Personal Security Checklist & Reporting
Build a practical operational-security framework, learn the proper reporting channels (IC3, FTC, SEC, ChainAbuse), and understand realistic recovery options.
15 min · beginner · part of Crypto Scams & How to Stay Safe
What you'll learn
- Operational Security: Hardware, Seed Phrases, and Authentication
- Evaluating a New Project Before You Invest
- Detection Tools You Should Have Installed
- How to Report a Crypto Scam
- Recovery Realities
- Ongoing Vigilance: The Habit Stack
Key terms
- Hardware wallet
- A device (such as Ledger or Trezor) that signs transactions internally and never exposes the private key to the connected computer. The single highest-leverage security purchase for anyone holding meaningful crypto.
- Seed phrase
- A 12 or 24 word recovery phrase that controls a wallet. Must be written on paper or metal and never typed into a computer, photographed, or stored in cloud notes. No legitimate service ever asks for it.
- SIM-swapping
- An attack where the attacker convinces your mobile carrier to port your phone number to their device, capturing SMS-based 2FA codes. Use authenticator apps or YubiKeys instead.
- Hot vs cold wallet
- A separation strategy where daily-use funds live in a "hot" wallet exposed to dApp interactions and long-term savings live in a "cold" hardware-secured wallet that rarely transacts.
- Revoke.cash
- A free web tool at revoke.cash that lets you audit and revoke smart contract permissions to spend your tokens. Run monthly to close doors that future drainers might walk through.
- ScamSniffer
- A browser extension maintaining a real-time blocklist of known phishing domains and drainer signature patterns. One of the most effective single defenses against drainer attacks.
- ChainAbuse
- A community scam-reporting platform at chainabuse.com jointly operated by TRM Labs and Binance. Lets you search wallet addresses for prior reports and submit your own.
- IC3 reporting (ic3.gov)
- The FBI Internet Crime Complaint Center, the central federal portal for reporting crypto fraud. File within 24 hours with all transaction hashes, communications, and account details.
- Recovery scam
- A second scam targeting previous fraud victims with promises to recover stolen funds for an upfront fee. Legitimate U.S. law enforcement never charges fees. Refuse all unsolicited recovery offers.
- YubiKey / FIDO2 hardware key
- A physical security key that provides phishing-resistant two-factor authentication, an order of magnitude harder to defeat than authenticator apps and dramatically harder than SMS codes.
Read the full lesson in the CryptoBipto app.
Open lessonEducational only — not financial advice.