Most people who lose crypto were not hacked by geniuses. They reused a password, clicked a link, or pasted an address without checking it. Your $200 balance doesn't need a vault. It needs a handful of habits you'll still be doing in six months.
Here are the ones that prevent the most common losses, in the order worth fixing them.
Lock down the accounts that already hold your money
Do this before you buy anything. It takes one evening.
Give every exchange its own password
Not a variation on your email password. A random string from a password manager, one per account. When one exchange gets breached, a reused password is the thread that unravels everything else you own.
Use app-based two-factor, not SMS
SMS codes can be intercepted through SIM-swap attacks, where someone convinces your mobile carrier to move your number onto their SIM. An authenticator app or a hardware security key closes that gap. Most major exchanges support both — switch when you can.
Treat email as the master key
Every exchange password reset flows through your inbox. If someone owns that inbox, they own everything downstream. Secure it first with the strongest 2FA available, and consider a separate email address just for crypto so phishing attempts don't land next to your shopping receipts.
Check your withdrawal path before you hit send
Buying is the easy part. Moving coins is where mistakes get expensive, and most of them can't be undone.
- Verify the first and last six characters of the destination address against what you copied.
- Send a small test amount first. A $5 transfer confirms the address works for almost nothing.
- Match the network exactly — a token sent on the wrong chain can be gone permanently.
- Save trusted addresses in the exchange's address book instead of pasting from clipboard history.
Clipboard hijacking is real: some malware silently swaps a copied wallet address for the attacker's. The test transfer catches that. No single tool does.
Learn the two scam patterns aimed at beginners
You don't need to memorize every attack. You need to recognize the shapes they come in.
Urgency
Anyone rushing you — "act in the next ten minutes," "your account will be frozen" — is almost certainly a scammer. Real platforms don't manufacture panic. Slow down, open the official app or a bookmarked URL, and check for yourself.
Fake support
Search results and social media are full of fake support accounts. Real support never asks for your password, your 2FA code, or a seed phrase. Here's how it plays out: a beginner posts in a public forum about a stuck withdrawal. Within minutes a "support agent" DMs them asking for their 12-word recovery phrase to "verify the wallet." They send it. The wallet is emptied. That script runs constantly.
Keep your seed phrase offline, full stop
If you move to a self-custody wallet, the recovery phrase is the whole ballgame. Write it on paper or stamp it into metal. Never photograph it, never type it into a website or chat, never keep it in a notes app or cloud storage.
| Habit | Risk it removes |
|---|---|
| Unique password per account | One breach cascading into others |
| App-based 2FA | SIM-swap interception |
| Test transfer before sending | Permanent loss to a wrong address |
| Seed phrase offline only | Remote wallet theft |
| Bookmarked login URLs | Phishing sites |
Split your balance between exchange and wallet
A small balance on a reputable exchange is fine for trading and learning. Treat it as spending money, not savings. Once you hold more than you'd shrug off losing, move it to a wallet you control. Not your keys, not your coins — the old line still holds.
Then set a monthly five-minute review: check login history, confirm 2FA is still on, update the password manager. Five minutes a month beats a frantic recovery attempt any day.
Frequently asked questions
Is SMS two-factor authentication good enough?
Better than nothing, but it's the weakest common option because SIM-swap attacks let someone take over your number and receive your codes. An authenticator app or hardware key closes that gap, and most major exchanges support both.
How much crypto should I keep on an exchange?
Only what you're actively trading or learning with. There's no universal number, but a common approach is to keep the bulk in a wallet you control and leave a small working balance on the exchange, like a checking account versus savings.
What should I do if I think I've been phished?
Change your password and 2FA settings immediately, starting with your email. Revoke any connected sessions or API keys you don't recognize. If a seed phrase was exposed, move the funds to a fresh wallet right away.
Are hardware wallets worth it for small amounts?
Not at first. A $200 balance doesn't justify a $60–$100 device, and the real early risk is phishing and password reuse, not wallet theft. Build the account habits first, then add a hardware wallet as your balance grows.
Open your password manager tonight and fix one reused password. That's the habit that matters most, and it takes two minutes.