Defending Yourself

SIM Swap Defense

SIM swaps are preventable. Most victims had no account-level protections on their carrier account. These steps, done once, protect against the most common vector:

Hardware Wallet Setup

Setup security varies by brand. The principles are universal but the specific steps matter.

Universal rules for all hardware wallets

• Only buy from the manufacturer directly or from authorized resellers. Never buy secondhand.
• When the device arrives, verify the packaging for signs of tampering (broken seals, unusual tape, evidence of opening).
• Set up the device yourself, from scratch. Never use a device that was already initialized by someone else.
• Generate a new seed phrase on the device itself. Never import a seed that was generated on a computer or phone.
• Write the seed phrase on paper during setup. Never take a photo. Never type it into a computer.
• Set a PIN that you will actually remember but is not obvious to someone who knows you.
• Enable PIN protection immediately. The PIN prevents unauthorized physical access.

Ledger-specific setup

• Download Ledger Live exclusively from ledger.com. Not from any other site, not from an email link.
• Verify addresses on the device screen before sending. Never trust the address shown on your computer screen only.
• If you use Bluetooth (Nano Gen5, Flex, Stax): connect in a private location, disconnect when done.
• Do not enable Ledger Recover unless you specifically want cloud-based seed recovery.

Trezor-specific setup

• Download Trezor Suite from trezor.io only.
• Enable the passphrase feature (25th word) for your main holdings. This creates a hidden wallet that requires both the seed and the passphrase to access.
• Store the passphrase separately from the seed phrase. If someone finds your seed, they cannot access your main wallet without the passphrase.
• Write down the passphrase as carefully as the seed. Losing the passphrase is equivalent to losing the wallet.

Air-gapped wallets (ELLIPAL, Keystone)

• The device must never be connected to a computer via USB data mode during normal operation. Keystone: USB charges only. ELLIPAL: USB is power only.
• For Keystone, firmware updates come via microSD. Verify the firmware hash from Keystone's official site before applying.
• For ELLIPAL, firmware updates come via QR code from the ELLIPAL app. Do not scan QR codes from any other source.
• The signing workflow (create on phone, scan to device, sign, scan back) is the security property. Don't shortcut it.

Seed Phrase Storage

The seed phrase is the single most important thing to protect. Lose it and you lose everything. Have it stolen and you lose everything. There is no recovery support, no customer service, no second chance.

Steel and titanium backup plates

Products like Cryptosteel Capsule, Billfodl, and CoinPlate allow you to engrave or stamp your seed words onto metal. Stainless steel resists temperatures above 1400°C. Titanium is even more resistant. Both survive floods, fires, and corrosion that would destroy paper in minutes.

The metal backup is not more secure by itself - it's the same 24 words. But it survives catastrophic physical events that paper doesn't. For a portfolio worth protecting, metal backup is not optional.

SLIP-39 Shamir's Secret Sharing

SLIP-39 (available natively on Trezor devices) lets you split your seed into shares using Shamir's Secret Sharing. In a 3-of-5 configuration: 5 shares are generated. Any 3 are sufficient to reconstruct the wallet. Any 2 shares reveal nothing mathematical about the seed.

This lets you distribute backups geographically without creating a single point of failure. Store one share at home, one in a safety deposit box, one with a lawyer, one with a trusted family member, and keep one offsite backup. An attacker who finds your lawyer's share has nothing. A house fire that destroys your home share doesn't destroy your access.

The downside: SLIP-39 shares are more complex to use and understand than a standard seed phrase. If family members need to recover after your death, they need instructions and at least 3 of the 5 shares. Documentation is essential.

Geographic distribution

Regardless of whether you use SLIP-39 or standard BIP-39, don't keep all seed phrase backups in one location. A fire, flood, or burglary that destroys one location should not destroy all copies. At minimum: one copy secured at home (in a safe if possible), and one copy in a different physical location (safety deposit box, trusted relative in another city). Safety deposit boxes are accessible by your bank but provide strong protection against home-level disasters.

Password and 2FA Hierarchy

Not all 2FA is equal. The three-tier hierarchy, from strongest to weakest:

Pair your 2FA with a password manager (1Password, Bitwarden). Use a unique, generated password for every account. The password manager itself should be protected by a hardware key. This setup means that compromising any single credential is not enough to access your accounts.

Browser Hygiene

Your browser is the most attacked surface in crypto. Malicious extensions, compromised bookmarks, and phishing tabs live there. Separation is the primary defense.

Transaction Verification

Most crypto losses involve a transaction the victim authorized. The transaction was valid. The authorization was obtained through deception or error. Verification at signing time catches the deception.

Approval Management

Token approvals accumulate silently. Every DeFi interaction you've ever done has likely left at least one approval active. Some of those protocols no longer exist. Some have been compromised. The approvals remain valid until you revoke them.

