Crypto security: how to protect your crypto without relying on luck

When you buy bitcoin on an exchange, what you own is a balance recorded in a company's books. The private keys, the ones that actually move the coins, are kept by the platform: that's third-party custody. When you move your crypto to a wallet of your own, you generate and keep the keys yourself: that's self-custody. Both options carry risks; what changes is who you're trusting.

With an exchange, you trust the company. Mt. Gox suspended operations in February 2014 and FTX filed for bankruptcy on November 11, 2022; in both cases customers lost access to what they had deposited. Hacks aren't a thing of the past either: Bybit had about $1.5 billion stolen on February 21, 2025, according to the FBI, and Bitget lost about $388 million from its online wallets on September 24, 2026. Bitget says its protection fund covered it, but that cushion depends on each company's goodwill and cash.

If you live in Spain or elsewhere in the EU, the picture has improved. In Spain, since July 1, 2026, only providers authorized by the CNMV (Spain's securities regulator) or by another European authority with a passport can operate, and MiCA requires the custodian to legally separate its customers' crypto from its own assets, so its creditors can't claim them if it goes bust. What MiCA doesn't give you is a guarantee fund like the one that covers bank deposits. Before you open an account, look the platform up in the CNMV register; I cover the rest in my guide to the MiCA rules and in the exchanges section.

My take, sin humo (no hype): the exchange is the way in and the way out, not the safe. To buy, I use OKX, which holds a MiCA license through Malta's MFSA, and I go through it, downsides included, in my OKX review. If you see a Bitget link in older descriptions of my videos, keep in mind that Bitget has no MiCA license and that since July 1, 2026 it can't provide services to residents of Spain.

Wallet vs Exchange: dónde guardar tus criptos DE VERDAD (y no perderlas)12:15

Within self-custody there are two families. A hot wallet (MetaMask, Trust Wallet, Phantom…) generates and uses the keys on an internet-connected device, whether that's your phone, your browser or your computer. It's free, fast and perfect for moving money often, but it shares a home with everything you install. A cold wallet keeps the keys on a dedicated device that signs internally and never lets them out. It costs money and it's a bit slower, and in exchange, malware on your computer can't walk off with the seed.

The rule I defend in the video is simple: there's no best wallet for everyone, there's a best one for you. With little money and lots of movement, a well-configured hot wallet is enough. When the amount starts to hurt if it disappears, it's time for a cold one, and most people end up using both. I explain it in depth in hot vs cold wallet. If you already know what you're after, here are my comparisons: the best cold wallets of 2026, Ledger vs Trezor and the best hot wallets.

Wallet FRÍA vs Wallet CALIENTE: cuál necesitas de verdad (guía 2026)11:07

Almost every wallet follows the BIP-39 standard: when you create it, you get 12 or 24 words taken from a list of 2,048. All your keys come from those words, so anyone who has them can empty your wallet from anywhere in the world without touching your device. The device can be lost, broken or replaced. The seed is what you have to protect.

1. Never digital. No photo, no note on your phone, no email to yourself, no password manager. A photo ends up synced to the cloud almost without you noticing.
2. Never type it into a website or an app other than your own wallet at the moment you create or restore it. If something asks for the words to “verify,” “sync” or “unlock,” it's theft.
3. Nobody legitimate will ask for it. Not Ledger, not Trezor, not MetaMask, not the support team of any exchange. After the fake app of April 2026, Ledger's CTO summed it up like this: if someone, or some app, asks for your 24 words, assume something is wrong.
4. Paper first, metal later. Write it down by hand, in order and in clear handwriting. If the amount justifies it, copy it onto a metal plate that can survive fire and water, and keep it away from the device.
5. Generate it yourself. If a wallet arrives with words already written down or someone “gives” you a seed, don't use it: whoever wrote it can spend your funds whenever they like.

For serious amounts there's an extra layer: the passphrase, the so-called “25th word.” It's combined with the seed and opens a different wallet, so whoever finds your paper sees nothing. The price is that if you forget it, there's no way to recover it. Store it separately and make sure you remember it before you put money in.

