Holding crypto assets (also known as virtual currencies) isn't just about weathering price swings. You also need to watch for risks that can lock you out of your own holdings entirely — unauthorized account access, phishing scams, transfer mistakes, and losing your recovery phrase.
Crypto assets run on blockchain, a distributed ledger technology in which transaction records are shared and maintained across many computers at once. Even though the blockchain itself is highly resistant to tampering, your assets can still be lost if you manage your account or wallet carelessly.
Unlike a bank or brokerage account, crypto asset security depends directly on how well you safeguard your private key and recovery phrase. Transfers, in particular, are essentially irreversible once sent, which makes checking every detail beforehand essential.
This article walks through the security risks to watch for with crypto assets and the basic precautions to take when using an exchange (an order-book marketplace where users trade with each other), managing a wallet, or sending a transfer.
Crypto asset security starts with day-to-day management, not just technology
Crypto asset security isn't only about the technical soundness of the assets themselves. Alongside how well an exchange manages its systems, it also matters whether you, as the user, are properly managing your account, wallet, private key, recovery phrase, and transfer operations — in other words, whether you are actively reducing the risk of losing your assets.
The reason this matters is that most crypto assets are held and transferred over the internet, moving only through actions the user takes. If your login credentials are stolen, your exchange account can be accessed without authorization. If a third party learns your recovery phrase, the assets in your wallet can be moved without your consent. And if you enter the wrong destination address, unlike a bank transfer, there's often no way to reverse or reclaim the funds.
So crypto asset security isn't just a question of which coin to buy — it also comes down to where you store your assets, how you protect your login credentials, and what you check before sending a transfer. Just as managing your brokerage account matters for stocks and mutual funds, managing where you store your crypto assets and how you protect your access credentials is the foundation of keeping them safe.
The Financial Services Agency (FSA), Japan's financial regulator, has also published a draft policy on strengthening cybersecurity at crypto asset exchange service providers. While aimed at businesses rather than individual users, it underscores that crypto asset security is a priority not just for users but for operators and regulators alike.
Common security risks in crypto assets
Common security risks associated with crypto assets include the following:
- Unauthorized login access
- Phishing scams
- Loss or leakage of a private key or recovery phrase
- Transfer mistakes
- Wallet app malfunctions
These risks tend to arise not from a flaw in the underlying crypto asset system itself, but from targeting how users manage and operate their accounts and wallets. Understanding these risks is essential before handling crypto assets.
Information theft through phishing scams and fake websites
Phishing is a scam technique in which criminals impersonate a real company or financial institution to lure victims to a fake website and steal their login credentials or personal information. According to Japan's National Police Agency, there have been confirmed cases of emails and SMS messages impersonating online bank accounts, mobile carriers, delivery companies, and financial institutions, directing victims to convincing fake websites (reference: Phishing Countermeasures | National Police Agency — in Japanese).
Phishing scams targeting crypto assets often arrive disguised as important notices from an exchange — for example, a login restriction, a request to redo identity verification, or a notice that a withdrawal freeze has been lifted. A key characteristic is that they create a sense of urgency, pushing the user to act "immediately" and click a link in the email or SMS that leads to a fake website.
One reported case targeted users of the MetaMask crypto wallet with a phishing scam disguised as a two-factor authentication setup prompt, directing victims to a fake site (reference: SlowMist CSO Warns of New Phishing Scam Targeting MetaMask Users — in Japanese).
Be especially cautious during periods of sharp price movement, or when logging into an exchange or wallet after a long absence. The urge to quickly check your balance can make you less careful about verifying URLs and senders. Even if a site looks identical to the official one, a URL that differs even slightly can indicate a fake site — always check closely.
Also be wary of anyone claiming to be from an exchange or support team who asks you to enter your password, two-factor authentication code, recovery phrase, or private key. Providing this information can lead to your account being accessed, or the crypto assets in your wallet being moved, without you realizing it.
Loss or leakage of a private key or recovery phrase
If you use a self-custody wallet, managing your private key and recovery phrase is critical. A recovery phrase is a sequence of words used to restore a wallet. A private key is the piece of information that grants the authority to move crypto assets (related: What's the Difference Between a Recovery Phrase and a Private Key? (in Japanese)).
There have been real cases of crypto assets being stolen through fake apps that trick users into entering their recovery phrase. According to reports, a fake app impersonating the Ledger crypto wallet was distributed through Apple's App Store, resulting in the theft of roughly $9.5 million worth of crypto assets.
In this scheme, users were tricked into downloading a fake app disguised as the legitimate Ledger Live app and entering their wallet's recovery phrase (seed phrase). Once a user entered it, the attacker gained full access to the wallet and could move the assets freely.
This case is a reminder that an app being listed on an official app store doesn't automatically make it safe. Even when using a legitimate wallet, it's important to confirm that the download source matches what the official website recommends.
