Common Crypto Security Mistakes and How to Check for Them

Most lost crypto wasn’t lost to a genius hacker. It was lost to a sheet of paper that got wet, a password nobody remembered, or a link someone clicked in a hurry. Below are twelve mistakes we see most often, each with a test for checking it yourself. A test never requires showing your seed to anyone.

The wider picture is in the pillar how to secure crypto. A printable version is the 10-step checklist.

1. A single seed backup

A seed written once, in one place. Water, fire, a burglary or an ordinary clear-out ends the story. It’s both the most common mistake and the cheapest to fix.

How to check: count the places where a backup lies and the buildings they’re in. Ask whether at least one copy would survive a fire in your flat, and whether you know how to reach it when you’re not at home. If the answer is “one place”, make a second copy and keep it in another building. The rules are in the guide how to store your seed phrase.

2. Seed on a phone, in the cloud or in an email

A photo, a note, a file, a message to yourself. Each of these lands on an internet-connected device and usually in a cloud backup. Trezor advises never keeping a seed backup digitally, because such copies can be made without the owner’s knowledge.

How to check: search your phone gallery, notes, email and password manager for words from the seed (one or two, not all of them). Check file names on your computer too. If you find anything, delete it everywhere, including the bin and the cloud. Also check whether your phone makes automatic backups of photos and notes: a photo deleted from the gallery may already have reached the cloud. If the file was in the cloud or in your mail, assume it may have leaked and consider a new wallet with a new seed.

3. No recovery test

A backup that has never been used may have a typo, a missing word or a swapped order. You find out when it’s too late.

How to check: restore the wallet from the backup on a device after a reset, or on a second device, and compare the first address with the original. If you’ve never done this, it’s the number one mistake to fix this week. The steps are in the guide on storing a seed phrase.

4. A passphrase only the owner knows

A passphrase is an extra password for the wallet. Under BIP39 every password creates a valid but different wallet, so the seed words with a wrong passphrase open an empty wallet and nothing warns you about the mistake. If the passphrase exists only in your head, then after your death the funds can’t be recovered.

How to check: answer the question of where the passphrase is written down and whether the person who is meant to help you knows it exists. Also check that you’d type it exactly, including capital letters and spaces. More in the guide passphrase and the 25th word.

5. Seed and passphrase in one place

The passphrase was meant to protect you if someone finds the sheet with the words. If it lies on the same sheet or in the same envelope, it protects nothing.

How to check: see whether the seed backup and the passphrase record lie in separate places, and whether someone who finds one won’t find the other.

6. Everything on an exchange

An exchange account is a balance in somebody else’s database, not your own keys. The exchange can freeze the account, demand verification you can’t pass, or stop operating. After the owner’s death the family has to go through the exchange’s procedure, if they even know the account exists. The details are in the pillar exchange vs self-custody.

How to check: list the exchanges and accounts where you hold funds, and the amount on each. Ask yourself how much of it you could lose without harm to your plans. Consider moving the rest to your own wallet.

7. A device with a ready-made seed or from an unreliable source

A hardware wallet with a card in the box saying “seed to write down”, bought second-hand or from an unknown seller, is a classic trap. Whoever knows the seed empties the wallet after you deposit.

How to check: check who you bought the device from, whether you bought it from the manufacturer or an authorised shop, and whether the packaging was sealed. Make sure your own hardware generated the seed at first start-up, and that you didn’t type it in from a card supplied by the seller. If you have doubts, move the funds to a new wallet with a new device from the manufacturer.

8. Typing the seed “to check it” or “for support”

Fake sites, fake apps and “support agents” ask for the seed under the pretext of verification, synchronisation or repair. It’s always a scam. Trezor states that it never asks for the recovery seed, PIN or passphrase.

How to check: recall whether you’ve ever typed your words into a site or an app that isn’t the manufacturer’s software, downloaded from its official site. If you have, treat the seed as compromised and move the funds to a new wallet.

9. A wrong backup in multisig: seeds without the configuration

This mistake applies to 2-of-3 wallets. Nunchuk’s documentation lists, for recovering a wallet, as many seeds as the signing threshold plus the wallet configuration file. From two seeds you can’t work out the third participant’s public key, and without it the wallet won’t show the right addresses.

How to check: check that you have the configuration file (in Nunchuk in the BSMS format) and that it lies in at least two places. The details are in the guide 2-of-3 multisig wallet.

