The big security checklist for your bitcoin

Good Bitcoin security is mostly a matter of simple habits. This checklist arranges them into three levels: start with the basics and only go as far as suits your amount. You don’t have to do it all in one day – we’ll go through the points with you, one after the other. The security check shows where you stand.

Which level suits you?

Level	For whom?	Goal	Time needed
1 – Basic	everyone, including those whose bitcoin are with a provider	protect accounts and devices against the most common attacks	1–2 hours
2 – Advanced	your own hardware wallet	keys offline, robust backups, procedures practised	an afternoon
3 – Significant holdings	amounts whose loss would hit you hard	no single mistake, theft or death leads to total loss	several days, spread out

There’s no fixed amount – what matters is what a loss would mean for you.

Dive deeperGuidance in dollars: the Sparrow developers’ suggestion

The developers of Sparrow WalletProvider · Software walletSparrow WalletBitcoin desktop wallet with no purchase price and full transparency: coin control, PSBT, multisig and support for most hardware wallets.Non-custodial software – no financial licence required · reviewed Sept 2026Price: no purchase price (donations welcome); network fee when sending (as of Sept 2026)On the learning path: Stage 5 · Step 2 – Setting up your first wallet →Our profile →Official website ↗× give these rough guide values:^[1]

• up to about $10,000: a hardware walletTermHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →AdManufacturers with a paid linkProviders from our comparisonBitBox02Hardware wallet · SwitzerlandVisit BitBox* (paid link, opens in a new window)Trezor SafeHardware wallet · Czech RepublicVisit Trezor* (paid link, opens in a new window)Blockstream JadeHardware wallet · Canada/USAVisit Blockstream Jade* (paid link, opens in a new window)All 6 compared – including non-partners →Only buy hardware wallets from the manufacturer or an authorised reseller.*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →×, with the seed phrase backup ideally in a different place,
• up to about $100,000: your own node in addition,
• above that: multisig (at least 2-of-3) with devices from different manufacturers in separate places.

Level 1: the basics for everyone

These points apply even if your bitcoin are still held on an exchangeTermExchange (crypto exchange)A trading platform where buyers and sellers trade bitcoin with each other via an order book.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →AdLicensed providers with a paid linkProviders from our comparisonKrakenExchange · MiCA (Central Bank of Ireland)Visit Kraken* (paid link, opens in a new window)BitvavoExchange · MiCA (AFM, Netherlands)Visit Bitvavo* (paid link, opens in a new window)CoinbaseExchange · MiCA (CSSF, Luxembourg)Visit Coinbase* (paid link, opens in a new window)All 7 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.× or in an app.

Provider. In the EU, only buy from providers with MiCA authorisation. How to check this in the register is explained in Choosing the right provider.

Passwords. The BSI, Germany’s Federal Office for Information Security, recommends a separate password for each account – for example 20 to 25 characters made up of several words – and a password manager. Then you only need to remember its master password.^[2]

Second factor. The US Cybersecurity and Infrastructure Security Agency (CISA) advises against SMS codes: authenticator apps are better, but only FIDO methods such as security keys or passkeys also protect against phishing. Set up an app or key, then switch SMS off – otherwise it remains a weak back door.^[3] Where possible, add a backup factor so that a lost phone doesn’t lock you out.^[4]

Seed phrase. With your own wallet, you get a seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →×. Anyone who knows it can steal your bitcoin. If someone asks for it, that’s a warning sign of fraud.^[5] If you lose it and access to your wallet, your bitcoin are gone.^[6]

Scams. Many losses are caused by scams, not technology. Spotting & avoiding scams explains the schemes.

Level 2: your own hardware wallet

Now you hold your bitcoin yourself, usually on a hardware walletGlossaryHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally. The key never leaves the device, so malware on your computer can’t get at it.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →×. The guide is in Setting up a hardware wallet; Hardware wallets compared compares the devices.

Buying. Buy directly from the manufacturer or an authorised reseller. Order with a separate email address and to a parcel locker or pick-up point: in August 2026, it emerged that attackers had stolen the names, email addresses, phone numbers and delivery addresses of more than 11,000 customers from one of Trezor’s shipping providers; Trezor warned of targeted phishing.^[7] More in Protecting your data when you buy.

