During a crypto market crash, secure access before making trading or transfer decisions. Use a unique exchange password, protect the email account tied to it, enable the strongest multi-factor authentication (MFA) the service supports, and treat urgent messages as possible phishing. If you self-custody, protect and back up your recovery phrase offline. Do not assume that moving coins in a panic is safer: a rushed transfer can be sent to the wrong address or approved through a malicious prompt.
The right controls depend on where your keys are held. An exchange or other custodian protects the keys while you depend on its security, solvency and policies. A self-custody wallet gives you control, but you carry the full responsibility for the private keys, recovery phrase, devices and transaction approvals.
As an Amazon Associate I earn from qualifying purchases.
Why a crash changes the security problem
Price volatility creates the conditions that attackers exploit: people are watching markets constantly, reacting to alarming headlines and responding quickly to messages that appear to come from an exchange, wallet company or support desk. A message saying your account is frozen, a withdrawal is pending or a recovery check is required may be designed to make you click before you verify it.
Volatility itself does not make a wallet or exchange account technically less secure. The danger is that urgency leads you to reveal a password or recovery phrase, approve an unfamiliar transaction, install counterfeit hardware or send funds without checking the destination. A calm security process is more valuable than a hurried move between custody arrangements.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
The Federal Trade Commission (FTC) says cryptocurrency accounts are not backed by a government protection such as FDIC insurance on bank deposits. Losses from a failed exchange, a mistaken transfer or a compromised wallet may not be recoverable; the FTC’s guidance is U.S. consumer information and does not determine the law or contract terms in every country or with every provider (FTC guidance on cryptocurrency and scams).
Know which custody model you are protecting
| Question | Exchange or custodian | Self-custody wallet |
|---|---|---|
| Who controls the private keys? | The provider controls them on your behalf; you control an account under its policies. | You control the keys and authorize transactions yourself. |
| What is the main access risk? | Account takeover, phishing, weak recovery procedures, provider security failures or insolvency. | Loss or theft of the recovery phrase, device compromise, counterfeit hardware and deceptive transaction signing. |
| Who handles recovery? | The provider’s account-recovery process, subject to its identity checks and rules. | You must maintain a usable, private backup; losing it can make funds permanently inaccessible. |
| What is convenient? | Web or mobile access and provider-managed operations, subject to outages, holds and withdrawal policies. | Direct control and independent signing, with more responsibility for devices, backups and addresses. |
| What must you verify? | Supported MFA, recovery methods, withdrawal rules and the provider’s current security procedures. | Wallet backup instructions, device authenticity, supported assets and every transaction prompt. |
Bitcoin.org explains this division of responsibility in “Some things you need to know”. Neither model is a universal winner: choose controls that match how often you transact, how much operational responsibility you can manage and what the actual service supports.
Secure the exchange account perimeter first
- Stop following unsolicited instructions. If a message says you must act immediately because of the crash, close it. Open the exchange’s known app or type its established web address yourself. Do not use a link, phone number or attachment supplied in an unexpected email, text or direct message.
- Use a unique password. Do not reuse the exchange password on email, social media or another financial account. A password exposed in a different breach can otherwise become the first step in an account takeover.
- Protect the email account used for login and recovery. Someone who controls that mailbox may be able to receive reset messages or impersonate you. Give the email account its own unique password and the strongest MFA available, and review the provider’s recovery options so you understand what would happen if access is challenged.
- Enable the strongest MFA the exchange actually offers. Turn it on in the account’s security settings, then complete a test login only through the known app or site. Never approve an MFA prompt you did not initiate.
- Read the provider’s recovery and withdrawal rules before you need them. Exchanges differ in their supported factors, waiting periods, identity checks, withdrawal holds and contact procedures. Do not assume a control exists merely because another service offers it.
MFA does not make every attack impossible, but it adds a barrier when a password is stolen. The FTC says, “Multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password” (FTC phishing guidance).
Recommended Free Tools
Choose phishing-resistant MFA when it is available
Authentication methods differ in how easily a fake site can capture or relay them. CISA’s Cross-Sector Cybersecurity Performance Goals, version 1.0.1 (2023), places hardware-based, phishing-resistant FIDO/WebAuthn authentication above app-based tokens or passkeys in its listed hierarchy. Its guidance also treats SMS or voice as fallback options when stronger methods are unavailable (CISA Cross-Sector Cybersecurity Performance Goals PDF).