Every big incident of these two years leaves a practical lesson, and none of them comes down to bad luck. They all exploit a specific weak point that you can keep an eye on too.

Bybit, February 2025: they signed what they couldn't see

The attackers, whom the FBI links to North Korea, didn't break any key. They hacked the computer of a developer at Safe{Wallet}, the multisig platform Bybit used, and injected code into its website. When the signers approved a routine transfer from an Ethereum cold wallet, the interface showed them a normal transaction while the real one changed the contract and handed control to the attackers. That's how more than 400,000 ETH and stETH walked out the door. The lesson: a cold wallet signs whatever you approve. If you can't read on the device's screen what you're signing, you're not protected.

Coldcard, July 2026: the seed was born weak

Coldcard, one of the most respected cold wallets for bitcoin, had carried a bug in certain firmware versions since March 2021: seeds were generated with far less randomness than intended, about 72 bits on recent models instead of 128. Attackers regenerated those seeds by brute force, without touching a single device, and from July 30 they emptied more than 5,200 addresses. The lesson is uncomfortable: updating the firmware doesn't fix a seed that was born weak. You have to create a new one and move the funds. Anyone who generated theirs with 50 or more dice rolls wasn't at risk from this flaw.

¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?7:15

Trust Wallet, December 2025: the poisoned update

On December 24, 2025, a tampered version of the Trust Wallet extension appeared in the Chrome Web Store, published with credentials stolen from its developers. For two days it sent the seed phrase of anyone who opened it to the attackers: 2,520 addresses emptied and about $8.5 million gone. The mobile app wasn't affected and the company announced voluntary refunds. The lesson: an extension updates itself and inherits any weak link in the chain of whoever publishes it. Don't keep more there than you're willing to lose.

Ledger and Trezor: your data leaves through the back door

No Ledger or Trezor leak has exposed seeds, but they have exposed names, emails, phone numbers and home addresses. In 2020 Ledger lost a database that ended up published with 272,853 customers and their postal addresses, and in January 2026 it suffered another breach through Global-e, the company that handles its store's orders. Trezor has had three: 66,000 support contacts in January 2024, 80,689 customers exposed by its logistics company ShipMonk in August 2026 and about 347,000 email addresses that received phishing after the hack of Brevo, its newsletter provider, in September. With that data come the fake emails, the calls and even paper letters with a QR code that leads to a website asking for the seed: in 2025 and 2026 they arrived with both brands' letterheads. If you bought a wallet, assume your address may be on a list and distrust any contact you didn't start yourself.

October 2026: Ledger devices tampered with before they reach the customer

The most recent case is the most unsettling. Since October 9, Ledger has been investigating thefts from buyers of CryptoBilis, a reseller in Southeast Asia. Inside some devices there was an implant: a circuit with an LTE modem and an eSIM that captures the 24 words while they're shown on screen during setup and sends them out. It doesn't touch the secure chip, which is why Ledger's Genuine Check passes the device as genuine. On-chain loss estimates range from $72 million to $93 million, figures Ledger hasn't confirmed. Independent researchers also found tampered units bought on marketplaces in Japan, and some people saw them listed at almost half price. In Europe, MediaMarktSaturn pulled Ledger devices from its stores and website as a precaution after a customer complaint in Germany, and Ledger said no losses had been recorded in that case. Trezor, for its part, will cut back its reseller network on January 1, 2027.

The lesson is the one I repeat in my video descriptions: buy your cold wallet only from the manufacturer's official website, never second-hand or from third parties. If you're going for one of the two I recommend, the official Ledger store and the official Trezor store are the ones in the boxes above.

Hacks make the headlines, but most of the money is lost to scams. In the FBI's latest annual report, crypto-related complaints added up to 181,565 cases and $11.366 billion in losses in 2025, in the United States alone, and investment fraud accounted for $7.228 billion of it. The script is almost always the same: someone contacts you, adds you to a group of “experts,” shows you fake profits on a fake platform and, when you try to withdraw, “taxes” and “fees” start appearing that never end.