Losing your recovery phrase or private key can lock you out of your wallet permanently. Conversely, if a third party obtains it, your assets can be moved without your consent. Treat this information as more sensitive than a bank account PIN — never store it online, and never enter it into a screen where a third party is asking you to.
Errors in the destination address or network when sending a transfer
Unlike a bank transfer, where the financial institution verifies the recipient's name, crypto asset transfers offer no such check. An incorrect destination address, network, or tag/memo can mean the transferred crypto assets are unrecoverable (related: Can a Crypto Transfer Mistake Be Undone? What to Check and How to Respond (in Japanese)).
One common mistake is checking only the destination address and assuming that's enough. Even for the same coin, the network used can differ. For example, some exchanges and wallets let you choose from multiple networks for the same crypto asset when depositing or withdrawing. If the network you select at the sending end doesn't match the one supported at the receiving end, the transfer may not be reflected.
When sending funds to an exchange, some coins also require a tag or memo, which the exchange uses to identify the depositor. If you forget to include it, the transfer itself may complete, but the exchange may be unable to automatically match it to your account, so it won't show up in your balance.
Before sending, check the address, network, tag or memo, and amount one item at a time. For a first-time destination or a large transfer, consider sending a small test amount first. It costs a small fee, but it lets you confirm the destination and network are correct before committing the full amount, reducing the risk of a misdirected transfer.
Losing access when a wallet app shuts down or malfunctions
A wallet app being discontinued or malfunctioning can also leave you unable to access your assets. In this case, if you still have your recovery phrase or private key, you may be able to restore access using a different compatible wallet.
That said, using the wrong compatible wallet or an incorrect recovery process can leave you stuck. Being unable to log into an app is not necessarily the same as having actually lost your crypto assets, so the first step is always to confirm whether your recovery phrase or private key is still available.
Security checks to make when using an exchange
When storing or trading crypto assets on an exchange, you need to check both the exchange's own security practices and your own account management. Even a well-secured exchange can't fully protect you if your password management is weak — the risk of unauthorized login remains.
Start by checking whether the exchange is a Crypto Asset Exchange Service Provider registered with the FSA. In Japan, any business operating a crypto asset exchange service must be registered with the FSA and the relevant Local Finance Bureau. You can check whether a business is registered via the FSA's list of registered crypto asset exchange service providers (in Japanese).
It's also worth checking how an exchange manages customer assets. GMO Coin, for example, states that it segregates customer deposits from its own corporate assets and keeps crypto assets in cold wallets that are isolated from the internet. A cold wallet is a storage method that keeps private keys and similar information disconnected from the internet.
All crypto assets (virtual currencies) entrusted to us by customers are stored in a "cold wallet" isolated from the internet. Moving crypto assets (virtual currencies) from the cold wallet to the hot wallet requires approval from multiple departments, meaning transfers out of the cold wallet can only occur under strict, multi-person oversight.
Reference: Security and Customer Asset Management | GMO Coin (in Japanese)
When it comes to crypto asset security, the exchange's own measures alone aren't sufficient. You also need to set a password that's hard to guess and avoid reusing it across other services. Two-factor authentication and multi-factor authentication are also precautions worth enabling without exception. Two-factor authentication adds a verification step beyond your password, typically via an authenticator app or SMS.
Make it a habit to check login and withdrawal notifications as well. If you receive a notification for a login or withdrawal you don't recognize, contacting the exchange quickly can help limit the damage.
Security precautions to take when using a wallet
If you use a self-custody wallet, managing your recovery phrase and private key is the most important thing. For crypto assets held on an exchange, account management on the exchange's side is central. With a self-custody wallet, on the other hand, whoever holds the recovery phrase or private key effectively has access to the assets.
In either case, if a third party learns this information, your assets can be moved without your consent — so you should treat it as more sensitive than a bank account PIN.
Never store your recovery phrase or private key online
As a basic rule, never store your recovery phrase or private key online. Saving it in email, cloud storage, a chat app, or as a screenshot on your smartphone creates a risk that a third party could access it through unauthorized access or a lost device.
If you need to store it, offline methods are the way to go — for example, writing it on paper, or engraving it onto a fire- and water-resistant metal plate (in Japanese). Even paper storage requires care around the risk of loss, deterioration, fire, or water damage. Consider a safe, a safe deposit box, or another location that's both hard for third parties to access and reasonably resistant to disasters (related: Is Your Seed Phrase Storage Method Safe? Survey Results on Crypto Storage Habits and Hidden Risks (in Japanese)).
If you plan to pass your assets on to family members, you don't need to share every detail of your holdings. However, if no one knows that the crypto assets exist or where they're stored, there's a real risk that the assets could become inaccessible after your death.