Beyond classic ERC-20 approvals, watch for Permit and Permit2 signature requests. These are off-chain signatures that grant token-spending authority without an on-chain transaction. A malicious dApp can request a Permit2 signature that looks innocuous in a wallet popup, then use it to drain your wallet without you ever signing a transaction in the conventional sense. revoke.cash supports viewing and revoking active Permit2 allowances. If a site asks you to sign a Permit or Permit2 message you do not fully understand, refuse. The wallet drainer scripts dominating losses in 2024 to 2026 work primarily through this mechanism.

Air-Gapped Signing for High-Value Transactions

For any transaction large enough that you'd regret it if something went wrong, air-gapped signing ensures the private keys never touch an internet-connected device during the signing process.

This workflow applies to ELLIPAL Titan 2.0, Keystone 3 Pro, and NGRAVE ZERO. It is also possible with Trezor (using Trezor Suite's offline mode) and some Ledger configurations. The friction is worth it for transactions where losing the funds would be a serious financial event.

Multisig for High-Value Holdings

For holdings significant enough that a single hardware wallet feels like too much concentration, multisig is the next defense layer. A multisig wallet requires multiple keys to authorize a transaction. The most common configuration is 2-of-3: three keys exist, any two can sign. An attacker who compromises one key gets nothing. The user retains operational flexibility if one key is temporarily unavailable.

The two practical paths to multisig are self-custody and collaborative custody. Self-custody multisig means you hold every key. The setup uses Sparrow Wallet or similar coordinator software with three different hardware wallets, ideally from different vendors: Trezor, Ledger, and Coldcard, for example. Vendor diversity defends against a single-vendor compromise. Each key gets stored in a different physical location with its own backup.

Collaborative custody means a third party holds at least one key on your behalf. Casa offers a 2-of-3 or 3-of-5 service where Casa holds a recovery key. Unchained Capital offers similar service starting at $250 per year plus 0.50% per trade. The collaborator key cannot move funds alone, but its existence means you have a recovery option if you lose your other keys. The trade-off: the collaborator becomes a target for legal compulsion or social engineering, so you accept some custodial risk in exchange for recovery insurance.

Multisig adds operational friction. Every transaction requires coordinating two or more signatures across two or more devices in two or more locations. For day-to-day spending, multisig is overkill. For long-term storage of significant holdings, the friction is the feature. Document the recovery process and key locations. Without documentation, a 3-of-5 setup is a puzzle your heirs cannot solve.

Tax Compliance as Defense

The category of loss most people forget to defend against is not theft. It is an IRS examination triggered by a Form 1099-DA mismatch. The remedy can cost more than a hardware wallet drain because it includes back taxes, interest, and accuracy-related penalties.

Form 1099-DA is the broker reporting form for digital assets. As of January 1, 2025, US-based custodial brokers (Coinbase, Kraken, Gemini, and others) must report gross proceeds from digital asset sales to the IRS. Cost basis reporting becomes mandatory January 1, 2026. The IRS receives the same data you do, and the cross-match is automated. CP2000 letters, the automated under-reporting notices, started arriving in mid-2025 for the 2024 tax year. If your tax return shows a different number than what the broker reported, you receive a notice.

Revenue Procedure 2024-28, also effective January 1, 2025, made wallet-by-wallet cost basis tracking the default. Aggregating everything into a universal cost basis pool is no longer permitted. Each wallet, each exchange account, must track its own lot-level cost basis. The safe-harbor allocation deadline for assigning historical lots was December 31, 2024. If you missed it, your pre-2025 holdings default to first-in-first-out without specific identification.

Two reporting traps to know about

Crypto held on foreign exchanges (non-US-based platforms like Binance International, Bybit, or OKX) may trigger FBAR reporting on FinCEN Form 114 if your aggregate foreign account value exceeds $10,000 at any point in the year. FinCEN's specific rule for digital assets has been proposed but not finalized as of early 2026, so treat the threshold conservatively if you have material foreign-exchange exposure. The Form 8938 reporting requirement under FATCA applies separately and at higher thresholds.

Staking rewards, airdrops, and hard fork receipts are ordinary income at fair market value on the date of receipt, not on the date you sold. The cost basis going forward is that fair market value. Failing to record the receipt produces a future capital gains calculation that overstates gains and overpays tax, or understates them and triggers an audit risk.

One nuance worth knowing

The wash-sale rule that applies to securities does not currently apply to digital assets. As of 2026, multiple bills have proposed extending wash-sale to crypto, but none have been enacted. Loss harvesting at year-end is still a legitimate planning tool. Treat that as subject to change, because it is the most consistently proposed crypto tax change in Congress.

The DeFi broker reporting rules that Treasury published in late 2024 were withdrawn in early 2025 after industry pushback. Form 1099-DA applies only to centralized custodial brokers. DeFi protocol activity is still your responsibility to track and report. Nothing reaches the IRS automatically from on-chain activity.