Crypto Wallet and Exchange Security: A Sysadmin’s Guide to Protecting Digital Assets

Crypto theft isn’t a trading-platform problem any more, it’s a credential-security problem. In January 2026 alone, phishing accounted for 71% of the roughly $400 million lost across the sector, and the single largest incident that month, $284 million in Bitcoin and Litecoin, wasn’t a technical exploit at all. The victim handed over a hardware wallet recovery phrase to someone impersonating Trezor support.

That’s a pattern every sysadmin already recognises: attack surface, authentication factors, and the human element. This guide applies that thinking to wallets and exchange accounts, covering what hardware wallets actually protect against, which MFA methods hold up under phishing, and the custody habits worth enforcing whether you’re securing your own holdings or fielding “is this safe?” from someone who just clicked a link.

Why this belongs on an IT security checklist

The attack surface has moved. In 2021, most crypto losses came from code exploits: bugs in smart contracts, bridges, and protocol logic. By 2025, Chainalysis-style tracking shows 76% of losses coming from infrastructure attacks instead, compromised private keys, phished credentials, and supply chain tampering. The February 2025 Bybit hack, the largest exchange security failure on record at roughly $1.5 billion, came from compromised signing infrastructure rather than a smart contract flaw.

In other words, the same controls you’d apply to any high-value credential (privileged admin accounts, domain controllers, financial systems) now apply directly to crypto holdings: minimise standing access, separate hot and cold storage, and assume the phone call or support chat claiming to help you is the attack.

What a hardware wallet actually protects against

A hardware wallet (Ledger, Trezor, and similar devices) keeps the private key on a dedicated chip that never touches an internet-connected machine. Transactions are signed on the device itself, so malware on your PC can display a fake address but can’t sign a transaction without physical confirmation on the wallet’s own screen.

What it doesn’t protect against is you typing the recovery seed phrase into a website, a support chat, or a phone call. The wallet’s entire security model rests on that phrase staying offline and never being disclosed to anyone, including “support”. No legitimate hardware wallet vendor will ever ask for it, by phone, email, or chat. That single rule would have stopped January 2026’s largest theft.

2FA that actually resists phishing

Not all two-factor authentication is equal, and for crypto accounts the gap matters more than usual.

• SMS codes: the weakest option. SIM-swap fraud (porting your number to an attacker’s SIM) defeats it entirely, and it’s the method most exchanges still default to.
• Authenticator apps (TOTP): better, since codes aren’t tied to your phone number, but a convincing fake login page can still relay the code to the attacker in real time.
• Hardware security keys (FIDO2/WebAuthn): the strongest option. The key cryptographically checks the site’s actual domain before responding, so a lookalike phishing page simply fails, it can’t complete the handshake.

If an exchange supports hardware security keys, use one there and for the email account tied to it. That email is usually the actual recovery path attackers go after first.

Phishing patterns worth knowing about

Beyond the classic fake-login page, three patterns are behind most current losses:

1. Fake support impersonation. Attackers cold-call or message victims claiming to be from a wallet vendor or exchange, walking them through “recovery steps” that end with the seed phrase being read out. This is how the $284m January 2026 theft happened.
2. Address poisoning. Attackers send tiny “dust” transactions from wallet addresses that look almost identical to ones you’ve used before, hoping you copy the wrong address from your transaction history next time you send funds. Blockaid recorded over 65 million of these attempts since January 2025.
3. Malicious approval requests. A fake dApp or “wallet connect” popup asks you to approve a token spending limit. Approve it and the attacker can drain that token without needing your seed phrase at all.

A practical custody checklist

• Never type or read out a seed phrase to anyone. No genuine support process needs it.
• Write the seed phrase on paper or a metal backup plate, not a phone photo, cloud note, or password manager entry.
• Keep only spending money in a hot wallet; move anything you’d be upset to lose into cold storage.
• Verify a receiving address on the hardware wallet’s own screen, not just what the PC displays.
• Periodically review and revoke old token approvals through the relevant block explorer’s token approval tool.
• Use a unique, password-manager-generated password and a hardware security key for exchange logins and the associated email account.

Frequently asked questions

Is a software wallet ever good enough?

For small, actively-used balances, yes. Treat it like cash in your pocket rather than savings: fine to lose, not where you keep everything.

What do I do if I think I’ve been phished?

Move any remaining funds to a new wallet with a freshly generated seed phrase immediately, using a device you’re confident is clean. If a seed phrase was disclosed, everything secured by it is compromised, moving funds isn’t optional, it’s the only fix.

Are hardware wallets vulnerable to supply chain tampering?

It’s a known risk category, which is why vendors recommend buying only direct from the manufacturer or an authorised reseller, and checking the tamper-evident packaging and device firmware signature on first setup.

Does 2FA stop SIM-swap attacks?

SMS-based 2FA doesn’t, since the attacker receives the code once your number is ported. App-based TOTP or a hardware key isn’t tied to your phone number, so it isn’t affected.