How to Keep Crypto Safe

How to keep crypto safe comes down to one question since October 29, 2026: who holds the keys to your coins? That evening, about $6.3 billion left Binance according to the exchange, and Chainalysis counts $6.4 billion. It is the biggest crypto hack in history, and the trail leads to North Korea. Binance is covering its customers' losses. If you hold your own coins, you don't depend on promises like that, and the responsibility is yours. This guide shows how to secure your crypto: with a hardware wallet, a wallet scanner and the right settings on your exchange.

Key takeaways

• Binance hack: about $6.3 billion according to Binance, $6.4 billion according to Chainalysis, drained on the evening of October 29, 2026.
• Scale: more than three times what North Korea's hackers stole in all of 2025, namely $2.02 billion according to Chainalysis.
• Hardware wallet: from €59 (Ledger Nano S Plus, Trezor Safe 3), manufacturer prices as of October 16, 2026.
• Wallet scanner: MetaMask checks transactions and signatures with security alerts by default, Revoke.cash shows old token approvals.
• Exchange account: two-factor authentication via app or security key instead of SMS, plus a withdrawal whitelist.
• Tactic: North Korea's hackers get access through fake job offers and hiring tests, according to Chainalysis in its report of December 18, 2025.

How to keep crypto safe: what the Binance hack means for you

The key lesson from the Binance hack: a balance on an exchange is a claim against the exchange, not a coin in your own hands. As long as the exchange can and will pay, you won't notice the difference. Binance has promised to cover all losses from its own funds and its emergency fund SAFU.

Binance explained what happened in an announcement on October 30: the entry point was most likely the compromised laptop of a DevOps engineer, which gave the attackers access to a service container and to withdrawals. Binance sees no leak of private wallet keys, and about $3 billion has been frozen on-chain. TRM Labs and Chainalysis attribute the attack to the North Korean group TraderTraitor; everything on that is in our overview North Korea behind the Binance hack?

For you as an investor, the scale is what matters. According to the Chainalysis annual report, North Korean hackers stole at least $2.02 billion in all of 2025, more than ever before. The Binance hack alone is more than three times that. Binance can absorb a loss of this size: before the hack, its known wallets held almost $145 billion according to DefiLlama, not counting its own tokens such as BNB. At FTX, the outflow on the day of its bankruptcy in November 2022 ended very differently, and customers waited years for their money. We collect every case in our section Crypto Hacks and Security.

What you can do with your Binance account right now is covered in our Binance hack report, and whether the exchange could fail over it in How much would it take to bankrupt Binance? The steps below apply to every exchange and every wallet.

Exchange, software wallet or hardware wallet: where your crypto is safest

Crypto is safest on a hardware wallet whose recovery phrase only you know. For money you trade, a regulated exchange is the more convenient place. A software wallet on your phone or computer sits in between: you hold the keys yourself, but on a device that is always online.

A proven split: what you actively trade stays on a licensed exchange, for example one with a license under the EU's MiCA regulation; we compare them under regulated crypto exchanges. What you hold for the long term goes on a hardware wallet. That way, an exchange hack can only hit the smaller part of your holdings.

Hardware wallet: the safest way to store crypto

A hardware wallet generates the private key on the device and never lets it out. You confirm every transfer there, not on your computer. A laptop infected with malware, the entry point in the Binance hack, is then not enough to move your coins. Even the best hardware wallet has one limit: it protects the key, not every signature. Whatever you confirm on the device is valid, which is why a wallet scanner belongs in the setup.

We do not recommend Tangem, a wallet in the format of a bank card. It has no screen of its own, so you check the recipient and amount only in the app, and its firmware is not open source. In December 2024 the app wrote the private keys of seed-phrase wallets into support logs (fixed), and in 2025 and 2026 Donjon, the security lab of manufacturer Ledger, showed attacks on the access code that cannot be fixed by an update on cards already shipped. On top of that comes our disappointing experience with the company's communication; there is no partnership with Tangem. For your coins we recommend a device with its own screen such as the Trezor Safe 3 or Ledger Nano S Plus. Our full assessment is in the review Tangem Wallet: the card without a seed phrase.

Ledger and Trezor work with a display and a cable. You see the recipient address and amount on the device before you confirm, and you back up the wallet with a recovery phrase of 12 or 24 words. Trezor publishes its firmware as open source.

