Printable crypto security checklist

Work through this list once, then revisit it every few months. Your ticks are stored only in this browser, nowhere else. Use your browser's print function for a paper copy.

Seed phrases

• Every seed phrase is written on paper or metal, never stored digitally.
• Backups are stored away from the devices they belong to.
• I have tested that my backup words are correct.
• If I use a passphrase, it is backed up separately.
• Someone I trust could find my backups if something happened to me.

Wallets

• Most of my funds are in a vault wallet, ideally a hardware wallet with its own seed.
• I use a separate wallet for airdrops, mints and new protocols.
• My farming wallet holds only what current tasks need.
• I have reviewed and revoked old token approvals on every chain I use.
• I use an address book instead of copying addresses from history.

Accounts

• My email has a unique password and strong 2FA (security key, passkey or authenticator app).
• My exchange accounts use strong 2FA, not SMS.
• Withdrawal address allowlists are on for my exchanges.
• Anti-phishing codes are set on exchanges that support them.
• I use a password manager with unique passwords everywhere.
• I have asked my mobile carrier about SIM-swap and port-out protection.
• Unused exchange API keys are deleted, and the rest have no withdrawal rights.

Devices

• Operating system, browser and wallet apps are up to date.
• I use a separate browser profile for crypto with only the extensions I need.
• I do not install pirated software or run files and commands from strangers.
• My phone has a strong screen lock and my seed phrases are not in my photo gallery.

Habits

• I open crypto sites from bookmarks, never from search ads, replies or DMs.
• I read every wallet popup, including the domain, type of request and simulation.
• I reject approvals and permits on claim pages.
• I ignore unsolicited messages offering help, airdrops or investments.
• I know what to do first if I am hacked. See the first-hour checklist.