Crypto Security Basics — The Rules That Follow From How It Works

Direct answer

Cryptocurrency security rests on three properties: transactions are irreversible, private keys are the sole authority over funds, and there is no administrator to appeal to. Together these mean prevention is the only control that works — there is no recovery step. Nearly all real losses come from authorisation mistakes and social engineering, not from broken cryptography.

The three properties

1. Transactions are irreversible

A confirmed transaction cannot be recalled, reversed, or charged back. There is no intermediary with the authority to undo it.

This is why: test transactions matter, address verification matters, and any pressure to act quickly should be treated as hostile. Speed has no upside and unbounded downside.

2. Keys are the whole model

Balances live on the ledger. A private key is the authority to move them. Whoever holds the key controls the funds — there is no separate concept of ownership.

This is why: a seed phrase is both a complete backup and a complete compromise, and why no legitimate service ever needs it. There is no scenario in which giving it to anyone helps you.

3. There is no administrator

No password reset, no fraud department, no account freeze on a self-custody wallet.

This is why: backups are your responsibility, and why "contact support to recover your funds" is a fiction that fraud relies on.

Where losses actually come from

Ordered by how often they cause real harm:

1. Authorisation mistakes. You approved something. A malicious token approval, a transaction whose contents you did not read, a signature on a site you assumed was legitimate. No key was stolen; permission was granted.

2. Social engineering. You were persuaded. Fake support, an impersonated team member, an urgent opportunity, a recovery service after an earlier loss.

3. Key handling. The seed phrase was stored somewhere convenient — a photo, a notes app, cloud storage — and later accessed. Or it was lost entirely with no backup.

4. Wrong destination. Right amount, wrong address or wrong network. Address-substitution malware, or a manual error nobody caught.

Cryptography being broken does not appear on this list. Defensive effort belongs where the losses are.

What to prioritise

In order of protection per unit of effort:

Never disclose a seed phrase. Absolute, no exceptions. This single rule prevents the largest category of catastrophic loss.
Separate wallets by purpose. A vault that never touches contracts, a trading wallet, a burner for anything unfamiliar. This limits the blast radius of any single mistake — which matters because you will eventually make one.
Initiate contact yourself. Type domains. Do not follow links or respond to approaches. This defeats fake support, phishing, listing fraud, and recovery fraud simultaneously.
Read what you sign. Which contract, which token, what amount. Prefer finite approvals to unlimited ones.
Enable 2FA, preferably a passkey, on exchange accounts — and store recovery codes offline, away from the authenticator device.
Verify addresses in the middle, not just the first and last four characters, and send a test transaction for anything significant.

Notice that items 2 and 3 are structural: they work without requiring you to correctly judge whether a given thing is malicious. That judgement is exactly what attackers spend their effort defeating, so defences that do not depend on it are worth more.

Custody: two different risk models

Self-custody means you hold the keys. You carry key-management risk and gain independence from any operator's solvency or decisions.

Custodial means a third party holds keys and you hold a claim on them. You gain account recovery and support, and take on counterparty risk — the operator can be hacked, become insolvent, or restrict access.

Neither is universally safer; they relocate risk. What matters is knowing which model you are in for each holding, and not assuming protections from one apply to the other. Exchange 2FA does not protect a self-custody wallet, and a hardware wallet does not protect an exchange balance.

Security theatre worth ignoring

"Audited" with no auditor named. Not evidence.
"Ownership renounced" without checking whether other privileged roles survive.
A large community as a safety signal. That is marketing output.
A rising price as validation. During a honeypot, rising is the expected behaviour.
A verified badge on a social account. Badges are purchasable and impersonation is routine.

What CoinDock will never do

Ask for your seed phrase or private keys.
Contact you first requesting a payment, approval, or credential.
Send an invoice as an address in a message — invoices appear in your authenticated account.
Guarantee a price, return, or performance outcome.

Cryptocurrency Security Basics — What Actually Matters