Buy a hardware wallet directly from the manufacturer and never second-hand. In October 2026, Ledger confirmed an implant in tampered devices that read the recovery phrase during setup and sent it to attackers over a mobile network; MediaMarkt and Saturn in Germany then pulled Ledger from their shelves. The background is in our report on the Ledger hack. Never use a phrase that comes with the device or is pre-filled. All models with prices and features are in our hardware wallet comparison.

Wallet scanner: how to check transactions before you sign

A wallet scanner checks a transaction or signature before you confirm it and warns you about known scam patterns, much like antivirus software. Many retail investors lose their coins not through a cracked key but through a single signature on a fake website. That is exactly where a scanner helps.

MetaMask security alerts

MetaMask has such a scanner built in. According to the MetaMask help center, security alerts are switched on by default in the browser extension and the mobile app. They check transactions and signature requests using data from Blockaid and other providers and come in two levels: a warning for a potential risk and a prominent alert when a request is classified as malicious. The alert does not block anything, so you could still confirm. Cancel in that case. More on the wallet is in our MetaMask review.

Revoke.cash: find and revoke old approvals

Every approval you once gave an app stays active until you revoke it. Revoke.cash lists all open token approvals for an address across many blockchains. Your address is enough to view them; to revoke, you connect your wallet and pay only the network fee. A step-by-step guide is in Revoke token approvals on Ethereum, and how to spot a dangerous signature is in our guide to wallet drainers. For an overview of all software wallets, see our software wallet comparison.

How to keep crypto safe on an exchange: settings that protect your account

If part of your coins sits on an exchange, five settings decide whether an attacker can do anything with your password alone.

• Two-factor authentication via app or security key: an authenticator app, a passkey or a hardware key instead of SMS. SMS codes can be intercepted through SIM swapping.
• Withdrawal whitelist: withdrawals only go to addresses you saved beforehand. Many exchanges add a waiting period for new addresses, which gives you time to notice an attack.
• Anti-phishing code: a word you choose that appears in every genuine email from the exchange. If it is missing, the email did not come from the exchange.
• Dedicated email address: an address used only for exchange accounts and nowhere else.
• Licensed exchange: providers licensed under MiCA must keep client assets separate from their own and are supervised.

How Binance performs on security, fees and licenses is covered in our Binance review.

Seed phrase backup: where your recovery phrase belongs

Whoever knows a wallet's recovery phrase owns the coins. So: never take a photo of it, never store it in a cloud or notes app, never type it into a website. Write it on paper or, better, on a steel plate, keep it somewhere fire and water can't reach, and store a second copy in another place. No wallet or exchange support team will ever ask for your phrase.

Why a single printed key is a weak backup is explained in our article on paper wallet risks.

How North Korea's hackers operate and how to spot their tricks

North Korea's hackers mainly attack people, not technology. According to Chainalysis, they plant IT workers as employees inside crypto companies and increasingly pose as recruiters for well-known web3 and AI firms. A supposed hiring process ends with a "technical test" that harvests credentials and access to the victim's current employer. Executives receive approaches from alleged investors or buyers who probe for systems and access paths.

For retail investors, that means: don't install software sent to you by a recruiter, an investor or a contact from Telegram or LinkedIn, and never open a coding task on the computer that runs your wallet. A separate computer, or at least a separate user account just for crypto, lowers the risk considerably. How one such campaign drained thousands of wallets is covered in our report on North Korean hackers and fake job offers.

Checklist: how to keep crypto safe in seven steps

1. Split your holdings: trading money on a licensed exchange, the rest on a hardware wallet.
2. Buy right: hardware wallet directly from the manufacturer, check the packaging, generate the phrase yourself.
3. Back up offline: recovery phrase on paper or steel, two locations, never digital.
4. Harden your exchange account: two-factor authentication via app or security key, withdrawal whitelist, anti-phishing code.
5. Keep the scanner on: leave MetaMask security alerts switched on and take every warning seriously.
6. Clean up approvals: check them once a month with Revoke.cash and revoke what you no longer need.
7. Act fast in an emergency: move remaining funds to a new wallet with a new phrase immediately, revoke approvals, inform the exchange and the police.

The Binance hack shows how much money can disappear in a single evening. Binance can cover the loss. With a hardware wallet and these seven steps, you don't have to rely on that in the first place.