iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A market crash is a reason to slow down, not to make a hurried transfer. Price volatility attracts phishing messages, fake support agents and other attempts to exploit urgency. Protect the account used to reach an exchange, protect any self-custody recovery phrase, and verify every transaction before you approve it. An exchange and a self-custody wallet distribute risk differently, so the right safeguards depend on who controls the private keys.
Why a crash changes the security problem
A falling market does not make a transfer inherently safer. It can, however, create conditions in which people act quickly, click unsolicited links, reveal credentials or sign transactions they have not read. Your security plan should therefore separate two decisions: how to protect access and keys, and whether to buy, sell or move an asset. The first is a security task; the second is a financial decision.
Exchange custody and self-custody are different responsibilities
With an exchange or other custodian, the provider controls the operational wallet infrastructure and you access an account under its policies. You depend on that provider’s security controls, solvency, withdrawal rules and recovery procedures. Bitcoin.org explains this custodial trade-off in its guidance on who controls cryptocurrency funds.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →With self-custody, you control the private keys. That removes dependence on an exchange for day-to-day access, but it makes you responsible for the recovery phrase, device security, backups and every signing decision. If the phrase is lost or exposed, there may be no provider that can restore access.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Crash-specific threats to watch
- Messages claiming that your account is frozen, liquidated or eligible for emergency protection.
- Fake support agents asking for a password, one-time code, private key or recovery phrase.
- Look-alike websites that capture credentials or request a dangerous wallet signature.
- Impersonation of a wallet company, exchange, public figure or regulator.
- Pressure to move funds immediately to a “safe” address.
Treat unexpected urgency as a warning sign. The Federal Trade Commission’s phishing guidance recommends independently contacting an organization rather than using a link in an unexpected message.
1. Secure the exchange account perimeter first
Use a unique password
Create a long password that you do not use for email, banking, social media or any other service. Reused credentials let a breach at one site become an exchange-account takeover. Do not share the password with support personnel or store it in a message or note that other people can access.
Turn on the strongest MFA the service actually supports
Multi-factor authentication (MFA) makes it harder for a scammer to log in with a stolen username and password. The FTC describes this benefit in its consumer phishing advice. Sign in through the exchange’s known app or address, open its current security settings, and review both login MFA and withdrawal or transaction-confirmation controls. Labels and available factors differ by provider, so follow that service’s current instructions rather than an old menu path.
Recommended Free Tools
CISA’s Cross-Sector Cybersecurity Performance Goals, version 1.0.1 (2023), ranks hardware-based, phishing-resistant FIDO/WebAuthn authentication above app-based tokens or passkeys, with SMS or voice presented as fallback methods when stronger options are unavailable. In practice:
- Choose a hardware security key using FIDO/WebAuthn when the exchange supports it.
- If that is unavailable, use a passkey or an authenticator-app code according to the provider’s supported method.
- Use SMS or voice only when stronger factors are not available, and understand that a recovery flow may still offer a weaker alternative.
- Record the provider’s recovery requirements before you need them. A strong login factor cannot eliminate risk if an attacker can defeat account-recovery checks.
CISA’s Mobile Communications Best Practice Guidance provides additional context on protecting mobile communications. Neither CISA nor the FTC evaluates every exchange’s implementation, so confirm which factors, backup methods and withdrawal protections your own provider offers.
Protect the email account connected to the exchange
Email access can help an attacker reset an exchange password, approve a new device or intercept security notices. Give that mailbox its own unique password and the strongest MFA it supports. Review recovery addresses, phone numbers, active sessions and forwarding rules. Remove old devices and recovery methods you no longer control. Use the email provider’s official app or typed web address when making these changes.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Review account activity without reacting to price movement
During a crash, check recent logins, device sessions, API keys, withdrawal addresses and security notifications. If the provider offers withdrawal-address allowlists, time delays or transaction confirmations, understand how they work and enable them only after reading the current terms. Do not disable security controls to make trading faster. If an alert looks suspicious, reach the provider through a known channel rather than the alert’s link.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute2. Defeat phishing and fake support
Reach services independently
Type the exchange or wallet address yourself, use a bookmark you created earlier, or open the official app. Do not use a link from an unsolicited email, direct message, text, advertisement or chat reply. Check the domain carefully before entering a password or approving a connection; a convincing logo does not prove that the page is genuine.
