Estimate Time8 min

How to store crypto safely

Key takeaways

  • Like any digital asset, bitcoin and other cryptocurrencies are vulnerable to hackers and pump-and-dump scams.
  • Knowing how to store your crypto investments can help reduce the chance of theft.
  • Investors should consider storing crypto either with a trusted custodian or in a cold wallet.

While security is gradually improving across the crypto industry, cyberattacks still happen. In September 2020, for instance, hackers stole over $281 million from Kucoin, one of the largest crypto exchanges. In August 2021, they made off with more than $610 million from the blockchain platform Poly Network. During the summer of 2022, $100 million was swiped from crypto transfer platform Horizon Bridge.

In addition to these headline-grabbing hacks, smaller phishing scams (i.e., social media and email scams) are continuously occurring.

The good news is you can take steps to store your crypto safely. Here are a few suggestions for improving the security of your crypto investments.

Is cryptocurrency safe?

Crypto is bought and sold on the internet, which means it comes with risks, just as there are with any asset you purchase online.

In general, remember that crypto is highly volatile, and may be more susceptible to market manipulation than securities. Crypto holders do not benefit from the same regulatory protections applicable to registered securities, and the future regulatory environment for crypto is currently uncertain.

Crypto is also not insured by the Federal Deposit Insurance Corporation (FDIC) or the Securities Investor Protection Corporation (SIPC), meaning you should only buy crypto with an amount you're willing to lose.

With that said, there are steps you can follow to help keep your crypto safe from cyberattacks, like protecting your passwords and never clicking on suspicious links. While many of the following strategies may sound familiar to anyone who has invested in stocks or commodities, crypto cybersecurity has some additional nuances we'll explore below.

Subscribe to Decode Crypto

Boost your crypto knowledge. Sign up for monthly insights from crypto thought leaders.

How do cybercriminals steal crypto?

Before we look at how to help keep your crypto safe, let's identify some of the ways your investments can be targeted. In general, cybercriminals favor the following methods:

  • Exchange attacks. Hundreds of millions of dollars of crypto are kept on exchanges. Platforms with security vulnerabilities have been targeted in the past.
  • Phishing emails or direct messages on social media. These include fake giveaways and fraudulent confirmation emails. They're designed to look like they're from an exchange or the development team of the cryptocurrency you're invested in. The goal is to get you to click on a fake link that gives the scammer access to your crypto wallet.
  • SIM swaps. A bad actor who obtains your phone number may be able to gain control of your phone by contacting your carrier and requesting a new SIM card. This gives them the ability to reset the logins to your crypto accounts with 2-factor authentication.

Stealing isn't the only way cybercriminals can defraud the market. They can also use pump-and-dump scams (known as "rugs"), where bad actors hype a coin to attract new investors. Once the price reaches a peak, they sell all their holdings at a profit and send the price falling.

While not technically hacks, these scams can wipe out your entire investment if you're not careful.

Strategies that can help keep your bitcoin and other cryptocurrencies safe.

Strategies that can help you store bitcoin and other cryptos safely

Here are 4 strategies that can reduce the chances your crypto gets stolen.

1. Choose where to store your crypto

There are 2 primary options to consider: Store your crypto with a trusted custodian, or provide your own custody.

a. Store your crypto with a trusted custodian

Third-party custodians may be a better option for inexperienced investors. One example of a third-party custodian is traditional trading platforms. These are typically platforms that traditionally offer equities, and are now also offering crypto. There are a few advantages to storing your crypto with this method.

First, you may have a lower chance of losing access to your crypto. If you lose your login, you may be able to work with a dedicated customer service team to recover it. This often isn't the case if you provide your own custody, where it can be impossible to find your login information if you lose it.

Second, keeping your investments secure can be a simpler process if you choose a reputable custodian with years of experience. Providing your own custody can be a complicated, multi-step process with more chances for errors. In contrast, using a third-party custodian may mean you only need to keep track of one username and password.

All things considered, this route may be the most secure strategy for those who don't have time or the desire to learn about the nuances of crypto cybersecurity.

The one drawback to this strategy is that some platforms do not yet provide the ability to send your coins to other wallets. Though this may change in the future, it may also not be a significant downside if your only goal is to use crypto as an investment.

b. Provide your own custody

If you decide to manage your own security, you'll first buy crypto on a crypto trading platform. When you complete your purchase, it'll initially be stored in a digital account (also known as a "hot wallet") managed by the platform. From there, consider transferring it to a digital crypto wallet or a physical, USB-like device known as a "cold wallet."

The benefit of providing your own custody is that it gives you full ownership of your coins. You can use them however you want, including to pay for goods and services.

The downside is that it can be both more complicated and more risky. If you lose the password to your wallet, or accidentally send your crypto to the wrong wallet address, you won't have access to a customer service department. Cold wallets may protect you from virtual theft, but are still vulnerable to physical theft and damage. Any of these events can result in losing access to your crypto forever.

Choose where to store your crypto. Options include using a trusted custodian, or providing your own custody.

