The mindset that keeps you safe
Most crypto losses are not sophisticated hacks. They are ordinary mistakes and ordinary scams that exploit haste, greed, and the fact that crypto transactions are usually final. The protective mindset is simple: slow down, assume anything promising guaranteed or outsized returns is a scam, and never act under time pressure. Scammers manufacture urgency precisely because it stops you thinking. If something has to happen "right now," that is itself the warning sign.
Custody risk: not your keys, not your coins
When your crypto sits on an exchange, the exchange holds the keys — you are trusting it not to get hacked, go insolvent, or freeze your account. History is full of failures: the FTX collapse in 2022 wiped out billions in customer funds, and India's own WazirX suffered a major breach in 2024. Holding the bulk of your assets in a self-custody wallet, where you control the keys, removes this risk — but transfers it to you. Which brings the trade-off: with self-custody, if you lose your recovery phrase, no one can help you recover the funds. Choose deliberately, and for larger amounts lean toward self-custody with a hardware wallet.
Scams and social engineering
The most common ways people are robbed don't involve breaking any code. Phishing: fake websites and apps that look like the real exchange or wallet and capture your password or recovery phrase. Fake support: someone posing as customer service in your DMs — real support never asks for your recovery phrase or private keys, ever. Giveaway and impersonation scams: "send 1 ETH, get 2 back," often using hijacked celebrity accounts. Romance and investment ("pig butchering") scams: a stranger builds trust over weeks, then steers you to a fake trading platform. Wallet-drainer signatures: a malicious site asks you to "connect" or "approve" something that actually authorises it to empty your wallet. Read what you are signing.
Rug pulls and project risk
A "rug pull" is when the creators of a token build hype, attract money, then abandon the project and disappear with the funds — sometimes by draining the liquidity pool, sometimes by minting unlimited new tokens. Meme coins and brand-new tokens are especially prone to this. Warning signs include anonymous teams with no track record, promises of guaranteed returns, token ownership concentrated in a few wallets, no code audit, and aggressive pressure to buy before you "miss out." Sticking to established, audited projects removes most of this risk.
Smart-contract and technical risk
Even honest projects can fail technically. Smart contracts are code, and code has bugs; DeFi protocols and especially cross-chain bridges have lost enormous sums to exploits. An audit reduces this risk but does not eliminate it. Beyond the protocols, simple technical mistakes cause permanent losses: sending funds to the wrong address, using the wrong network for a transfer, or mistyping an amount. Crypto transactions generally cannot be undone, so verify the address, the network, and the amount before you confirm — every time.
A practical safety checklist
Use a hardware wallet for significant holdings. Write your recovery phrase on paper and store it offline — never as a photo, screenshot, cloud note, or text message. Enable app-based two-factor authentication (not SMS) on every exchange account. Bookmark official sites and never click links from emails or DMs. Verify contract addresses from official sources before interacting. Start with tiny test transactions when sending to a new address. Be deeply sceptical of unsolicited offers, guaranteed returns, and anything urgent. And keep records — both for your own safety and for India's tax requirements.
If you are in distress about a loss
Financial losses in crypto can be sudden and severe, and the finality of it can be genuinely distressing. If a loss is affecting your wellbeing, reach out to someone you trust or a professional for support — the money problem and the emotional weight of it are two different things, and the second one deserves real care.