how to not get your crypto hacked. bookmark this forever: 1. hardware - buy direct from the company or an authorized retailer. never random resellers - seed card already filled in when you received = scam. throw it - ship it to a pickup point, not your home - update firmware only through the official app 2. seed - metal over paper. never a photo, cloud or notes app - never enter your seed into a website or software wallet. restore only through your hardware wallet's official recovery - don't split your seed manually. no redundancy and it leaks information. use shamir or multisig instead - test your backup before funding: built-in check or wipe and restore. untested backup = no backup - two copies, two locations. fire is a hacker too if seed burns 3. setup - vault: a hardware wallet that never touches dapps - hot wallet for daily use. burner for anything new - bigger bags: passphrase on top. small decoy bag on the seed, real bag behind the passphrase - back up the passphrase too, stored apart from the seed. lose it and nothing recovers your coins - multisig when the amount justifies it. no single point of failure 4. signing (where most people get drained) - verify on the device, never trust the website alone. bybit lost $1.5B to a compromised UI - can't read it? don't sign it - "free" signatures can drain you with zero gas (permits) - one malicious eip-7702 authorization can delegate control of your entire account - on solana, one bad tx can reassign your token accounts. simulate before you sign - review approvals monthly. revoke what you don't need 5. sending - never copy addresses from tx history. scammers plant lookalikes - check the full address on the device, not just the first and last 4 - small test tx before every big one 6. machine - a laptop that only touches crypto. clean browser, no random extensions - download wallets only from the official site. app stores and search results are full of fakes - never run "meeting apps", game builds or files strangers send - never share your screen or install remote access. "support" asking for anydesk = scam - bookmark every site. never click search ads - surprise airdrops and NFTs = trap 7. exchanges - unique password everywhere. 1password or bitwarden - 2FA with an authenticator app or passkey. never SMS - 2FA backup codes offline. not in email, not in cloud - lock your SIM with a carrier PIN. sim swaps still work - separate email only for crypto. nobody knows it - turn on withdrawal whitelists - not your keys, not your coins. move out what you're not trading 8. opsec - don't flex your bags or your setup. wrench attacks are rising - support never DMs first. - avoid phishing emails, only trust official sources - have an inheritance plan. dead keys are lost coins 9. quantum (check my other quantum tweet for detailed advice) - not a threat today and anyone selling quantum panic is selling something - btc: never reuse addresses. sending from one exposes its public key forever - btc: park long-term coins in addresses that have never sent a tx. taproot (bc1p) and old p2pk show the key from day one - btc: bip-360 proposes a step toward quantum-resistant addresses. not live. proposals also exist to freeze unmigrated coins - eth + erc20: sending a tx exposes your public key. signing messages can expose it too so keep major bag on clean wallet - sol: your address is your public key. exposed from day one. experimental winternitz vaults exist, not standard wallet protection hardware rarely gets hacked. people do.