A Practical Crypto Security Checklist

Start with the threats that actually occur

Most crypto losses do not come from sophisticated attacks on cryptography. They come from a small set of recurring failures: phishing, reused passwords, SIM swaps, malicious approvals, and leaving everything on an exchange. The checklist below is ordered by how much risk each step removes relative to the effort it takes.

Do these first

Replace SMS two-factor with an authenticator app on every exchange and email account. SIM swap attacks are common in India and SMS codes do not survive them.
Use a unique password per service, generated and stored in a password manager. Credential reuse is how one unrelated breach becomes a crypto loss.
Secure the email account attached to your exchanges. It is the recovery path for everything else, and compromising it compromises the lot.
Enable withdrawal allowlists so funds can only leave to addresses you pre-approved, with a delay on adding new ones.
Move long-term holdings off exchanges to a wallet you control.

Then these

Verify your seed phrase backup by restoring it on a spare device before it matters.
Store the backup physically, in more than one location, never digitally and never photographed.
Bookmark exchange and wallet URLs and use only those. Search results carry paid phishing ads.
Review and revoke token approvals you no longer use. Standing unlimited approvals outlive the session that created them.
Use a separate wallet for experimentation, holding only what you can lose.

Habits that matter more than settings

Never enter a seed phrase into anything except your wallet during a deliberate restore. There is no legitimate exception.
Verify addresses on the hardware wallet screen, not on your computer. That screen is the part malware cannot forge.
Send a small test transaction first to any new address.
Treat urgency as a warning. Every scam manufactures time pressure, because research defeats it.
Assume unsolicited contact is hostile. Support never messages first.

For Indian users specifically

Two additions. First, if you trade P2P, keep a separate bank account for it so a fraud-related freeze does not immobilise your primary banking. Second, keep transaction records from the start — not only for security but because Schedule VDA requires per-transaction detail that is painful to reconstruct.

The review worth doing quarterly

Check active sessions and API keys on every exchange; revoke anything unrecognised.
Confirm two-factor is still app-based and recovery codes are stored safely.
Review token approvals and revoke the unused.
Verify that your seed backup is where you think it is and still legible.
Export transaction history from each platform you used.

Fifteen minutes, four times a year, removes most of the exposure that accumulates through ordinary use.

API keys deserve their own section

If you connect a portfolio tracker, a tax tool or a trading bot to an exchange, you create an API key — a credential that can act on your account without your password or two-factor code.

Create read-only keys wherever the tool permits it. A tracker never needs trade or withdrawal permission.
Never enable withdrawal permission on a key used by third-party software, under any circumstances.
Restrict by IP address where the exchange supports it, so a stolen key is useless from elsewhere.
Use one key per tool, so revoking one does not break everything.
Audit and delete unused keys quarterly — keys outlive the tools that created them.

Device hygiene

The device you use matters as much as the settings on the account.

Keep the operating system and browser updated; most malware exploits known, patched vulnerabilities.
Install browser extensions sparingly. Extensions can read every page including your exchange session, and compromised extensions have been used to steal crypto at scale.
Consider a dedicated device or browser profile for crypto, with nothing else installed.
Never access exchange accounts over public wifi without a trusted connection.

What this checklist deliberately omits

Not on the list: complex multi-signature arrangements, air-gapped signing setups, or elaborate physical security. These are genuinely stronger and they fail the practicality test for most people — an arrangement too cumbersome to maintain gets abandoned, which leaves you worse off than a simpler one consistently applied.

Start with the items above. They address the attacks that actually take people's crypto, and they take an afternoon.