Never disclose wallet secrets
A recovery phrase and private key authorize control of self-custodied funds. Bitcoin.org’s wallet FAQ says never to store a recovery phrase as a photo or in a cloud service and never to share it. Its scam guidance says legitimate support will not ask for a recovery phrase or private key, and no legitimate firm can guarantee recovery of stolen cryptocurrency.
Anyone who asks for a phrase, private key or “verification deposit” is asking for control of the funds, regardless of the claimed emergency. Do not paste a phrase into a website, form, chat or screen-sharing session.
Recognize pressure tactics
- “Move your coins now or they will be liquidated.”
- “Send a small amount to unlock withdrawals.”
- “Read your recovery words to verify ownership.”
- “Install remote-access software so support can fix the wallet.”
- “A guaranteed recovery service can reverse the transfer.”
Stop, close the conversation and contact the organization through a channel you located independently. A crash does not make these requests legitimate.
3. Keep self-custody backups private and recoverable
Understand what the recovery phrase does
The phrase is a backup for the wallet’s private keys, not a customer-service credential. Someone who obtains it may be able to restore the wallet elsewhere and control its assets. Someone who loses it may be unable to recover the wallet if the device is lost, damaged or reset. Bitcoin.org explains these responsibilities in Securing your wallet and its FAQ.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Store it offline
- Follow the wallet’s own setup and backup instructions.
- Write the phrase on a durable physical medium and check every word and its order.
- Keep it offline; do not photograph it, upload it to cloud storage, email it or place it in a password manager unless the wallet maker’s documented design explicitly requires a different process.
- Store copies in more than one secure physical location so a single theft, fire or flood does not destroy the only backup. Each location must remain private and access-controlled.
- Do not leave the phrase with the device or in an obvious drawer where a thief can take both.
Do not make extra copies casually. Every additional copy increases the number of places an attacker could find the phrase. Periodically confirm that the physical backup is readable without entering the words into an internet-connected device.
Separate routine spending from longer-term holdings
A small hot-wallet balance can be used for routine transactions while longer-term holdings remain in a device or arrangement intended for offline storage. Bitcoin.org’s FAQ describes this hot-wallet and cold-storage split as a way to balance convenience with protection. The split does not remove the need to verify addresses, protect the phrase or secure the devices used to sign.
4. Consider hardware wallets without treating them as magic shields
What a hardware wallet can and cannot do
Bitcoin.org describes hardware wallets as a balance between very high security and ease of use and recommends considering them for longer-term savings. They keep key material in a dedicated device and can reduce exposure to a computer’s ordinary operating system. They do not guarantee safety: a stolen or exposed recovery phrase, a deceptive transaction, compromised setup or user error can still result in loss.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Buy through a trustworthy channel
Use the manufacturer or an authorized reseller. Bitcoin.org’s scam guidance warns about counterfeit devices that may arrive with an attacker-known recovery phrase or modified firmware. During setup, generate the phrase yourself on the device and follow the manufacturer’s authenticity and firmware checks. Never accept a device that arrives already initialized with words supplied by the seller.
Do not assume universal compatibility
Wallet software, networks and assets have different support requirements. Confirm compatibility in the device maker’s current documentation before moving funds or signing a transaction. Buying a device does not establish that it supports every asset or network you use.
Distinguish a wallet security key from an account security key
A FIDO security key can harden an exchange login or the email account connected to it when those services support FIDO/WebAuthn. It is not the same thing as a hardware wallet and does not replace a self-custody recovery backup. Check each service’s current supported methods before purchasing or depending on a particular key.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
5. Slow down before every transfer or signature
Verify the complete receiving address
Crypto transfers can be irreversible. Compare the entire destination address with the intended address using a trusted source; do not rely only on the first and last characters shown in a shortened display. Confirm the network and asset as well as the address. A copied or substituted address can send funds to an attacker even when the transaction appears ordinary.
Free tools Windows power users keep installed
One-click scans. No signup required.