In practice, use the strongest option your exchange and email provider support:
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
- Hardware-based FIDO/WebAuthn security key: a physical key that authenticates to a compatible service and is designed to resist phishing. Keep a backup key in a separate secure place if the service allows more than one.
- Passkey or authenticator application: useful alternatives when a hardware key is not supported. Follow the service’s enrollment and recovery instructions exactly.
- SMS or voice codes: use them only when stronger methods are unavailable, consistent with CISA’s fallback ranking. They are not a reason to disclose a code to a caller or chat representative.
CISA’s Mobile Communications Best Practice Guidance (December 2024) provides additional context on protecting mobile communications. The existence of an MFA option does not prove that an exchange’s implementation or recovery flow is equally strong, so inspect the service’s current documentation.
Recognize and stop crash-themed phishing
Scammers can copy an exchange’s logo, use a convincing domain look-alike or claim to be a wallet developer, public figure or support agent. The request may ask for your password, an MFA code, a recovery phrase, a private key or a “verification” transaction.
- Reach the service through an app you already installed or an address you type yourself.
- Check the domain carefully before entering credentials; a familiar design does not make a site genuine.
- Do not call a number supplied by an unsolicited message. Find contact details through the service’s known app or official site.
- Never provide a recovery phrase or private key to support. Bitcoin.org states that legitimate support representatives will not ask for these secrets.
- Reject claims that a company can guarantee recovery of coins lost to a scam. Bitcoin.org’s scam guidance warns that no legitimate firm offers guaranteed crypto recovery (Bitcoin.org, “Avoid Scams”).
If you already entered a password into a suspicious page, stop using that page, change the affected password through the genuine service and secure the associated email account. If you exposed a recovery phrase, treat the wallet as compromised rather than waiting for a message that promises help; the phrase grants control to whoever has it.
Protect a self-custody wallet and its recovery phrase
A recovery phrase is a backup for the wallet’s keys, not a customer-service credential. Anyone who obtains it may be able to control the assets, while losing it can leave you unable to restore access. Follow the wallet’s own backup instructions and keep the phrase private.
Store the backup offline
Write the phrase on the wallet’s supplied material or another durable offline medium and keep it in a secure physical location. Bitcoin.org specifically warns: “Never store your recovery phrase as a photo or in a cloud service, and never share it with anyone” (Bitcoin.org FAQ). A photograph can synchronize to multiple devices or accounts without you noticing; cloud storage also creates another account that an attacker could target.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Plan for one incident without creating another
Consider more than one secure physical location so a single theft, fire or flood does not destroy the only backup. Do not make extra copies casually or leave them where visitors, contractors or a compromised camera can see them. Your goal is redundancy for physical failure without increasing the number of people or systems that can obtain the phrase.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Separate routine spending from long-term savings
Bitcoin.org’s FAQ describes a common arrangement: a hot wallet for everyday spending and hardware-based cold storage for longer-term savings. Keeping only a working balance in a wallet that connects regularly can limit the amount exposed to a deceptive site or mistaken approval, while the longer-term wallet remains offline when not needed. This separation is an operational choice, not a guarantee against theft or user error.
Use hardware wallets carefully
Bitcoin.org describes hardware wallets as “the best balance between very high security and ease of use” and recommends considering them for longer-term savings (Bitcoin.org, “Securing your wallet”). They keep key operations on a dedicated device, but they do not eliminate every risk: a user can reveal the recovery phrase, approve a malicious transaction, lose the device or buy a counterfeit product.
Buy and initialize the device safely
- Obtain the device from its manufacturer or an authorized reseller, not an unknown marketplace listing.
- Inspect packaging and follow the manufacturer’s authenticity and firmware instructions.
- Generate the recovery phrase yourself during initial setup. Do not use a phrase supplied on a card, in an email or by a seller.
- Write the phrase offline and verify the device’s backup check before depositing significant funds.
- Confirm that the device supports the asset and network you intend to use; compatibility differs by wallet, network and asset.