Firmware. Keep it up to date and subscribe to the manufacturer’s security notices, because no device is flawless. In July 2026, Coinkite reported that a firmware bug in COLDCARDProvider · Hardware walletCOLDCARDBitcoin-only signing device from Coinkite (Canada) with an air gap via microSD, NFC and QR – more for advanced users.Hardware manufacturer – no financial licence required · reviewed Sept 2026Price: Q $319, Mk5 $219 (promotional prices, as of Sept 2026)On the learning path: Stage 6 · Step 1 – Hardware wallets compared →Our profile →Official website ↗Only buy hardware wallets from the manufacturer or an authorised reseller.× devices had weakened seed generation; attackers recalculated keys and stole funds. An update didn’t repair existing seeds – those affected had to move to a new seed.^[8]

Backups. Paper burns and gets soggy; a metal backupGlossaryMetal backupA backup of your seed phrase on steel or titanium – punched, engraved or made with letter tiles. Unlike paper, it survives fire and water. Independent tests show that simple stainless steel plates are robust and often the cheapest.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× withstands far more. Jameson Lopp tests such backups for heat, corrosion and crushing, and advises: the simpler the design, the fewer the points of failure.^[9] Details: Backing up your seed phrase.

Practise. Test recovery before larger amounts are on the wallet – here’s how to do it without risk: Testing recovery.

Addresses. Malware on your computer or phone can swap a receiving address. The hardware wallet’s display shows the address independently – so compare every address there.^[10]

Away from the exchange. Leave only what you need for purchases there. How the withdrawal works and what a whitelistGlossaryWhitelist (address book)A list of withdrawal addresses that you have stored and confirmed with your provider in advance. When it’s active, withdrawals can only go to these addresses – effective protection if someone breaks into your account.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →× does for you is shown in Your first withdrawal to your own wallet.

If you don’t have a device yet, buy it directly from the manufacturer or from a retailer the manufacturer names.

Level 3: Significant holdings – no single mistake should cost everything

The goal: neither a lost backup nor a stolen device, a burglary or your death should lead to total loss.

Passphrase or multisig. A passphrase adds a further secret to the seed phrase. Every passphrase produces a valid wallet, but only the right one opens yours – if you forget it, access is lost.^[11] MultisigGlossaryMultisig (multi-signature)A wallet in which several keys jointly control the bitcoin – for example 2 of 3. If one key is lost or stolen, the bitcoin stays safe. In return, setting it up and backing it up is considerably more demanding.On the learning path: Stage 6 · Step 4 – Inheritance & emergency plan →In the glossary →× spreads control across several keys; for large amounts, Sparrow recommends at least 2-of-3 with devices from different manufacturers in separate places.^[1] Back up the wallet configuration too: without the extended public keysGlossaryxpub (extended public key)An extended public key from which all the addresses of a wallet account can be calculated. Nobody can spend bitcoin with it – but anyone who knows it can see your entire account history.In the glossary →× of all participants, even two of three seeds aren’t enough to recover the wallet.^[12] More in Multisig simply explained.

Your own node. Public servers see your wallet’s addresses, balances and IP address. Sparrow therefore recommends your own full nodeGlossaryFull nodeA node that checks every block and every transaction itself against all the consensus rules. If you run a full node, you don’t have to trust anyone to know whether a payment is valid.In the glossary →× or a private Electrum server as your holdings grow.^[1]

Discretion. Jameson Lopp collects publicly reported physical attacks on owners of bitcoin and other crypto assets (wrench attacksGlossaryWrench attack ($5 wrench attack)An attack using violence or threats instead of technology: criminals force Bitcoin owners to unlock their wallet or transfer bitcoin. The best protection is discretion – if nobody knows you own bitcoin, you are less likely to become a target.On the learning path: Stage 6 · Step 2 – Spotting scams →In the glossary →×); for 2025 he lists almost 90 cases (as of September 2026).^[13] The EU financial supervisory authorities warn that sharing a lot about yourself and your investments on social media makes you an easier target.^[5] More in Privacy with Bitcoin.

Inheritance and emergencies. Without a plan, your heirs can’t get at your bitcoin either. Inheritance & emergency plan shows what an emergency letter without the seed phrase looks like.

Once a year: your security review

Put it on a fixed day, such as your birthday. Also go through the list after major changes: a new phone, a house move, a new provider, a security warning from your manufacturer.

What’s next?