Crypto security: guard the keys, not just the coins

01First question: where are your coins, and who holds the keys?

Keeping crypto safe starts with a simple question, not an app. If your coins sit on an exchange, the platform holds the keys and your safety depends on your password, your two-factor authentication and the platform itself. If they sit in your own wallet, on a phone or a hardware device, you hold the keys and your safety depends on how you store the seed phrase and how carefully you sign. The threats are different, and many people get hurt by using one mindset to defend against both.

We suggest using both: small, everyday balances on a licensed exchange with every protection switched on, and long-term holdings on a hardware wallet. How to judge whether an exchange deserves your trust is covered in Is my exchange safe?

02Seed phrases: the one thing you cannot get wrong

A seed phrase (recovery phrase), usually 12 or 24 English words, is your wallet. Whoever has it can move your coins from anywhere, on any device, without your phone, password or fingerprint. So there is one rule: the phrase lives on paper or metal and never touches a connected device.

In practice: no photos, no screenshots, no notes app, no sending it to yourself on WhatsApp or email, no cloud drive, no password manager. Write it by hand, check the word order twice and store it somewhere safe from fire and water. For larger amounts, stamp it onto a stainless-steel or titanium plate. Some people keep one copy at home and one in a bank safe-deposit box, which is sturdier than a single copy, but every extra copy is another place it can leak. Weigh that trade-off honestly.

Advanced users can add a passphrase, sometimes called the "25th word". Even if someone finds your seed phrase, they cannot open the real wallet without it. But forgetting the passphrase is as final as losing the phrase. Don't use it until you fully understand how it works.

03Account security: 2FA, passkeys and withdrawal whitelists

For coins held on an exchange, your account is the vault door. The password is only the first lock. What actually stops account takeovers is what comes after it: two-factor authentication, a withdrawal whitelist, an anti-phishing code and a review of logged-in devices.

Don't rely on SMS. The weakness of SMS codes is the SIM-swap: a criminal uses your personal details to get your number transferred to a new SIM, and from that moment every text code goes to them. Codes from an authenticator app (Google Authenticator, Microsoft Authenticator and others) stay on your phone, which is far safer. Better still are passkeys and hardware security keys such as a YubiKey. They are bound to the real website's domain, so a fake site cannot trick them into producing a usable login. More exchanges support them every year; switch them on where you can.

The withdrawal whitelist is, in our view, the most underrated feature on any exchange. Once on, funds can only go to addresses you registered in advance, and new addresses usually face a 24–48-hour cooling-off period. Even if someone gets into your account, they can't drain it straight away. An anti-phishing code is a word you choose that the exchange adds to every genuine email. An "exchange email" without it goes straight to the bin.

1. Use a unique, strong password for the exchange

   Never reuse your email or social-media password. Let a password manager generate and store it.

2. Switch 2FA to an authenticator app or passkey

   Remove SMS as the main method. Write the authenticator's backup codes on paper and store them away from your seed phrase.

3. Turn on the withdrawal whitelist

   Register only your own wallets and the exchanges you use. The cooling-off period for new addresses is valuable insurance.

4. Set an anti-phishing code

   Learn what it looks like, and delete any "official" email that doesn't carry it.

5. Review devices and API keys

   Log out devices you don't recognise and delete unused API keys, especially any with withdrawal rights.

Don't forget your email. Nearly every "reset password" link goes there, so a compromised inbox hands over a spare key to all your accounts. Protect it with an authenticator or passkey too, and set a screen lock and remote-wipe on your phone.

04Phishing sites, wallet drainers, address poisoning and fake apps

Phishing sites look almost identical to the real thing. They usually arrive through search ads, social-media DMs and "claim your airdrop" links. Hong Kong's SFC alert list now carries many look-alike domains impersonating licensed platforms. The simplest defence: bookmark your exchange and wallet sites and only ever enter through the bookmark. Never click ads or links in messages.

Drainers are the big threat for self-custody users. On Ethereum and similar chains, clicking "Connect wallet" and then "Approve", or signing a message you don't understand, can hand a contract permission to move your tokens. Your wallet is then emptied in one go, even though your seed phrase never leaked. Read what the wallet pop-up actually says and don't sign what you can't understand. Revoke approvals you no longer need with the Etherscan approval checker or Revoke.cash, and use a separate "burner" wallet with a small balance when trying new projects.

Address poisoning exploits the habit of checking only the first and last few characters. The scammer generates an address that starts and ends like one you use, then sends you a zero-value or tiny transaction so it shows up in your history. Next time you copy an address from that history, you may copy theirs. The fix: always copy from your whitelist or saved address book, send a small test before any large transfer, and check the full address in chunks. Clipboard malware on computers swaps addresses as you paste, so check again after pasting.

