Keeping digital assets safe

Who is holding it: you or someone else

When you buy on an exchange, the exchange usually holds the coins and your account is a record of what it owes you. That is convenient, and it means you carry the risk of that business: Mt. Gox in 2014 and FTX in 2022 both left customers out of pocket.

Holding it yourself means holding the keys, with nobody in between. Nothing can be frozen by a company, and nothing can be recovered either: lose the keys and the money is gone, with no support line to call.

Neither option is right for everyone. What matters is knowing which one you are using, and for how much.

• On an exchange, you rely on that company staying solvent, secure and open.
• Holding it yourself removes that risk and gives you full responsibility.
• Many people use both: a small amount on an exchange, the rest held themselves.

Your recovery phrase is the money

Setting up a wallet gives you a recovery phrase: 12 or 24 ordinary words. Those words can rebuild the wallet on any compatible device, so anyone who reads them can take everything in it.

Write the words on paper, in order, and check them against the screen. Keep copies in two separate safe places. Don't photograph them, type them into a computer or phone, email them, or put them in cloud notes or a password manager.

Before you move a meaningful amount in, practise: wipe the device or use a spare one, restore from your written words, and see the same wallet come back. A recovery you have never tested is a plan you are guessing at.

• Paper, written by hand, stored in two separate places.
• Never a photo, a screenshot, a cloud note or a password manager.
• Test the recovery before the amount matters.
• No legitimate service, ours included, will ever ask you for these words.

Hardware wallets

A hardware wallet is a small device that keeps the keys off your computer and asks you to confirm each payment on its own screen. It is the most practical step up in safety for most people, and the usual choice once an amount would hurt to lose.

Buy one from the maker's own website, never second-hand and never from a marketplace listing, and set it up yourself so you are the first person to see the recovery phrase. If a device arrives with a phrase already printed, it is not safe to use.

How people actually lose money

Most losses are not clever attacks on the technology. They are ordinary mistakes and ordinary cons.

• A photo of the recovery phrase on a phone or in cloud storage.
• A fake wallet or exchange app, so download only from the official website.
• Software that swaps the address you pasted, so check the whole address on the device screen before confirming.
• Phishing emails and sites that imitate a real exchange to collect your sign-in or your words.
• Someone promising guaranteed returns, or help recovering money you have already lost. Both are standard scams.
• Having no record for your family, so nobody can find or reach the assets if something happens to you.

A short checklist

• Turn on an authenticator app for every exchange account, not text messages.
• Use a different, long password for each account, kept in a password manager.
• Write the recovery phrase on paper and store copies in two places.
• Test the recovery with a small amount first.
• Send a small amount first whenever you use a new address.
• Check the full address on the device screen, not just the first and last few characters.
• Write down, somewhere your family can find, where things are held, without ever writing the words themselves.