Two other classic routes go after your wallet directly. Fake apps: in April 2026, a fake Ledger Live for Mac slipped into Apple's App Store and stole about $9.5 million from around 50 victims. And address poisoning: someone plants in your history an address almost identical to one you use, hoping you'll copy it from there. An academic study covering two years of Ethereum and BNB Chain counted 270 million attempts and at least $83.8 million stolen.

I have a whole guide with the warning signs and what to do if it has already happened to you: crypto scams. If you're a victim in Spain, INCIBE's 017 helpline is free and confidential, and you file the report with the Policía Nacional, the Guardia Civil, the regional police or a court. The sooner, the better.

7 errores que ARRUINAN a los principiantes en cripto (evítalos antes de perder dinero)12:34

If you only read one part of this page, make it this one. None of these steps takes more than a few minutes, and together they close almost every door through which money gets lost.

1. 01

   Separate spending from savings

   An exchange to buy and sell, a hot wallet for day-to-day use and a cold wallet for what you won't touch. If you have everything in one place today, start here.

2. 02

   Check your exchange's license

   If you live in Spain or elsewhere in the EU, look it up in ESMA's register and, in Spain, in the CNMV's. Since July 1, 2026, if it has no MiCA authorization, it can't serve you in Spain.

3. 03

   Lock down your accounts

   A unique password for each platform, a password manager for them (never for the seed) and two-factor authentication with an app or a physical key rather than SMS.

4. 04

   Buy the cold wallet from the official store

   No second-hand units, no marketplaces, no bargains. If the seal, the box or the device doesn't match what the manufacturer shows, send it back.

5. 05

   Generate the seed yourself and write it down by hand

   In private, with no cameras around, on paper and in order. No photos and no notes on your phone.

6. 06

   Make a backup that survives a fire

   A metal plate for the seed and a second safe place, separate from the device.

7. 07

   Test before you move the bulk

   Send a small amount, check that it arrives and verify the address on the device's screen, character by character.

8. 08

   Copy addresses from the wallet, never from your history

   And compare the beginning, the end and several characters in the middle. It's your defense against address poisoning.

9. 09

   Read what you sign

   Be wary of blind signing, unlimited approvals and airdrops in a hurry. Review and revoke the permissions you no longer use.

10. 10

    Leave instructions for your family

    A letter explaining what you have and where the backups are, without writing the seed in it. I go into detail just below.

It's the gap people talk about least. Self-custody works so well that, if something happens to you and nobody knows your wallet exists or where the seed is, those funds stay locked forever. At the other extreme, if you leave everything too easy to reach, anyone in your household can empty it. You have to find the middle ground.

• A letter of instructions listing what you have (exchanges, wallets and networks), where the backups are and who to ask for help. Without writing the seed in it.
• The seed stays out of the will. A will is a document several people end up reading. It's enough for it to mention that the letter exists and where to find it.
• Separate pieces. The seed in one place, the passphrase in another and a trusted person who knows how to put them together only when the time comes.
• Split backups for large amounts. Trezor lets you split the backup into several parts (for example, so that any two of three are enough), and multisig wallets require several keys to move funds. They're more complex, so practice first with a small amount.
• A review once a year, or every time you change wallets. And make it clear to your heirs that nobody legitimate will ever ask them for the seed.

With exchanges, the path is more bureaucratic than technical: the platform will ask your heirs to prove the inheritance with whatever documents it requires, so it's enough for them to know where you have accounts. If you live in Spain, the tax side of crypto is in my guide to crypto taxes in Spain (elsewhere in the EU, your own country's rules apply), and for your specific case, a notary or a lawyer is the better call.

• You're starting from zero: first how to start in crypto and then hot vs cold wallet.
• You're about to buy your first cold wallet: the best cold wallets of 2026, with official prices and each brand's drawbacks.
• You're torn between the two big names: Ledger vs Trezor, head to head at the same price.
• You want a wallet for everyday use or for DeFi: the best hot wallets of 2026, with my MetaMask tutorial.
• “Support” has messaged you or someone is offering you a bargain: read crypto scams before you reply.

This is NOT financial advice. It's my personal analysis. Always do your own research. The security of your crypto is your responsibility, and the good news is that almost everything it takes fits into a single afternoon.