Lesson Objective
Security begins with the control model
A blockchain may continue operating correctly while an individual user still loses assets. Many losses occur because a private key, recovery phrase, exchange account, device or transaction approval is compromised — not because the blockchain's historical record was rewritten.
Digital-asset security therefore begins by identifying who can authorize a transfer and how that authority is protected. The right safeguards depend on whether assets are held through a custodian, controlled directly through a wallet, managed through multiple approvals or committed to a smart contract.
The Essential Distinction
Public addresses, private keys and recovery phrases
Public address: An identifier used to receive assets and view activity. Sharing an address does not normally grant spending authority, but it can reduce privacy by linking transactions.
Private key: Secret cryptographic information used to authorize transactions. It must not be disclosed or entered into untrusted software.
Recovery phrase: A sequence of words — commonly 12, 18 or 24 — that can recreate the keys for compatible wallets. Anyone with the phrase may be able to take control of the associated assets.
Wallet password or PIN: A local access control for a device or application. It may protect everyday access but is not necessarily a substitute for the underlying recovery material.
Transaction signature: Cryptographic authorization of a specific instruction. Signing can transfer assets or grant a smart contract permission to use them.
Custodial and self-custodial security
| Feature | Custodial account | Self-custodial wallet |
|---|---|---|
| Who controls keys? | The provider generally controls transaction-signing infrastructure. | The user or organization controls the wallet credentials. |
| Primary risks | Account takeover, provider failure, insolvency, internal misconduct, withdrawal restrictions and legal uncertainty. | Key loss, recovery-phrase theft, malicious approvals, device compromise and irreversible user error. |
| Recovery | The provider may offer identity-based account recovery, subject to its policies and continued operation. | There may be no third party capable of restoring access after loss of all valid recovery material. |
| User responsibility | Secure the account, verify the provider and understand custody and withdrawal terms. | Secure keys and backups, verify transactions and maintain a tested recovery plan. |
Neither model is automatically safe. Custody transfers some responsibilities to a provider and creates provider-related risks. Self-custody removes that dependency but places more operational responsibility on the holder.
Common ways assets are compromised
Phishing and impersonation: Fake websites, emails, direct messages, advertisements and support agents try to steal credentials or induce a harmful signature.
Account takeover: Reused passwords, compromised email, weak multifactor authentication or mobile-number takeover can expose custodial accounts.
Malware and clipboard manipulation: Malicious software can capture passwords, alter copied addresses or substitute a different transaction destination.
Recovery-phrase theft: Attackers request the phrase through fake support, wallet-verification or migration instructions. Legitimate support should not require the phrase.
Malicious approvals: A transaction may grant a smart contract continuing authority to move tokens later, even when no asset leaves immediately.
Address poisoning: An attacker creates misleading transaction history containing a similar-looking address, hoping the user copies the wrong destination.
Provider or smart-contract failure: An exchange, custodian, bridge, application or protocol can be hacked, mismanaged, frozen or become insolvent.
Physical loss and poor succession planning: Devices and backups can be destroyed, stolen or become inaccessible after incapacity or death.
Layer 1
Protect identity and accounts
Use a unique, long password for each exchange, custodian, email account and password manager.
Protect the email account connected to financial services; it is often the route for password resets and security alerts.
Enable multifactor authentication. Where supported, prefer phishing-resistant methods such as FIDO security keys or passkeys over SMS codes.
Register more than one secure authentication method so the loss of one device does not force insecure recovery.
Turn on login, withdrawal and security-change alerts, and review them promptly.
Use withdrawal allowlists, time delays or address books when the provider offers them.
Never approve an MFA prompt or password reset that you did not initiate.
Why Phishing-Resistant MFA Matters
Layer 2
Secure devices and wallet software
Install wallets and updates only from verified official sources; confirm the publisher and destination before downloading.
Keep operating systems, browsers, wallet applications and security software current.
Use device encryption, a screen lock and a separate non-administrator account where practical.
Avoid conducting sensitive transactions on shared computers, public devices or unknown networks.
Separate routine activity from long-term holdings. A wallet used with experimental applications should not expose all assets.
Treat browser extensions as privileged software and remove those that are unnecessary.
A hardware wallet can isolate signing keys, but its screen, supply chain, recovery process and user confirmations still require care.
Layer 3
Protect the recovery phrase
A recovery phrase deserves controls appropriate to the value it protects. The objective is to prevent both unauthorized access and permanent loss.
Record the phrase accurately and verify the backup according to the wallet manufacturer's trusted procedure.
Keep it offline. Avoid ordinary photographs, screenshots, email drafts, cloud notes and unencrypted digital files.