A wallet app failing doesn't always mean your assets are lost
Even if a wallet app becomes unusable, you may still be able to restore access using another wallet, as long as you still have the recovery phrase or private key. For example, if a service shuts down or an app malfunctions, restoring the wallet through another app that supports the same standard is often possible.
There are real cases where users were unable to log into a wallet app, yet still regained access to their assets because they still had the recovery phrase or private key. This works because crypto assets aren't stored inside a specific app — they exist as records at an address on the blockchain. It helps to think of the wallet app simply as a gateway for accessing those assets (related: How to Recover Access When You Can't Log Into MyEtherWallet: Based on a 15 ETH Recovery Case (in Japanese)).
That said, recovery isn't guaranteed in every case. If the recovery phrase or private key is incorrect, if the wallet you're using isn't compatible, or if the currency or address format doesn't match, the assets may simply not appear. Rather than repeatedly guessing on your own, it's important to first confirm the correct compatible wallet and recovery method.
What to do if you suspect unauthorized access or fraud
If you suspect unauthorized access or fraud, act as quickly as possible. Because reversing a crypto asset transfer after the fact is difficult (in Japanese), delaying action once you notice a problem can make it harder to trace the assets or prevent further losses.
Contact the exchange immediately if you suspect unauthorized login access
If you suspect your exchange account has been accessed without authorization, contact the exchange immediately. If you can still log in, change your password and check your two-factor authentication settings. If you see a withdrawal request you don't recognize, ask the exchange whether they can freeze the account or halt withdrawals.
Leaving suspected unauthorized access unaddressed can allow withdrawals or transfers to go through. Response procedures vary by exchange, so check the official site's support contact and emergency guidance, and reach out as soon as possible.
Preserve evidence of transfer history and communications
If you suspect fraud, save the following information. Being able to show later "who told you what, when, and which address you sent funds to" is essential for explaining what happened:
- Transfer history
- Email / SMS / chat history
- Information about the other party's account
- Destination address
Closing the relevant screens or deleting your conversation with the other party can make it harder to explain the situation later. Since the other party's account could also be deleted, it's important to save screenshots and transaction history as soon as you notice something suspicious.
Consult the police or a consumer affairs center
If you suspect fraud or an unauthorized transfer, consider consulting the police or a consumer affairs center. The FSA has also issued a public warning (in Japanese) about crypto asset-related trouble, cautioning against dealings with unregistered operators and suspicious solicitations.
- Cybercrime Consultation Desk | National Police Agency (in Japanese)
- Consumer Hotline | Consumer Affairs Agency (in Japanese)
- National directory of consumer affairs centers (in Japanese)
The right contact and the information you'll need depend on the nature of the incident. Organizing details such as the destination address, transaction ID, correspondence with the other party, and the exchange you used will make it easier to explain your situation when you reach out for help.
If you can't access your wallet, first check whether you still have your recovery information
If you can't access your wallet, first check whether your recovery phrase or private key is still available. Even if the app itself no longer works, you may still be able to restore access if that information is intact (related: Alta Wallet Recovery Case Study: Restoring Roughly 6.5 ETH After a Service Shutdown Left the Wallet Inaccessible (in Japanese)).
Be careful, though — entering your recovery information into a fake recovery site or fake support channel can lead to theft of your assets. When attempting recovery, use only official websites or trustworthy sources, and never send your recovery phrase or private key to a third party.
If you've shared sensitive information with a third party, move your assets to a new wallet
If you've already shared your recovery phrase or private key with a third party, you should assume that wallet is no longer safe. If any assets remain, move them to a different, secure wallet as soon as possible.
That said, a mistake during this process can make the damage worse. Double-check the destination address and network carefully, and consider consulting an expert depending on your situation.
Conclusion: Everyday habits are what keep your crypto assets secure
Understanding how blockchain works is valuable for crypto asset security, but staying disciplined about everyday account management matters just as much. When using an exchange, check whether it's a registered operator and how it manages customer assets, and make sure you're managing your own password and two-factor authentication properly.
If you use a self-custody wallet, protecting your recovery phrase and private key is the core of managing your assets. Losing them can lock you out permanently, and a third party learning them can result in your assets being moved without your consent. Avoid storing them online, and keep them safe offline — on paper or a metal backup, for example.
Phishing scams and transfer mistakes also deserve close attention. Simple habits — verifying the official site's URL, never sharing sensitive information with anyone, and double-checking the destination address and network before sending — go a long way toward preventing losses.
Crypto assets give you a high degree of control over your own holdings, but that same freedom means a management mistake can cost you those assets. Keeping your holdings safe means not leaving everything to the exchange — you need to understand and regularly apply your own security practices.
If you have any concerns about how to store your crypto assets, recover a wallet, or verify a transfer, feel free to reach out to Clabo. We'll review your situation and guide you through the steps you need to take.
This article is for informational purposes only and does not constitute financial or investment advice. Please consult a qualified professional before making investment decisions.
