Security and Custody Basics for Active Traders

Trading risk is only one way to lose money in crypto. The other is operational: an exchange that fails, an account that is compromised, a wallet whose keys are lost. These losses are total and permanent, and they are avoidable with habits that take an hour to set up.

The account

Every exchange or broker account should have:

• A unique password that is not used anywhere else
• Two-factor authentication through an app or a hardware key, not through text messages, which can be intercepted
• Withdrawal address whitelisting, so that funds can only be sent to addresses you have approved in advance
• Email notifications for every login and withdrawal

These four steps stop the large majority of account thefts. Most compromises happen through reused passwords and text-message codes.

Where the coins sit

Coins on an exchange are a claim on the exchange, not coins you control. If the exchange fails, the claim may be worth little. For an active trader some balance must sit on the venue, but it should be the trading balance, not the savings. Anything held for longer than the current trade belongs in a wallet whose keys you control.

Hardware wallets keep keys offline and are the standard answer for holdings of any size. The recovery phrase that comes with the wallet is the wallet; whoever holds it holds the coins. It belongs on paper or metal in a safe place, never in a photo, a cloud note or an email.

Counterparty risk

Choose venues by their record of surviving stress, their transparency about reserves, and their regulation where it exists. Spread meaningful balances across more than one venue. Watch for warning signs: delayed withdrawals, changes to terms, unusual promotions to attract deposits. A venue that is slow to pay out is telling you something.

Everyday habits

Verify addresses character by character before sending, and send a small test amount first. Be suspicious of any message asking you to act quickly, whether it claims to be from support, from a strategist or from a friend. Bookmark the real login page and never follow a link to it.

Copy trading through a broker account keeps the coins in the custody of the broker, which removes wallet management but adds broker risk. The same questions apply: regulation, reserves, withdrawal record. The strategist never has access to the money, only to the mirrored orders.

What to watch

Watch withdrawal times at the venues you use, the security settings on each account, and where the recovery phrases are stored. Review all three every few months; most losses come from settings that were right once and never checked again.