Keep Your Crypto #SAFU in 2026
Realizing the original article (https://www.binance.com/en/blog/from-our-ceo/421499824684900429) is too long and wordy, I made a condensed version.
Match security measures to the value of your holdings and your technical ability. Address three priorities: prevent theft, prevent accidental loss, and provide for inheritance.
Self-custody
Private keys authorize access to funds. Seed phrases generate those keys. Anyone who obtains either can control the associated crypto.
Self-custody requires secure devices, reliable backups, and a workable recovery plan.
1. Prevent key theft
Computers
Use a dedicated offline computer to store keys and sign transactions.
Install software from official sources using clean removable media.
Check downloads for malware and reported security issues.
Use supported software that permits offline signing.
Encrypt the disk and protect the computer physically.
Mobile phones
Use a dedicated phone, reset before installing the wallet.
Install only necessary wallet software; avoid rooting or jailbreaking.
Keep the phone offline except when transfers or updates require connectivity.
Use a strong passcode and maintain physical control.
For fully offline wallets, plan how to update software and move funds securely.
Hardware wallets
Choose an established device and protect it against theft or tampering.
Keep the connected computer or phone secure.
Verify the destination address on the hardware wallet before approving transfers.
Protect backups as carefully as the device itself.
Hardware wallets reduce exposure of private keys but remain vulnerable to software flaws, physical attacks, and insecure backups.
2. Prevent key loss
Maintain multiple protected backups in separate locations.
Paper: Simple to create, but vulnerable to damage, loss, transcription errors, and unauthorized reading.
Metal: More durable, but still vulnerable to loss and unauthorized reading.
Encrypted USB drives: Allow geographically separated backups but require strong encryption and technical care.
Avoid photographs or screenshots of keys that may sync to cloud accounts. Research backup and encryption tools, restrict access, and ensure the recovery process works.
3. Plan for inheritance
Provide a recovery process without unnecessarily exposing funds during your lifetime.
Sharing keys gives recipients immediate spending access and creates additional opportunities for loss or theft. Storing keys with an intermediary carries similar risks.
A dead man’s switch can release instructions after prolonged inactivity. Research and test the service before relying on it.
Do not place unencrypted keys or backup passwords in scheduled messages. Encrypt recovery instructions for the intended recipient—for example, using their PGP public key. Recipients must understand the process and protect the private key needed to decrypt it.
Centralized exchanges
Exchanges manage custody and infrastructure; users remain responsible for account security.
Evaluate reputation, security resources, testing practices, and the sustainability of the business model. Treat unusually generous incentives or unclear revenue sources cautiously. Exchange custody carries counterparty risk.
Secure your account
1. Protect computers
Use a dedicated computer where practical. Enable antivirus and firewall protection, minimize installed software, and limit downloads. Protect other devices on the same network.
Install operating-system and application updates promptly. Disable unnecessary automatic downloads in messaging apps.
2. Protect email
Use a separate email address for each exchange. Enable strong two-factor authentication, preferably a hardware security key. Avoid phone-based recovery that could expose the account to SIM-swap attacks.
3. Use unique passwords
Create a strong, unique password for every account and store it in a suitable password manager. Protect the device running the manager; malware can undermine its safeguards.
4. Enable two-factor authentication
Use 2FA on exchange and email accounts. Authentication codes add protection, but malware and phishing sites may capture or relay them.
5. Use hardware security keys
Where supported, secure exchange, email, and password-manager accounts with hardware security keys. Their website-specific authentication helps resist phishing.
6. Avoid SMS authentication
Prefer authenticator apps or hardware security keys. Attackers who take control of a phone number may intercept SMS codes.
7. Whitelist withdrawal addresses
Restrict withdrawals to approved addresses to make unauthorized transfers more difficult.
8. Protect API credentials
Keep API keys private and prevent unauthorized use. For asymmetric authentication, retain the private key securely and provide only the public key to the exchange.
Lost API credentials can generally be replaced; wallet keys require a separate backup strategy.
9. Complete identity verification
Identity verification can support ownership checks, investigations of suspicious activity, and inheritance procedures. Understand the exchange’s documentation requirements.
10. Secure devices physically
Use strong screen locks and protect phones, computers, hardware wallets, and backups. A phone may provide access to email, exchange accounts, and authentication codes simultaneously.
11. Avoid phishing
Open exchanges through trusted bookmarks or carefully typed addresses. Do not enter credentials after following unsolicited email, text, or social-media links.
Treat unexpected contact from purported exchange staff or public figures cautiously.
Choose a custody mix
Allocate funds between exchanges and personal wallets according to technical ability, security practices, and access needs.
Self-custody requires independent key protection and recovery. Exchange custody requires trust in the provider and strong account protection. A separate wallet can provide access during exchange maintenance.