In this article · 8 sections
Read enough loss reports and a pattern appears. The exchange was fine. The owner typed a recovery phrase into a fake 'support' page, or lost a phone number to a SIM swap, or installed a cracked app that swapped the address on the clipboard. Security for crypto is less about one clever product than about layers, so that one mistake doesn't empty everything. Here is the setup we'd recommend to a friend, in order of how much each layer actually protects, including where a VPN fits and, just as important, where it doesn't.
1. Hold your long-term coins on a hardware wallet
A hardware wallet keeps the private key on a chip that never exposes it to your computer or phone. You approve each transaction on the device. That one step removes exchange risk and most malware risk for the coins you aren't trading. Write the recovery phrase on paper or steel, store it away from the device, and never photograph it or type it anywhere. If you'd rather not manage words at all, card wallets like Tangem replace the phrase with a backup card, a different trade-off we explain in our review.
2. Fix your 2FA before anything else
SMS codes are the weak link: a fraudster who convinces your mobile carrier to move your number to their SIM receives your codes. Use an authenticator app, or better, a hardware security key, on your email and every exchange account. Your email matters most, because it resets everything else. Then call your carrier and ask what protection it offers against SIM swaps and number porting; many now let you add a PIN or block changes.
Sources: UK NCSC, turn on 2-step verification
3. Assume every message is phishing
No exchange, wallet maker or 'blockchain support' will ever ask for your recovery phrase, and none will call you about a 'compromised account' and offer to help you move funds. Since Ledger's 2020 customer-data leak, owners have even received fake letters by post, on convincing paper, asking them to 'verify' their device. Bookmark the real sites, reach them only from your bookmarks, and treat urgency as the tell: real security problems don't come with a 30-minute deadline.
4. Keep the device you trade on clean
Clipboard malware waits for you to copy a crypto address and replaces it with the attacker's. It mostly arrives with cracked software, fake browser extensions and 'free' trading bots. Keep your operating system and browser updated, install wallet extensions only from the official store page linked by the wallet maker, and if you trade often, consider a separate browser profile, or a separate device, used for nothing else.
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
5. Public Wi-Fi, and where a VPN helps
On a hotel, airport or café network you don't control, the network owner (or someone pretending to be it) can see which sites you visit and try to interfere with your connection. A VPN encrypts the traffic between your device and the VPN server, so the local network sees only an encrypted tunnel. Some VPNs also block known malicious domains, which can stop the odd phishing link before the page loads. For anyone who checks their accounts on the move, that is a sensible extra layer, and it's why we use one.
We link to NordVPN. What we checked: its no-logs policy has been independently audited, one subscription covers up to 10 devices, and there is a 30-day money-back guarantee if it doesn't suit you. Prices change constantly with promotions, so check the current offer on their site rather than trusting a figure in an article.
What a VPN does NOT protect
This is the part VPN marketing skips, and it matters more than the features list:
- It won't stop you typing your recovery phrase or password into a phishing page. The encryption protects the connection, not your decisions.
- It does nothing against malware already on your device, or against a SIM swap.
- It doesn't make you anonymous to an exchange: you passed identity checks, and the exchange knows who you are.
- It is not a way to reach an exchange that isn't licensed in your country. Doing that breaks the platform's terms and can get your account frozen with your funds in it. We will never suggest it, and it's why we don't link exchanges to UK readers.
6. Don't advertise what you hold
Physical attacks on crypto holders are no longer rare. CertiK counted 34 verified 'wrench attacks' worldwide between January and April 2026, 24 of them in France. Don't talk about your holdings online or in person, have hardware wallets delivered somewhere other than your home if you can, and consider a wallet passphrase, which creates a hidden account that a decoy PIN won't reveal. Larger holdings justify multisignature setups, so no single device or person can move everything.
Sources: CertiK, 2026 wrench attacks overview
The setup, on one page
If you do nothing else this week, do the first three rows.
| Layer | What it stops | Effort |
|---|---|---|
| Hardware wallet for long-term coins | Exchange failure, most malware | One afternoon |
| Authenticator app or security key (no SMS) | SIM swaps, password reuse | 30 minutes |
| Recovery phrase offline, never typed | Phishing that steals everything | Habit |
| Updated, clean trading device | Clipboard and wallet-draining malware | Habit |
| VPN on networks you don't control | Snooping and tampering on public Wi-Fi | 5 minutes |
| Discretion and a delivery address | Targeting in the physical world | Habit |
Next step
Start with the layer that matters most
A hardware wallet protects the coins you hold; a VPN protects your connection when you're on someone else's network. Neither replaces the habits above.
Sponsored · affiliate link. We may earn a commission; it never changes our rankings or this article.