Bitcoin.org warns that counterfeit devices can arrive with an attacker-known recovery phrase or modified firmware (Bitcoin.org, “Avoid Scams”). A genuine device still depends on correct setup and careful signing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Slow down every transfer and signature
Crypto transfers can be irreversible. During a crash, treat every address and transaction prompt as if the market were calm:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- Start from a trusted destination. Use an address copied from the intended wallet or recipient, not one supplied by an unsolicited message.
- Verify the entire receiving address. Do not check only the first and last characters; compare the full address using a trusted display or an established address book.
- Confirm the network and asset. A correct-looking address on the wrong network can still produce a failed or unrecoverable transfer.
- Read the wallet’s transaction details before signing. Check the amount, recipient, network fee and any permission or contract action shown by the wallet.
- Reject unfamiliar approvals. A website’s appearance says nothing about what its requested signature authorizes. Disconnect from unknown sites and investigate before approving.
- Send a test amount only when you understand the network and the recipient’s process. A small test does not make an unknown destination trustworthy, but it can expose an address or network mismatch before a larger transfer.
Bitcoin.org’s scam guidance recommends checking transaction details and warns that a deceptive website can prompt a wallet signature that authorizes transfers (Bitcoin.org, “Avoid Scams”).
Exchange custody versus self-custody: a decision checklist
Ask these questions before changing where funds are held:
- Can you reliably maintain an offline recovery backup and keep it private?
- Does the exchange provide the MFA method and withdrawal controls you understand and can use?
- Will you need frequent access for routine spending, or is the balance intended for longer-term holding?
- Have you read the provider’s current custody, withdrawal, recovery and outage terms for your country?
- Can you verify every address and signing prompt without being rushed by a market headline?
There is no security rule that says a crash requires a transfer from an exchange to a personal wallet, or the reverse. Moving funds changes which risks you carry; it does not remove risk. Make the decision from your custody plan and the provider’s documented terms, not from an unsolicited warning.
A calm response plan for a crash
When the market is falling but you have no security alert
- Stop clicking market-related messages and open services only through known channels.
- Confirm that your email and exchange passwords are unique.
- Check that your strongest available MFA is enabled and that you know the recovery method.
- Verify that self-custody recovery information is offline, private and physically recoverable.
- Postpone nonessential transfers until you can review the full address and transaction details without pressure.
When you receive a suspicious support message
- Do not reply, click, call or disclose a code, password, private key or recovery phrase.
- Navigate independently to the service and check for alerts inside the authenticated account.
- Use only contact details found through that known channel.
- If credentials were disclosed, change them through the genuine service and secure the associated email account.
When a wallet prompt looks unfamiliar
- Reject the signature or transaction.
- Disconnect from the site and record what the prompt displayed.
- Reopen the wallet through its normal application and review recent activity.
- Do not enter the recovery phrase into a website to “unlock” or “synchronize” the wallet.
What cannot be promised
No MFA method, hardware wallet or custody arrangement guarantees recovery. A provider may have outages, holds or rules you cannot change; a self-custody user may lose a phrase or sign an irreversible transaction. The FTC’s warning about limited recovery and the absence of government backing for crypto accounts means you should treat prevention, verification and private backups as primary controls, not assume a later claim or support ticket will restore funds (FTC consumer guidance).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For U.S. readers, that FTC statement is consumer guidance rather than a universal description of every jurisdiction’s insurance, regulation or contract. Check the actual provider’s terms and the rules that apply where you live.
Sources and current guidance
- Bitcoin.org: Securing your wallet
- Federal Trade Commission: How To Recognize and Avoid Phishing Scams
- Bitcoin.org: Avoid Scams
- Bitcoin.org: Some things you need to know
- Federal Trade Commission: What To Know About Cryptocurrency and Scams
- Bitcoin.org FAQ
- CISA Cross-Sector Cybersecurity Performance Goals, version 1.0.1 (2023)
- CISA Mobile Communications Best Practice Guidance (December 2024)
The practical rule is simple: secure the email and exchange account, use phishing-resistant MFA when supported, keep self-custody backups offline and private, and verify every transfer or signature. A crash is a reason to slow down—not a reason to trust an urgent message or make an unplanned move.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
