Security & Safety First

Custody changes the failure modes

With an exchange or custodial wallet, a company controls spending keys. You depend on its security, solvency, withdrawal rules and legal arrangements. An account login is not a private key, and a displayed balance is not proof that withdrawals will remain available. Insurance, if offered, may cover only specific events and exclude losses you assumed were protected.

Self-custody puts key management on you. It reduces dependence on a custodian but creates risks from lost backups, malware, coercion, incorrect transactions and inadequate inheritance planning. There is generally no password-reset team that can recreate a lost private key.

Wallet types and tradeoffs

• Software wallet: convenient but dependent on device and software security.
• Hardware signer: can keep signing keys separate from an internet-connected computer, but cannot prevent every phishing attempt or bad transaction you approve.
• Custodial service: may offer account recovery, while retaining control of keys and withdrawals.
• Advanced arrangements: multisignature and shared recovery can spread risk, but complexity may create new failure points.

Original example: two ways to lose access

One learner leaves funds on a platform that freezes withdrawals. Another holds keys privately but loses the only backup and damages the device. Both can lose access, for different reasons. Neither “always leave it on an exchange” nor “self-custody makes loss impossible” answers their needs.

Before choosing a wallet

1. Identify who can authorize spending and recovery.
2. Read the official backup instructions and understand supported formats.
3. Check software maintenance and independent documentation.
4. Plan how to recover without depending on one device or one person.

Takeaway: The safest arrangement is not a universal product ranking. It depends on the risks you can realistically manage.

Sources and further reading

• Bitcoin.org: securing a wallet
• Bitcoin.org: compare wallet features and control of funds

Sources support the technical or regulatory points above. They do not endorse this course or predict investment returns. Rules and service terms can change.

Recovery material is spending authority

Many wallets use a recovery phrase, often 12 or 24 words, but backup designs vary. An additional passphrase, if used, can create a different wallet and may be required for recovery. Follow the actual wallet’s documentation instead of assuming all products work the same way.

Anyone with the necessary recovery material may be able to spend the funds. Never enter it into a website, support chat, shared document or online form. Legitimate help should not require your phrase. Avoid photographs, cloud backups and casual digital copies that expand exposure. More copies can reduce accidental loss but increase the opportunities for theft.

Original example: a backup inventory without the backup

A learner records “Wallet A: backup checked; secure location known to the designated recovery person; official recovery instructions identified.” They do not write the actual phrase into that inventory. This separates administrative information from spending secrets. The plan still needs protection: even knowing where a backup is kept can create risk.

Safe practice checklist

• Practice with an empty or low-value learning wallet, not your only funded wallet.
• Use an official, documented recovery check on a trusted device.
• Do not erase a working wallet until you have verified the recovery plan.
• Account for fire, water, theft and the possibility that you become unavailable.
• Never use an example phrase published in a course or generated by a stranger.

Takeaway: A backup helps only if it is both recoverable and secret. Security procedures reduce risk; they cannot make loss impossible.

Sources and further reading

• Bitcoin.org: backups, encryption and offline storage
• FTC: impersonation and cryptocurrency scams

Sources support the technical or regulatory points above. They do not endorse this course or predict investment returns. Rules and service terms can change.

Check the request before checking the address

A perfectly valid address can belong to a scammer. First ask why the payment is needed and independently verify the recipient through a known channel. Urgent messages from an apparent relative, a cloned exchange page or an unsolicited “support agent” can be social engineering.

Then verify asset, network, full recipient address, amount and fees on the wallet or signing device. Clipboard malware can replace an address. “Address poisoning” can place a similar-looking address in transaction history; do not copy a destination from history merely because it looks familiar.

Original example: a fake support request

A message says your wallet needs “validation” and links to a page requesting recovery words. Stop. A website does not need those words to check a transaction. Close the message and find the service’s official support independently. If recovery material was exposed, treat the wallet as compromised and seek trusted, product-specific guidance immediately; changing an account password alone may not protect it.

Before pressing send

1. Confirm the person and purpose through a separate trusted channel.
2. Verify the address on a trusted display and use the intended network.
3. Inspect fees and whether the recipient needs confirmations.
4. Use a small test when appropriate; it does not validate every later transaction.
5. Save the transaction identifier and non-secret records for reconciliation.

Do not pay “tax,” “release fees” or “recovery charges” to an unknown party claiming it can unlock a lost investment. Recovery scams often target people who have already suffered a loss.

Takeaway: Security includes evaluating people and requests, not just buying a device.

Sources and further reading

• FTC: recognizing and reporting crypto scams
• Bitcoin.org: irreversible payments and user responsibility

Sources support the technical or regulatory points above. They do not endorse this course or predict investment returns. Rules and service terms can change.