You can lose cryptoassets without anyone stealing your password or recovery phrase. Sometimes, all it takes is signing a transaction or message that lets someone else move your assets. This can happen even with a hardware wallet, a device designed to protect your private keys.
To understand how, you need to know who controls your funds and what you authorize when you sign. This guide covers those basics. The next two guides explain how to protect your accounts and wallets and how to recognize common risks and scams.
These explanations cannot guarantee the safety or recovery of your funds. No product, provider or protocol discussed in our articles is endorsed by Token Expert.
1. Your address, private key and password do different jobs
A wallet lets you check your balance and authorize transactions. It does not directly contain your cryptoassets: they are recorded on the blockchain, a ledger shared among the network's computers. The wallet lets you interact with that ledger. To understand what someone could do with your information, it helps to distinguish four things: (1)
- Your public address is what you share to receive funds. It does not let someone spend them, but it can reveal your balance and transaction history.
- Your private key is used to sign transactions. Someone who steals it can move the funds controlled by that key without knowing the password to your wallet app.
- Your recovery phrase is a set of words that lets you recreate your keys. It can generate several private keys and is therefore different from an individual key. Writing it down by hand on paper creates a physical backup copy; no computer file is needed. If someone obtains the phrase, several accounts may be exposed at once. (16)
- Your password or PIN protects local access to an app or device. Changing it does not make a stolen private key safe again. Some wallets use passkeys, which let you authenticate using a device without having to enter a traditional password. Recovery methods also vary between wallets, so check how yours works.
Never share your recovery phrase with another person or service. If a website or supposed support agent asks for it to “verify” your account, they are trying to scam you.
2. Who controls your funds?
On a centralized exchange, often called a CEX, the company holds the assets and manages withdrawals. When assets are under your control, your keys and the wallet's rules determine how operations are authorized. Protecting them then depends on your own security practices.
DeFi, short for decentralized finance, relies on smart contracts: programs on a blockchain that handle activities such as swaps, loans and liquidity pools, where users' funds are pooled to enable trading. Depending on the operation, you authorize a contract to use your assets or deposit funds into it. You make the deposit through your own wallet, but the deposited funds then depend on those contracts and the services they use. (2)
| Where you hold the assets | What controls access to them | What could go wrong |
|---|---|---|
| On a centralized exchange | The company's custody and withdrawal systems | Someone takes over your account; the operator is fraudulent; withdrawals are blocked; the company fails |
| Assets under your control | Your keys and the wallet's authorization limits | Keys are stolen; you sign a harmful request; you lose the physical copy of your recovery phrase |
| In a DeFi protocol | The contracts and services that manage the deposit | A vulnerability is exploited; administrators change the rules; withdrawals become difficult; the position loses value |
A hardware wallet is a device designed to keep private keys away from your connected computer. You must confirm the transactions it signs on the device itself, which adds a layer of protection. (10) Warning: if a private key is compromised, an attacker can move the funds it controls without having the device. (11)
A multisignature wallet, or multisig, requires several signatures for transactions. In a two-of-three setup, three separate keys can sign, but two signatures are enough. Stealing a single key is therefore not enough on its own to approve a transaction. Losing access to two keys, however, can leave funds inaccessible. The security practices guide also explains options that can create other access rights.
Both can help protect access to your wallet. Neither removes the risks of a protocol where you deposit funds.
3. What are you agreeing to when you sign?
Wallet prompts can look similar while asking for very different things. These examples mainly apply to Ethereum-compatible applications; other networks and account types can work differently.
| Request | What it can do | What to check |
|---|---|---|
| Connect your wallet | Share your address with the site; authentication may require a separate signature | Connecting alone generally does not allow spending. Read any request that follows |
| Sign a message | Log you in, place an order or authorize a later action | What the message permits, even if there is no gas fee to pay now |
| Approve asset spending | Let another address or contract move a particular asset | Who receives that permission, which asset it covers and the spending limit |
| Sign a transaction | Transfer funds, make a deposit or change permissions | The network, recipient and expected result |
Imagine a website offering a reward for depositing into a liquidity pool. To claim it, you must authorize its contract to move assets held in your wallet. You confirm on your signing device. If the contract is fraudulent, its operator can use that approval to move your assets within the permission you granted. Your recovery phrase was never needed. (5, 6)
A spending approval can remain active after you last use an application. If you later receive more units of the same asset, they may also be exposed, up to the remaining allowance. Limit the approval to the amount needed to reduce exposure. Disconnecting your wallet from the website does not cancel those approvals. (6)
You can revoke permissions granted to contracts through a service such as Revoke.cash, or directly in some browser wallets, such as Rabby Wallet. (8, 9) Revocation takes place on the relevant network, incurs network fees and does not recover assets already transferred.