Store backups in secure locations protected from theft, fire, water damage and casual discovery.
Do not give the phrase to support staff, callers, friends, investment promoters or websites.
Enter it only during a deliberate recovery into verified wallet software or hardware, in a private and controlled environment.
Avoid inventing an untested scheme so complicated that the rightful owner or successor cannot recover the wallet.
For material holdings, consider professional advice on multisignature arrangements, estate planning and jurisdiction-specific legal requirements.
Layer 4
Verify every transaction
Confirm the asset and network.
The receiving service must support the exact asset on the exact blockchain network.
Obtain the address from a trusted source.
Use the recipient's official deposit screen, verified contact or approved internal record — not an unsolicited message.
Compare the complete address.
Check more than the first and last characters, particularly after copying and pasting.
Review the wallet or device display.
Confirm destination, amount, network and contract action before signing.
Send a small test when appropriate.
Verify arrival before sending the remaining amount. A test reduces some errors but does not validate every later transaction.
Preserve the record.
Keep the transaction identifier, date, purpose, amount, fees, counterpart information and supporting documents.
Slow Down
Layer 5
Control application permissions
Verify the application domain and contract information through more than one trusted source.
Understand whether the request is a transfer, login signature, token approval or unlimited spending authorization.
Limit approval amounts and duration where the application permits it.
Review and revoke permissions that are no longer required, using a trusted tool and verified network.
Do not assume that disconnecting a website from a wallet cancels permissions already granted on-chain.
Consider a separate wallet with limited funds for unfamiliar applications.
Security for organizations
Business controls should avoid placing significant authority with one person, device or undocumented process.
Maintain a current inventory of wallets, custodians, networks, authorized users and recovery arrangements.
Separate transaction preparation, approval, custody administration and accounting review where practical.
Use role-based access, transaction limits, multiple approvals or multisignature controls appropriate to the risk.
Require independent verification for new addresses and changes to settlement instructions.
Document who can upgrade contracts, recover accounts, access backups or respond to an incident.
Reconcile blockchain records, custodian statements and the accounting ledger regularly.
Test continuity and succession procedures without exposing live recovery secrets.
Accounting and Audit Trail
If compromise is suspected
Act quickly, but avoid improvising on a possibly compromised device.
Stop communicating with the suspected scammer and stop sending funds.
Contact the exchange, custodian, bank or service provider through independently verified channels and request available account protections.
From a clean device, secure the connected email and accounts, change compromised credentials and review active sessions and authentication methods.
If a self-custodial recovery phrase or private key is exposed, create a new wallet with entirely new recovery material using verified tools and move remaining assets when it is safe to do so.
Review and revoke malicious token approvals if the wallet remains usable and the process can be performed safely.
Preserve addresses, transaction identifiers, messages, emails, screenshots, phone numbers and a timeline of events.
Report fraud promptly to the appropriate local authorities and relevant cybercrime or financial-fraud reporting service.
Be cautious of recovery services demanding advance payment or claiming guaranteed recovery; victims are frequently targeted again.
A practical security checklist
I know who controls the keys for each holding.
My email and custodial accounts use unique passwords and strong MFA.
My recovery material is accurate, offline, protected and recoverable by the intended person.
My devices and wallet software come from verified sources and remain updated.
I verify the complete address, asset and network before sending.
I understand transaction signatures and review active smart-contract permissions.
I separate experimental activity from significant holdings.
I maintain records and have a written incident and succession plan.
Key takeaways
Blockchain security does not eliminate account, key, device, application or human risk.
A wallet protects signing authority; it does not contain the blockchain assets themselves.
Custodial and self-custodial models assign risks and responsibilities differently.
Recovery phrases and private keys require protection from both theft and permanent loss.
Strong MFA, verified software, transaction checks and limited permissions create layers of defense.
A small test transaction helps detect some mistakes but is not a substitute for complete verification.
An incident plan prepared in advance is safer than making urgent decisions during a compromise.
Quick knowledge check
Why can assets be stolen even when the blockchain itself continues to operate correctly?
What is the security difference between a wallet PIN and a recovery phrase?
Why does disconnecting a website not necessarily revoke an on-chain token approval?
Name four records an organization should retain in addition to a transaction identifier.
Glossary
Sources and further reading
Editorial note: This lesson was independently written for Fichtner Digital and synthesizes the cited sources in original language. It does not reproduce substantial passages from them. Facts and links last reviewed 22 July 2026.
Educational purposes only. Not financial advice. No security method eliminates all risk. Digital-asset transactions can be irreversible, and loss of credentials or reliance on a compromised provider can result in complete loss. This material does not constitute investment, legal, cybersecurity, accounting or tax advice.