Fake apps and APKs are especially common in Chinese-speaking communities. Mainland China's app stores removed crypto wallets and exchanges years ago, so counterfeit installers posing as imToken, TokenPocket or MetaMask circulate widely. They send whatever seed phrase you type or generate straight to the scammer. Download only from the official site or a mainstream app store, check the developer name, and never install an "internal", "faster" or "localised" version.

05Scams common in Asia: pig-butchering, fake support and "trading mentors"

Those are Hong Kong Police figures for 2025, published in February 2026. Taiwan, Singapore, Malaysia and much of Southeast Asia report the same pattern: crypto is increasingly the rail that scammers use to move victims' money. These are the scripts we see most.

Pig-butchering (romance plus investment fraud)

Someone meets you on a dating app, on social media or through a "wrong number" message. They spend weeks building trust, then casually mention an "insider platform". Small first deposits really can be withdrawn. When you deposit more, withdrawals suddenly need "tax", an "unfreezing fee" or a "deposit", until you have nothing left to pay. Warning signs: an online friend who brings up investing, a platform on no regulator's list, USDT-only deposits and fees before withdrawals.

Fake customer support

You complain publicly about a slow withdrawal, and minutes later "official support" messages you. Or you search for an exchange's helpline and add a Telegram account. They ask you to "validate your wallet", scan a QR code, install remote-access software or move funds to a "safe account". Real platforms don't DM first, and support only happens inside the official app or website.

Fake investment groups and "trading mentors"

In Telegram, LINE and WhatsApp "finance groups", members post profit screenshots every day and a "teacher" shares free calls, until you are steered to an "exclusive exchange" or a brand-new token. Everyone in the group except you may be a shill. Hong Kong's JPEX case of 2023 is the textbook example: the unlicensed platform was pushed through influencers and physical OTC shops, leaving more than 2,700 victims and over HK$1.6 billion in losses. By 2026, 26 people had been charged.

Fake police, government or bank officials

The caller says you are linked to money laundering and must move your funds to a "supervised account" for the investigation, sometimes by buying USDT or using a Bitcoin ATM. No law-enforcement agency asks you to prove your innocence in crypto.

Peer-to-peer trading carries a separate risk: receiving tainted money and having your bank account frozen. See our P2P guide for how to avoid it.

06Inheritance and emergency planning

If something happened to you tomorrow, could your family find your crypto? For many people the honest answer is no. Exchange accounts can usually be claimed by heirs with a death certificate and probate documents. It is slow, but there is a process. Self-custody wallets depend entirely on the seed phrase, and no institution can recover them.

We suggest an "asset map": the exchanges you use, the wallets and devices you hold, where the seed backups are stored and who to contact (a lawyer, a knowledgeable friend). The map says where, never the words themselves. Wills and powers of attorney pass through many hands and are the wrong place for a seed phrase. For larger holdings, speak to a local lawyer or look at a multisignature wallet, where several of a set of keys are needed to move funds, so that no single person or document holds everything.

07Travel and personal safety

If you regularly travel between Hong Kong, Shenzhen, Singapore, Bangkok or Tokyo, think one step ahead. Never carry your seed phrase, on paper or as a photo. A phone wallet with a small balance is enough for a trip. Border officers in some places can inspect electronic devices; a hardware wallet holds no seed phrase, so that's fine, but it should never travel in the same bag as its recovery card.

Don't log in to exchanges on hotel or airport Wi-Fi; mobile data is safer. If you use a Bitcoin ATM or an over-the-counter shop abroad, stick to established venues and watch whether anyone follows you. Kidnapping and extortion cases targeting crypto holders have been reported in many countries, so the plainest advice is often the best: don't post your holdings or profits online, and don't tell the dinner table how much Bitcoin you own.

When you move crypto between exchanges, more platforms now ask for the recipient's details under the FATF Travel Rule; see our Travel Rule guide. Singapore residents can also check the MAS Investor Alert List for suspicious entities.

FAQ

Sources

• Hong Kong Police: 2025 law and order situation (online investment fraud) · checked Oct 2026
• SFC Hong Kong: suspicious virtual asset trading platforms alert list · checked Oct 2026
• Anti-Deception Coordination Centre (Hong Kong) · checked Oct 2026
• Etherscan Token Approval Checker · checked Oct 2026
• Japan FSA: crypto-asset pages (unregistered-operator warnings, SNS investment-fraud alerts) · checked Oct 2026

Keep reading