Exchange or your own wallet
Lesson 13 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
Two risks, not one
On an exchange, it holds the keys to your coins and you have a login. If you get hacked, its protections help: 2FA, a whitelist, support. If it gets hacked or shuts down, you depend on its decisions. On 29 October Binance said it would cover the losses itself. In 2022, customers of the collapsed FTX waited years for any payout. Your own wallet removes the exchange risk, but all the responsibility moves to you.
The seed phrase is the money
A seed phrase is 12 or 24 words that restore your wallet on any device. Whoever knows the words owns the money, and no support team can undo that. So nothing digital: photos, notes, cloud and email leak sooner or later, and stealers look for exactly that. Write it on paper or stamp it on metal, and keep two copies in different places. And never type the words into a website, even one that “checks your wallet”.
A hardware wallet
A hardware wallet is a small device that keeps the key inside. The computer only prepares the transfer; the device signs it, and the key never leaves. Even with a stealer on the laptop, money won’t move without a press of the device’s button. Main rule: check the address and amount on the device’s screen, not the computer’s. Buy only from the maker, never second-hand or from a marketplace.
If you keep funds on an exchange
Keeping money on an exchange for trading is fine; what matters is setting up protection. A whitelist means withdrawals go only to addresses you added in advance, and a new address activates with a delay. Then an attacker with your password can’t pull everything at once. API keys are for bots and services. Never give them withdrawal rights, and delete the ones you don’t use. Most big exchanges have all five of these settings.
Check yourself
- Where is the safest place for a seed phrase?
Correct answer: On paper, two copies in different places. Paper can’t be grabbed by a stealer or leaked from a cloud. - Why turn on a withdrawal address whitelist?
Correct answer: So an attacker can’t withdraw to their own address right away. A new address activates with a delay, giving you time to notice the hack. - Dan bought a hardware wallet. The laptop shows one recipient address, the device shows another. Which to trust?
Correct answer: The device: cancel and check the laptop. Malware on the laptop can’t fake the device screen. A mismatch is a sign of infection.