Read the transaction details on the wallet
Before signing, inspect the recipient, amount, network, fees and any permissions or contract actions the wallet displays. A deceptive website can request a signature that authorizes a transfer or another operation you did not intend. The site’s appearance is not evidence that the requested transaction is safe.
Be cautious with new connections
Do not connect a wallet to an unknown site because a message says the connection is required to protect funds during the crash. Close the page and verify the service independently. If you cannot explain what a signature authorizes, do not approve it.
Exchange custody versus self-custody during volatility
| Decision factor | Exchange or custodian | Self-custody wallet |
|---|---|---|
| Who controls the private keys | The provider controls the operational keys; you control an account subject to its policies. | You control the keys and signing process. |
| Primary recovery burden | Follow the provider’s account-recovery and identity procedures; availability and requirements vary. | Protect and preserve the recovery phrase and wallet backups yourself. |
| Main exposure | Provider security, solvency, account takeover, withdrawal rules and service availability. | Device security, phishing, malicious signatures, phrase theft, loss or damage. |
| Convenience | Account-based access and exchange features, subject to provider operation and policy. | Direct control, with more responsibility for setup, backups and transaction review. |
| Best fit in the cited guidance | Use only after reviewing the provider’s current MFA, recovery and withdrawal terms. | A hot wallet can serve routine spending; offline storage can suit longer-term savings. |
Neither arrangement is a universal winner. Choose based on which responsibilities you can perform reliably and on the actual service terms. Do not move funds solely because prices are falling.
A practical crash-time security checklist
Before volatility increases
- Confirm that the exchange password is unique and that the connected email account is separately secured.
- Enable the strongest supported MFA and save the provider’s documented recovery requirements in a safe place.
- Review active sessions, devices, API keys, withdrawal addresses and recovery contacts.
- Locate your self-custody recovery phrase without exposing it to a camera, cloud service or website.
- Check that any hardware wallet came from the manufacturer or an authorized reseller and that you generated its phrase yourself.
- Decide in advance which wallet holds routine spending funds and which holds longer-term savings.
During the crash
- Ignore unsolicited messages promising protection, recovery, liquidation avoidance or guaranteed returns.
- Open services through a known app, typed address or trusted bookmark.
- Pause before signing; verify the full address, network, amount, fee and requested permissions.
- Do not reveal passwords, one-time codes, private keys or recovery phrases to anyone.
- Separate a market decision from a security decision. A price move is not proof that a transfer is necessary.
After a suspicious event
- Stop interacting with the suspicious message or website and preserve the relevant details for your own records.
- Reach the exchange, wallet maker or email provider through an independently found official channel.
- Use the service’s documented process to secure the account, review sessions and address any compromised credentials.
- If a recovery phrase may have been exposed, treat the wallet as compromised and obtain advice from the wallet maker or a qualified security professional before taking further action. Do not enter the phrase into a “recovery” website.
- Assume a mistaken or unauthorized blockchain transfer may not be reversible. The FTC’s cryptocurrency scam guidance warns that losses involving a failed exchange, mistaken transfer or compromised wallet may not be recoverable.
What crypto protections do not promise
The FTC notes that cryptocurrency accounts are not backed by the U.S. government in the way FDIC-insured bank deposits are. That is U.S. consumer guidance, not a statement of every country’s law or every provider’s contract. Read the actual terms for your jurisdiction and service.
MFA reduces the chance that a stolen password alone is enough to log in, but it cannot prevent every attack, especially when a recovery path is weaker or a user approves a malicious transaction. A hardware wallet can improve key isolation, but it cannot protect a phrase that has been photographed, copied to the cloud or disclosed to a scammer. No legitimate service can promise recovery of every lost, mistakenly sent or stolen asset.
Quick Recap
Sources and further reading
- Bitcoin.org: Securing your wallet
- Bitcoin.org: Avoid Scams
- Bitcoin.org: Some things you need to know
- Bitcoin.org: FAQ
- Federal Trade Commission: How To Recognize and Avoid Phishing Scams
- Federal Trade Commission: What To Know About Cryptocurrency and Scams
- CISA: Cross-Sector Cybersecurity Performance Goals, version 1.0.1 (2023)
- CISA: Mobile Communications Best Practice Guidance
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
