How to keep your crypto safe: seed phrases, 2FA and the scams that took $11 billion

Americans reported $11.4 billion in crypto losses to the FBI in 2025. Almost all of it came down to a few avoidable mistakes. Here are the rules that stop them, in order of importance.

Here's a number that should change how you think about crypto risk.

In 2025, Americans reported $11.4 billion in cryptocurrency-related losses to the FBI, up 22% on the year before (FBI IC3 2025 report). That's not market crashes. That's theft, scams and fraud.

The good news: almost all of it exploits the same handful of mistakes. Fix them and you've removed most of the risk that actually ends people.

The short version

Never share your seed phrase or private keys. Not with support, not with anyone. Anyone who asks is robbing you.
Use an authenticator app or a security key for two-factor login, never text messages.
"Guaranteed returns" means scam. Every time.
Nobody legitimate demands payment in crypto.
The biggest scam is the slow one: a friendly stranger, a fake trading platform, fake profits, then a withdrawal "fee" that never ends.

Rule 1: Your seed phrase is the whole wallet

A seed phrase (or recovery phrase) is the master key to a self-custody wallet. Whoever has those words has your coins. Full stop.

The SEC is blunt: never share your private keys or seed phrases (Investor.gov). Coinbase says it will never ask for, or have access to, your recovery phrase (Coinbase).

So:

Write it down on paper. Store it somewhere safe and private.
Never type it into a website, a chat, a "wallet sync" tool or a support form.
Never photograph it or keep it in your email, notes app or cloud storage.
Anyone asking for it is a thief. No exceptions, however official they look.

Rule 2: Lock the front door properly

Two-factor authentication (2FA) adds a second check when you log in. But not all 2FA is equal.

Security keys are the strongest option, according to the FTC.
Authenticator apps are next best, and unlike text codes they can't be stolen with a SIM-swap attack (FTC).
Text-message codes are better than nothing, but a thief who convinces your mobile carrier to move your number to their SIM card gets them too. The FBI recommends an authenticator app instead of SMS, and a PIN on your mobile carrier account (FBI).

Turn it on for your exchange, your email and your phone account. Email matters because it's how most passwords get reset.

Rule 3: Spot the scam in five seconds

The FTC's rules are short enough to memorise (FTC):

Only scammers demand payment in cryptocurrency.
Only scammers guarantee profits or big returns.

Watch for the usual costumes: fake investment platforms, people impersonating a company or government agency, fake coins, fake job offers that pay in crypto, and blackmail.

The big one: the slow-burn investment scam

Crypto investment fraud was the single biggest source of financial losses to Americans in 2025, at $7.2 billion, according to the FBI. It's usually run by organised criminal groups based in Southeast Asia (FBI IC3).

It almost always follows the same script:

A friendly contact by text, social media or a dating app. Often a "wrong number" that turns into a friendship.
A tip about an amazing trading platform they've been using.
Fake profits on the screen. Small withdrawals might even work, to build trust.
Bigger deposits, then a sudden "tax", "fee" or "verification payment" before you can withdraw.
The money is gone. The platform was never real.

If a new online friend ever brings up an investment platform, you already know how the story ends.

Questions people ask

No. Your seed phrase gives full control of your wallet. Legitimate companies, including major exchanges such as Coinbase, never ask for it, and the SEC advises never sharing private keys or seed phrases.

What is the safest two-factor authentication for crypto accounts?

A physical security key is the strongest option, followed by an authenticator app. Text-message codes are weaker because they can be stolen through SIM-swap attacks.

How much money do people lose to crypto scams?

The FBI's Internet Crime Complaint Center received 181,565 cryptocurrency-related complaints in 2025 with $11.4 billion in reported losses, and crypto investment fraud alone accounted for $7.2 billion.

How can I tell if a crypto investment is a scam?

Guaranteed returns, demands for payment in crypto, pressure from a new online contact and withdrawal fees or taxes you must pay before getting your money back are all signs of a scam.