2. Always research founders’ backgrounds before investing

Because anyone can start their own coin, crypto often attracts pump-and-dump scams (commonly referred to as "rugs" or "rug pulls"). In 2015, a Bulgarian woman named Ruja Ignatova launched OneCoin, promising it would soon overthrow bitcoin. After accumulating over $4 billion from investors around the world, Ignatova pocketed the money and disappeared.

New investors may want to consider sticking to cryptocurrencies that have established histories and have survived impactful events. Also look for interest from institutional investors with large research teams. Coins that have institutional interest may be comparatively less likely to be brought down by a single bad actor.

However, if you're committed to exploring relatively unproven coins, always research the founders' backgrounds before you jump in. This might help you spot potential red flags. Ignatova, for example, had a history of frauds and multi-level marketing scams.

3. Only buy through established exchanges with reliable histories

If you choose to buy your crypto on a crypto trading platform instead of a traditional trading platform, choose your exchange carefully, as security features can vary widely.

Consider the example of Canada's largest crypto exchange, QuadrigaCX, whose CEO passed away while traveling in 2018. Because only he had the password to the company's cold wallets, customers suddenly found themselves locked out of their investments.

When choosing an exchange, consider sticking to well-funded exchanges with at least several hundred employees. Also be wary of exchanges that offer high yields, as they are often not sustainable. One example is Voyager Digital, an exchange that advertised yields as high as 12%. In July 2022, the company filed for bankruptcy.

4. Follow common sense cybersecurity rules

You should also consider following standard cybersecurity recommendations, such as:

  • If you choose to provide your own custody, never share the key to your private or cold wallet with anyone. Just as you would never share your email password, keep your keys safe. Also make sure to write it down, as losing it could mean losing access to your crypto forever.
  • Avoid bragging about how much crypto you have online. To avoid being targeted by SIM swap scammers, the FBI recommends keeping details about your financial holdings private.
  • Check twice before you click an email link. Phishing scams are common in crypto. If you receive an email that looks like it's from your exchange, first check to see that the domain address is correct. For example, an email from Coinbase should come from an address. When in doubt, contact your exchange's customer support team to verify the email is legitimate.
  • Never click a link in a direct social media message. Exchanges will rarely contact you through direct message on social media, unless you've initiated it by contacting their support team. Sending fraudulent social media message links is currently one of the most popular phishing strategies.
  • Set 2-factor authentication for all accounts. This is where you must enter an additional code beyond your basic username and password to access your account. This code is usually sent to either your mobile phone or email, and adds an added level of security in case your login information is hacked.

Are crypto exchanges safe?

As we noted in the section "Choose where to store your crypto," crypto exchanges come with both benefits and risks.

Investors should consider their personal risk tolerance before choosing how to invest. Those who aren't interested in learning the nuances of crypto cybersecurity may feel more confident keeping their investments on an established traditional trading platform.

The bottom line on storing your crypto safely

Hacking stories may be scary, but the reality is there are ways to lower the chances of losing your investments if you follow commonsense steps.

For most, the least stressful strategy will be to keep it on a traditional trading platform platform, where security measures are taken care of for you. If you'd rather provide your own custody, consider transferring your investments to a cold wallet.

Never click on links without first verifying the source, and think about sticking to blue-chip coins if you are new to crypto. Take these precautions and bad actors will likely have a harder time getting your coins.

Fidelity Crypto®

New to crypto? Not for long. Ease in with as little as $1.

More to explore

Fidelity Crypto® is offered by Fidelity Digital Assets℠.

Investing involves risk, including risk of total loss.

Crypto as an asset class is highly volatile, can become illiquid at any time, and is for investors with a high risk tolerance. Crypto may also be more susceptible to market manipulation than securities. Crypto is not insured by the Federal Deposit Insurance Corporation or the Securities Investor Protection Corporation. Investors in crypto do not benefit from the same regulatory protections applicable to registered securities.

Custody and trading of crypto are provided by Fidelity Digital Asset Services, LLC, a limited liability trust company chartered by the New York Department of Financial Services (NMLS ID 1773897).

Brokerage services in support of securities trading are provided by Fidelity Brokerage Services LLC (“FBS”), and related custody services are provided by National Financial Services LLC (“NFS”), each a registered broker-dealer and member NYSE and SIPC.

Neither FBS nor NFS offer crypto nor provide trading or custody services for such assets.

Fidelity Crypto and Fidelity Digital Assets are service marks of FMR LLC.

As with all your investments through Fidelity, you must make your own determination whether an investment in any particular digital asset/cryptocurrency is consistent with your investment objectives, risk tolerance, financial situation, and evaluation of the digital asset. Neither Fidelity nor any of its affiliates are recommending or endorsing these assets by making them available.

Stock markets are volatile and can fluctuate significantly in response to company, industry, political, regulatory, market, or economic developments. Investing in stock involves risks, including the loss of principal.

Fidelity Brokerage Services LLC does not offer digital assets nor provide clearing or custody services for such assets.

Fidelity Crypto and Fidelity Digital Assets are service marks of FMR LLC.

The third parties mentioned herein and Fidelity Investments are independent entities and are not legally affiliated.

Fidelity Brokerage Services LLC, Member NYSE, SIPC, 900 Salem Street, Smithfield, RI 02917

© 2023 FMR LLC. All rights reserved 1043479.3.1