10. Nobody in the family knows

The best security that nobody knows about equals a loss if the owner dies. The funds are on the network, but nobody will find or move them.

How to check: ask yourself which of your loved ones knows you have crypto, where the backup is and what to do. Ask also whether that person could cope without your help, because “knows I have something” isn’t enough. If the answer is “nobody” or “someone knows I have something”, write a short set of instructions. What it should contain is described in the guide family access instructions: what to include. Legal matters are for a notary or lawyer.

11. A forgotten device and software

A hardware wallet sometimes needs a software update, and the apps that work with it change from year to year. A device that has sat in a drawer for five years may not work with the current program, and your family won’t know which version to look for.

How to check: check when you last switched on the device and ran the program. Write the device model, the program name and the version in the family instructions. Run a recovery test once a year. In our care service we do this together with you.

12. Rushing the first deposit

People buy a wallet, generate a seed, write it down in a hurry and deposit everything at once. If the record has a mistake or the device turns out to be faulty, they learn about it when trying to withdraw, months later.

How to check: recall whether, when you set up the wallet, you first deposited a small amount, and whether you restored the wallet from the backup before depositing the main sum. If not, do it now, with the current amount, while the funds don’t need to be moved in a hurry. Then send a small test transaction from the wallet to an address you control and check that it arrived.

Mistake, symptom, what to do today

The table collects the same in short. The symptom is the signal that the mistake applies to you, and the last column is the first step you can take today.

Mistake	Symptom	What to do today
A single seed backup	The answer to “where are the copies” is “one place”	Make a second copy and keep it in another building
Seed on a phone, in the cloud, in an email	The words turn up in the gallery, notes or mail	Delete everywhere, consider a new wallet with a new seed
No recovery test	You’ve never restored the wallet from the backup	Restore the wallet from the backup on a reset device
A passphrase only the owner knows	It isn’t written down anywhere but in your head	Write it down and keep it apart from the seed
Seed and passphrase together	Both lie in one envelope	Separate them into two places
Everything on an exchange	The exchange balance exceeds what you can afford to lose	Move the excess to your own wallet
A device from an unreliable source	The box was open or contained a ready-made seed	Move the funds to a new wallet on a new device
Seed typed on a foreign site	You remember typing the words outside the manufacturer’s software	Treat the seed as compromised and move the funds
Multisig without a configuration file	You have the seeds but not the descriptor	Export the configuration, print it and keep it with the key backups
The family doesn’t know	Nobody but you knows where the backup is	Write short instructions without the seed
A forgotten device	You can’t remember when you last switched it on	Switch it on, update it and note the model and program version
Rushing the first deposit	You deposited everything without a test	Send a test transaction and restore the wallet from the backup

Why these mistakes keep happening

They all come from one thing: a seed looks like a sheet of paper, not like the key to your wealth. People treat it the way they treat a spare flat key and put it in the first convenient drawer. Convenience adds to it. A photo on a phone is easier than stamping letters into steel, and a password in your head is easier than a record in a second place.

None of these mistakes shows carelessness. All can be fixed without specialist knowledge, if someone points out where to start. That’s why a list with one test per item works better than the general advice “secure your seed”.

What to do when you find a mistake

Finding a mistake means the test worked. What counts next is the order of actions.

If the seed may have leaked, meaning it was in a photo, an email or on a foreign site, fixing the backup isn’t enough. The old seed still opens the old wallet. Create a new wallet with a new seed on your own device, make its backup, and only then move the funds. Don’t leave it for later, because every day with a leaked seed is an opportunity for anyone who saw it.

If the seed didn’t leak and the backup is simply single or untested, you don’t need to move anything. Make a second copy and a restore test. That’s usually an hour’s work.

If the problem concerns your family, meaning nobody knows what you have, a short note with the backup’s location and the program name is enough. You don’t put the seed in it.

If you’re not sure whether a given mistake applies to your setup, don’t act blindly. The worst thing you can do is move funds in a hurry and get the address wrong.

How to work through this list

Don’t try to fix everything in one evening. Start with the mistakes that have the biggest effect and the smallest cost:

1. A second seed backup in another place (mistake 1).
2. Removing digital traces of the seed (mistake 2).
3. A recovery test (mistake 3).
4. One sentence for one close person (mistake 10).

The rest depends on your setup. If you don’t know which points apply to you, the quickest way to find out is a check-up: an hour’s online conversation from €50, after which you get a list of risks, most urgent first. We never see your seed or keys.