4. Where an attack can happen
Consider the steps in a DeFi transaction: you open a website, read a request, sign it and wait for a contract to execute it. Each step introduces something to check.
The website prepares the request. A copied website, or a compromised page on a service you regularly use, can ask you to send funds to the wrong recipient or approve an unexpected action. Checking the domain is useful, but it does not tell you whether the contract is safe.
Your computer and wallet then display the request. Malware can change what you see or steal information. Compare the available details on your signing device with what you intended to do.
The contract executes its rules. A lending application may rely on an oracle, a service that supplies prices. The contract uses these prices to value assets deposited as collateral for a loan. Incorrect data may make it treat the collateral as insufficient and trigger a forced sale, known as liquidation. (15)
Administrators may also have the power to change the contract or pause withdrawals. Identify who holds these powers and when they can use them: the rules you examine today are not necessarily permanent. Smart-contract risks cannot be eliminated completely. To reduce them, favour reputable platforms and research them thoroughly before committing funds. (4, 7)
Other services can add further exposure. A bridge, used to move assets between networks, introduces its own validation or custody arrangements. A service that combines several yield strategies may depend on several contracts and operators. If one fails, your deposit may be affected. (2, 3)
Public code allows the program to be examined. An audit is a security review of a particular version and set of functions; it can miss vulnerabilities. Large deposits show that users have committed funds, without proving that the contract is safe. (7) Check the network and the asset's contract address too: anyone can copy its name or ticker. Using DeFi always involves risk. Careful checks can reduce it, but cannot eliminate it.
5. Different losses call for different protections
When funds disappear or a position loses value, the cause matters:
- Someone stole a key or obtained a harmful approval. The attacker can move the affected assets either by possessing the key or by using a permission they were granted. Protecting keys and checking signatures helps address this risk.
- A protocol was exploited. Deposited funds may be lost even if your own device and keys were never compromised.
- The market moved or a loan was liquidated. An asset can lose value, or collateral can become insufficient to support a loan, without a hack. (4)
- A transfer or storage mistake can cause a loss or block access to funds. Sending assets on the wrong network or using the wrong address can make funds inaccessible or send them to the wrong recipient. Losing the only physical copy of your recovery phrase can prevent you from restoring the wallet if the device becomes unusable. Recovery options depend on the situation.
Be wary of offers that seem too good to be true. Social media posts, videos and private messages sometimes promise quick, risk-free money. Check the offer through independent sources before sending funds or signing a request. (12)
Scam statistics at a glance
Global figures in US dollars, from Chainalysis's January 13, 2026 report. (13)
| Measure | Amount |
|---|---|
| Scam receipts in 2024, revised estimate | US$12 billion |
| Identified scam receipts for 2025 | At least US$14 billion |
| Projection for 2025 | Over US$17 billion |
| Average payment | US$782 in 2024; US$2,764 in 2025 (+253%) |
These estimates are revisable. The projection is not a confirmed total; the average measures payments, not total losses per victim. (13)
A request to pay through a Bitcoin ATM
If someone tells you to withdraw cash and deposit it at a Bitcoin ATM, treat the request as a fraud warning. Their QR code may direct the payment to their wallet. End the conversation immediately: this is an attempted scam. (14)
6. Check your understanding of the risks
Before continuing, you should be able to confirm each point and explain it in your own words:
- Protecting secrets. A stolen private key or recovery phrase can give someone access to funds, and changing your password does not remove that access.
- What signatures authorize. A signature can authorize your assets to be moved immediately or later, even if you use a hardware wallet.
- Permissions that remain active. A spending approval can remain active and cover future deposits within its limits. Disconnecting the website does not revoke it.
- Reliance on others. Depositing assets on a platform or in a protocol makes you depend on its operators, contracts and supporting services.
- Losses without a hack. A price drop, liquidation or mistake can cause a loss even if your keys were never compromised.
- Limits of security checks. An audit and published code do not prove a protocol has no vulnerabilities.
If a point is unclear, revisit the relevant section before continuing. The security practices guide explains the precautions you can take before, during and after a transaction. The risk and scam guide helps you recognize situations that deserve closer attention.
Sources
Sources consulted October 29, 2026. Technical documentation explains mechanisms; references do not constitute endorsements.
-
Bank for International Settlements — DeFi risks and the decentralisation illusion, December 2021. Used for structural risks, not current market figures.
-
Ethereum.org — Contract security, access controls and audit limitations.
-
Rabby Wallet — Approval management in the browser extension — official source code.
-
Trezor documentation — Transaction confirmation on the device.
-
Chainalysis — 2026 Crypto Crime Report: scams, 2024–2025 figures and projection.
