how to not get your crypto hacked.
bookmark this forever:
1. hardware
- buy direct from the company or an authorized retailer. never random resellers
- seed card already filled in when you received = scam. throw it
- ship it to a pickup point, not your home
- update firmware only through the official app
2. seed
- metal over paper. never a photo, cloud or notes app
- never enter your seed into a website or software wallet. restore only through your hardware wallet's official recovery
- don't split your seed manually. no redundancy and it leaks information. use shamir or multisig instead
- test your backup before funding: built-in check or wipe and restore. untested backup = no backup
- two copies, two locations. fire is a hacker too if seed burns
3. setup
- vault: a hardware wallet that never touches dapps
- hot wallet for daily use. burner for anything new
- bigger bags: passphrase on top. small decoy bag on the seed, real bag behind the passphrase
- back up the passphrase too, stored apart from the seed. lose it and nothing recovers your coins
- multisig when the amount justifies it. no single point of failure
4. signing (where most people get drained)
- verify on the device, never trust the website alone. bybit lost $1.5B to a compromised UI
- can't read it? don't sign it
- "free" signatures can drain you with zero gas (permits)
- one malicious eip-7702 authorization can delegate control of your entire account
- on solana, one bad tx can reassign your token accounts. simulate before you sign
- review approvals monthly. revoke what you don't need
5. sending
- never copy addresses from tx history. scammers plant lookalikes
- check the full address on the device, not just the first and last 4
- small test tx before every big one
6. machine
- a laptop that only touches crypto. clean browser, no random extensions
- download wallets only from the official site. app stores and search results are full of fakes
- never run "meeting apps", game builds or files strangers send
- never share your screen or install remote access. "support" asking for anydesk = scam
- bookmark every site. never click search ads
- surprise airdrops and NFTs = trap
7. exchanges
- unique password everywhere. 1password or bitwarden
- 2FA with an authenticator app or passkey. never SMS
- 2FA backup codes offline. not in email, not in cloud
- lock your SIM with a carrier PIN. sim swaps still work
- separate email only for crypto. nobody knows it
- turn on withdrawal whitelists
- not your keys, not your coins. move out what you're not trading
8. opsec
- don't flex your bags or your setup. wrench attacks are rising
- support never DMs first.
- avoid phishing emails, only trust official sources
- have an inheritance plan. dead keys are lost coins
9. quantum (check my other quantum tweet for detailed advice)
- not a threat today and anyone selling quantum panic is selling something
- btc: never reuse addresses. sending from one exposes its public key forever
- btc: park long-term coins in addresses that have never sent a tx. taproot (bc1p) and old p2pk show the key from day one
- btc: bip-360 proposes a step toward quantum-resistant addresses. not live. proposals also exist to freeze unmigrated coins
- eth + erc20: sending a tx exposes your public key. signing messages can expose it too so keep major bag on clean wallet
- sol: your address is your public key. exposed from day one. experimental winternitz vaults exist, not standard wallet protection
hardware rarely gets hacked. people do.
@HwnElectric feds should investigate these guys, minor storm. 250k outage from barely a cat 1 from the south of big island. feds should also investigate power infrastructure budgeting and have a company give it a rating 🤣
@cryptosymbiiote It’s Funny seeing people predict a 58k floor drop like it’s similar to ftx collapse. markets don’t repeat and it’s a complete different environment