Cryptocurrency has no undo button. As the FTC's consumer guidance on cryptocurrency puts it, crypto payments generally aren't reversible once sent, and there's no bank or government program that insures crypto losses the way FDIC insurance covers a bank account. A phishing link, a lost recovery phrase, or a compromised device can mean funds are gone permanently, with no customer service line to call. That reality is worth taking seriously before you hold a meaningful amount of it, and the good news is that the actual defenses aren't complicated — they just require discipline most people don't bother maintaining until after something goes wrong.
Wallet Types Are a Security-Convenience Tradeoff, Full Stop
Every wallet type trades security for convenience in a predictable direction: the more control you have over your own private keys, the more secure the setup and the less convenient it is day to day. A hardware wallet keeps your keys on a physical device that's never connected to the internet except during a signed transaction — the gold standard for anything you can't afford to lose, but genuinely inconvenient for frequent spending. Cold storage (keys written down or stamped into metal, kept entirely offline) pushes that further for long-term holding you don't plan to touch. Desktop and mobile wallets keep keys on a general-purpose device that's online at least some of the time, which is a reasonable middle ground for money you're actively using. Web and exchange wallets, where a third party holds your keys on your behalf, are the most convenient and the least secure by this framework — you're trusting that party's own security and solvency, not just your own.
My honest recommendation: match the wallet type to the amount, not to whichever wallet happens to be easiest to set up. A small amount you're using for regular transactions is fine in a reputable mobile wallet. Anything you'd genuinely be upset to lose belongs in a hardware wallet, and anything you consider a long-term holding you won't touch for years is a candidate for cold storage on top of that.
What Actually Goes Wrong
The threats in this space are fairly well understood, even if I won't pretend to hand you a precise probability for each one — precise-sounding attack statistics in this genre are usually invented rather than measured, and I'd be skeptical of any guide that hands you a specific percentage for "how likely you are to be phished" without a real source behind it. What's genuinely common: phishing attempts that impersonate a wallet or exchange login page and ask you to "verify" your account by entering your private key or recovery phrase — no legitimate wallet or exchange will ever ask for that, full stop, and treating any such request as an automatic red flag will filter out most of this category of attack on its own. Malware that logs keystrokes or clipboard contents is a real risk for anyone doing sensitive crypto operations on a general-purpose, internet-connected device — an air-gapped device or a hardware wallet sidesteps this specifically because the keys never touch an internet-connected machine. A lost recovery phrase is quietly one of the most common ways people lose access permanently, not because of an attacker but because of their own lack of a tested backup — there's no support line that can recover it for you, since nobody, including the wallet provider, has a copy. SIM-swap attacks, where someone convinces your phone carrier to port your number to their device, defeat SMS-based two-factor authentication specifically, which is the single best argument for using an app-based or hardware-key second factor instead of SMS wherever you're given the choice.
Building Layered Defense
No single layer of security is sufficient on its own, which is why I'd think about this as several independent layers rather than one big decision.
Your wallet type choice is the first layer, and it should scale with the amount at stake — mobile or web wallets for small, actively-spent amounts; a hardware wallet for anything larger; a hardware wallet plus a genuinely separate cold backup for amounts you'd consider a significant loss.
Your recovery phrase is the second layer, and it deserves more care than most people give it, because it's the actual master key — anyone who has it owns your wallet, full stop, regardless of your password. Write it down on paper or stamp it into metal, never store it as a photo or a text file on an internet-connected device, and keep more than one copy in genuinely separate physical locations — a fire or theft at a single location shouldn't be able to destroy your only copy. Whatever backup approach you choose, actually test it: import the recovery phrase into a fresh wallet on a separate device and confirm it restores your balance correctly, then delete that test import. A backup you've never tested is a backup you don't actually know works.
Password security is the third layer. The practical version of good advice here is simple: use a reputable password manager to generate a long, fully random password for your wallet or exchange login, and don't try to memorize it — the recovery phrase is your actual backup, not a memorable password. If you're not using a password manager for anything else in your life, this is a good reason to start.
Device security is the fourth layer — keeping your operating system updated, avoiding unofficial software and unknown browser extensions, and, if you're holding a meaningful amount, considering a dedicated device used only for crypto rather than one you also browse the general internet on. And network security rounds this out: avoiding public WiFi for anything wallet-related, keeping most of your holdings off exchanges entirely (an exchange hack affects everyone with funds parked there, and it happens to even well-known platforms with some regularity), and withdrawing to your own wallet after any purchase rather than treating an exchange as long-term storage.
Red Flags Worth Memorizing
A handful of patterns are worth treating as automatic disqualifiers regardless of how legitimate the rest of a pitch looks: anything asking for your private key or recovery phrase outside of you personally initiating a wallet restoration, any service promising to "secure" your keys for you in a way that actually means holding them on your behalf, any promise that lost funds can be recovered (they can't — this is either a lie or a scam targeting people who've already lost funds once), and any pressure to act immediately. Legitimate crypto transactions and legitimate support interactions don't require urgency; urgency is a manipulation tactic, not a feature of how this technology actually works.
If Something Does Go Wrong
If you suspect your recovery phrase has been exposed, the only real response is to move funds to a brand-new wallet with a fresh recovery phrase immediately, if you still have access — the old wallet has to be treated as permanently compromised the moment there's any doubt about it. If you've genuinely lost your recovery phrase with no working backup, I won't sugarcoat this: the funds are permanently inaccessible, regardless of whether you remember your password or still have the device — the recovery phrase is the only path back in, by design, and that design is also exactly what keeps a third party from being able to seize your funds either. And if an exchange account gets compromised, the immediate steps are the ones you'd expect — change the password, check and remove any 2FA method you don't recognize, check for withdrawal addresses an attacker may have added, and contact support immediately — but the more reliable prevention is simply not keeping large balances sitting on an exchange in the first place.
The Principle Underneath All of This
"Not your keys, not your coins" is the phrase that captures the whole tradeoff. If a third party holds your private keys, you're trusting their security and their solvency, not just your own — and that third party can be hacked, can go bankrupt, or can simply disappear. Holding your own keys removes that dependency entirely, but it also removes any safety net: there's no fraud department, no chargeback, and no institution standing behind your mistakes. That's a genuinely different relationship with your money than a bank account gives you, and it's worth being honest with yourself about whether you're actually willing to maintain the discipline it requires before you move a meaningful amount into self-custody. The technology doesn't ask permission to hold you to that standard — it simply does.