Blockchains are hard to break. People, devices and habits are not. Learn the simple protective methods that most holders have never heard of — and get our complete 48-step checklist free by email.
Each one closes a real, commonly exploited gap. You can apply most of them today in under 15 minutes.
Attackers create addresses that share the first and last characters with one you use, then send you a tiny "dust" transaction so the fake shows up in your history. Wallets often display only 0x7a3F…b4C2 — which looks identical.
Do this today: never copy an address from your transaction history. Use a saved address book and compare at least 6 characters in the middle on your hardware wallet screen.
When you use a decentralized app, you often grant it an unlimited allowance to move a token. That permission stays active for months or years — long after you stop using the app. If that app is ever exploited, so are you.
Do this today: open the token-approval checker of your network's block explorer, connect your wallet in read mode and revoke approvals you no longer need.
If someone convinces your mobile carrier to move your number to their SIM card, every SMS code — including password resets for your email and exchange accounts — goes to them.
Do this today: ask your carrier for a port-out / number-lock PIN, and switch crypto accounts from SMS codes to an authenticator app or hardware security key.
A wrong address, wrong network or clipboard-hijacking malware can make a transfer unrecoverable. Blockchain transactions cannot be reversed by anyone.
Do this today: before any large transfer, send a small test amount, confirm it arrived, then send the rest. On exchanges, enable the withdrawal-address allowlist.
Malicious browser extensions and look-alike websites are among the most common ways wallets get drained. Your everyday browser has dozens of extensions and countless open tabs.
Do this today: create a separate browser profile used only for crypto, with only your wallet extension installed, and reach sites through saved bookmarks — not search results or links.
Many hardware wallets support an optional passphrase (sometimes called a "25th word"). Without it, a found or stolen recovery phrase alone cannot open the protected wallet.
Know the trade-off: if you forget the passphrase, nobody can recover the funds. Store it separately from the recovery phrase — the full checklist explains how.
Your wallet history shows the address below in its shortened form. Which full address is the real one?
Answer 8 quick questions. Nothing is sent or stored — your answers stay in your browser.
The methods above are a sample. The full checklist walks you through every layer of protection — from your first backup to a plan for your family.
Durable offline backups, recovery testing and the passphrase layer.
Safe purchasing, firmware checks and the hot/vault wallet split.
Email hardening, security keys and SIM-swap prevention.
Reading what you sign, approval hygiene and safe transfers.
Allowlists, anti-phishing codes, API keys and record keeping.
Fake support, airdrops, remote-access tricks and "recovery" scams.
What to do in the first hour after a compromise, and a plan for your family.
Enter your first name and email address in the form below. That is all we need.
A member of our team sends the checklist personally from info@asa-com.org, usually within 1–2 business days.
Tick off the steps in order. Each step explains what to do and why it matters.
A practical, printable list of 48 defensive steps for anyone who holds crypto assets — whether you are just starting or have held for years.
Yes. There is no charge and no obligation. We send it to anyone who requests it.
A person on our team sends each checklist. That lets you reply directly with questions about any step, and it keeps automated bots from scraping it.
Never. Legitimate security education never requires your recovery phrase, private keys, passwords, account logins or remote access to your computer. Treat any such request as a scam.
No. Our content is vendor-neutral and educational. We do not sell, custody, exchange or promote any crypto asset or product, and we do not give investment advice.
No — and be very careful with anyone who claims they can, especially if they ask for an upfront fee. "Fund recovery" offers are a common follow-up scam targeting victims. If you were affected, report it to your local police and, in the United States, to the FBI's Internet Crime Complaint Center at ic3.gov.
We only email you to deliver the checklist and to reply to your messages. To have your details deleted, email info@asa-com.org.