Ways to Keep Your Bitcoin Safe as Crypto Hacks Surge
|
Key Takeaways
|
 |
| By Bob Czeschin Reviewed by: Beth Canova |
In 2025, attackers stole up to $2.9 billion across nearly 150 crypto hacks.
The single largest was the February 2025 breach of Bybit.
North Korea-linked hackers made off with roughly $1.5 billion — the largest crypto exchange hack on record at the time.
Fast forward to Oct. 29, 2026.
Hackers were able to gain access to a Binance software engineer's laptop. They then used it to clear what would otherwise have been unauthorized transactions.
No wallet private keys were directly stolen.
And yet the chink in Binance’s armor was enough to send a whopping $6.3 billion out the door in 20 minutes.
To its credit, Binance moved swiftly to halt deposits and withdrawals and revoke fraudulent authorizations. It also pledged — and followed through — to cover all customer losses from its Secure Asset Fund for Users (SAFU) and its own money.
The FBI later attributed the attack to the same North Korean outfit that pulled off the 2025 Bybit heist.
Many experts are making a big deal over the fact that no keys were stolen and no cryptography was broken.
And that nuance is important.
It helps investors understand how much volatility will bleed through the rest of the market. Which is exactly what my colleague Sandeep Kaur reviewed on Monday.
Nevertheless, it’s hard to have much confidence in the future of crypto security when worldwide hacking losses have just gone from $2.9 billion in 12 months…
To $6.3 billion in 20 minutes.
By comparison, the amounts thieves made off with in the CryptoBilis Ledger hack and the Coldcard Wallets exploit were a lot smaller.
But the attacks are far more alarming.
That’s because cold hardware wallets Hardware wallets store private keys offline, isolated from the internet, and require physical confirmation for all transactions.
As such, they are supposed to be the gold standard of crypto security against theft.
To be fair, neither attack was the result of a hacker breaking cryptography.
That is, no one was able to break the security on individual devices to steal their keys.
In the case of Ledger, the physical hardware was compromised before they reached users.
Ledger now confirms unauthorized implants in devices shipped by then-authorized third-party seller CryptoBilis. It copied the 24-word recovery phrase off the screen and sent it out over a mobile network.
No malware, no phishing needed. But the moment you set up the wallet, your keys were gone.
By contrast, the Coldcard wallet exploit stemmed from a botched firmware update took four years to come to light.
A bug dating to 2021 caused affected devices to default to a flawed software-based random-number generator. Instead of a correctly functioning hardware unit.
If seed phrases aren’t truly random, attackers can sometimes work backward from funded wallet addresses to guess their keys. And sweep ’em clean.
In neither incident did anybody actually break the encryption Bitcoin (BTC, “A-”) — and the whole crypto-currency revolution — relies on to securely operate.
But these attacks prove there’s more than one way to skin a cat.
What’s an Investor to Do?
First step to solving a problem is understanding it.
Which means you have to understand the dangers of crypto self-custody.
Related Story: 3 Crypto Hacks Reveal a Smarter Way to Store Your Bitcoin
Even with cold hardware wallets, risks of self-custody are real. And they can be severe.
Among them …
- Hardware wallet vulnerabilities (like Coldcard and CryptoBilis) can’t be defended against because users have no way to know about them before becoming victims.
- Lost or stolen seed phrases. If you lose your recovery phrase, the blockchain is unforgiving. Your money is gone. No customer service, no reset, no recovery.
- Physical security. One high-net-worth holder was recently robbed of a physical wallet containing significant crypto. This highlights how self-custody can result in physical-world risk.
- User error. These include phishing sites and malicious browser extensions. And scams that trick users into signing blind transactions.
This is actually how most self-custody wallets are compromised. However, they can usually be defended against by using proper procedures.
Best Practices for Hardware Wallets
1. Verify device authenticity by only purchasing directly from manufacturers. (Avoid third-party sellers to prevent supply-chain corruption.)
2. Ensure your firmware is up to date before every transaction.
3. Do a test transfer first with a small amount of money before transferring significant funds. This way, if you make a mistake, you limit the damage.
4. Protect your seed phrase relentlessly. Because it’s your only recovery method. Never store it digitally — no screenshots, no cloud storage, no password managers, no emails.
Write it on durable materials. Paper in a fireproof safe. Or metal backup plates that resist fire and water. Create multiple copies safekeeping in geographically separate locations
5. Enable strong 2FA everywhere
Two-factor authentication is essential for all exchange accounts, web wallets, and email accounts. Hardware security keys (YubiKey, Titan Key) are the strongest options. Followed by authenticator apps.
Avoid SMS-based 2FA, which is vulnerable to SIM-swap attacks
6. Never sign blind transactions. Never approve a smart- contract transaction without first verifying what it actually does. Phishing sites and malicious dApps try to trick users into authorizing unlimited spending approvals.
7. Clean and revoke permissions when not in use. Permissions allow dApps to connect to your wallet. That’s fine when you’re using the platform. But once you’re done and disconnect your wallet, you should revoke them.
Otherwise, a later attack on that platform could follow that permission straight to your wallet.
8. Diversify custody risk. Don't keep all your crypto in one place. Use multiple platforms, wallets, and custody methods. This way, if one is compromised or frozen, you still have access to some of your funds.
A lot of average investors may find this 8-point checklist a rather daunting collection of stuff to keep up with.
That’s why Weiss Crypto Portfolio Editor Juan Villverde now recommends most people diversify their crypto holdings.
Hardware wallets still have their place in your strategy. So do software wallets — browser extensions that stay connected to the internet and let you interact with DeFi applications with ease.
But they’re no longer your only reasonable options.
Juan suggests you may also want to include holding on centralized exchanges — like Coinbase and Kraken — or a spot ETF in your crypto strategy.
Between them, BlackRock and Coinbase hold hundreds of billions of dollars in crypto. And their entire business depends on custody going right.
This isn’t the advice I would have given in 2018. But it’s now 2026. Crypto is far more popular, and bad acters more formidable.
It’s just the latest sign of how much the crypto market has grown.
Gone are the Wild West days where storing money in your digital mattress was the safest option.
Now, the infrastructure of a mature market is coming together.
It’s time crypto users grew with it.
Best,
Bob Czeschin
P.S. The market may be maturing, but its tried-and-true cycles are still turning right on cue.
At least, that’s the latest according to Juan’s Crypto Timing Model.
It hasn’t missed a key reversal yet this year, accurately calling the Feb. 5 low, the May 9 peak, and the June double-bottom.
And its next call is one Juan will share in his crypto briefing this coming Tuesday, Nov. 10 at 2 p.m. Eastern.
It’s free to attend. Just be sure to save your seat.
