose that appears in every real email from the exchange; fake emails won’t have it. While you’re in the security settings, delete API keys you don’t use and make sure the rest can’t withdraw funds.

9. Use a hardware wallet for long-term holdings

A hardware wallet keeps your private keys offline, and every transaction is confirmed on the device itself. Buy one only from the manufacturer’s official store or an authorized reseller, set it up yourself, and never use one that arrives with a seed phrase already filled in.

10. Store your seed phrase offline

Your seed phrase is the master key to your wallet. Write it on paper or stamp it in metal, keep it somewhere safe from fire and water, and never store it in a photo, notes app, email or cloud drive. Never type it into a website, no matter what it claims to be.

Spot the scams and build safe habits

11. Ignore “support” and “refund” messages after a hack

After the Binance hack, scammers started sending messages claiming your account was “affected by the breach,” plus links to fake compensation pages. No real exchange will ask for your password, 2FA code, seed phrase or a fee to release your money. Close the message, then check your account in the official app or by typing the website address yourself.

12. Watch out for address poisoning

Scammers send a tiny or zero-value transfer from an address that looks almost identical to one you use, hoping you’ll copy it from your history later. One victim reportedly lost $50 million this way. Use a saved address book, check the full address including the middle characters, and send a small test before large transfers.

13. Revoke old wallet approvals

When you use a decentralized app, you often give it permission to move certain tokens. Wallet drainers abuse those permissions. Once a month, open your wallet’s connected-apps or approvals screen and revoke anything you don’t recognize. Use a separate low-balance wallet for new sites and “free” airdrops.

14. Never pay to recover stolen crypto

“Recovery experts” and fake law firms target people who’ve already lost money, promising to get it back for an upfront fee. The FBI has warned about exactly this. Real government recovery efforts don’t charge you, and officials won’t contact you asking for payment.

15. Slow down when anyone rushes you

Urgency is the common thread in almost every crypto scam: a countdown, a deadline, a “last chance.” Make a personal rule that you never send crypto because a message, call or new online contact told you to. If older relatives hold crypto, agree that they’ll call you before sending it to anyone, for any reason.

What to do if you’ve been hacked or scammed

Act quickly, but don’t panic. In the first hour:

1. Move any remaining funds from the affected wallet to a new wallet created with a new seed phrase, ideally on a different device.
2. Revoke approvals on the affected wallet if tokens are still in it.
3. Change your exchange and email passwords and 2FA from a device you trust, and sign out other sessions.
4. Contact the exchange’s official support through its app or website.

Then record transaction IDs, wallet addresses, dates and screenshots, and file a report. In the US, use the FBI’s Internet Crime Complaint Center (ic3.gov) and the FTC (reportfraud.ftc.gov). In India, use the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call the 1930 helpline. Elsewhere, contact your national police cybercrime or fraud-reporting service.

And watch out for the second scam: anyone who contacts you offering to recover your crypto for a fee is almost certainly a fraud.

Get the printable version

If you’d like all of this in one place, The Crypto Safety Checklist 2026 is a 14-page printable PDF that goes deeper than this post. It includes a 15-minute safety check to do today, the exchange settings to turn on, a 2FA strength ladder, a 10-scam field guide with red flags for each, a pre-transfer checklist for your desk, a step-by-step response plan and a master checklist for monthly reviews. It’s $12 and written in plain English, so it’s easy to share with family members too.

Whether you use the guide or not, start with steps 1, 7 and 10 today: drop SMS codes, turn on the withdrawal allowlist and get your seed phrase offline. Those three changes alone close the doors attackers use most. And once your coins are safe, you might like our look at what is moving the Bitcoin price.

Crypto security FAQ

Is my crypto safe on an exchange after the Binance hack?

Binance says it will cover user losses from the October 29, 2026 hack. But any exchange can be hacked or pause withdrawals, so keep only what you actively trade on exchanges and hold the rest in a wallet you control.

What is the most important crypto security step?

Never share your seed phrase, password or 2FA codes with anyone, and replace SMS codes with an authenticator app, passkey or security key.

Is a hardware wallet worth it?

For savings and long-term holdings, a hardware wallet is one of the most effective protections, because your keys never touch your computer or phone. Buy it only from the official store.

What is address poisoning?

A scam where criminals send a tiny transfer from a look-alike address so it appears in your history, hoping you’ll copy it by mistake. Always use a saved address book and check the full address.

Can stolen crypto be recovered?

Sometimes, through law enforcement and blockchain analysts, but never through people who contact you asking for a fee. Report theft to the FBI’s IC3 (ic3.gov) in the US or cybercrime.gov.in in India.

Sources

• What to know about the $6.3B hack on Binance — PBS NewsHour / AP
• Binance Crypto Heist: How to Protect Your Crypto — McAfee
• What Binance users should do right now — Yahoo Finance
• Binance hack scams: fake support, refunds and recovery — 2-Spyware
• FBI says crypto-related fraud losses hit record $11.4 billion in 2025 — The Block
• FBI warns of fake law firms targeting crypto scam victims — BleepingComputer
• Why address poisoning works without stealing private keys — Cointelegraph

This post is for educational purposes only and isn’t financial advice.