Most people who lose crypto don't get "hacked" in some cinematic way. They leak a seed phrase, sign a bad transaction, or click the wrong link. None of that requires an attacker to break encryption — it just requires you to make one clickable mistake.
Here are the rules that actually prevent losses, in rough order of importance.
It never goes into a website, a chat, a note app, a screenshot, or the cloud. Paper or steel, offline. Everything else about wallet security is downstream of this rule.
A hardware wallet keeps the key off your internet-connected device, so a malware infection can't drain you silently.
Keep a small "hot" wallet with spending money for everyday use, and keep the rest behind the hardware wallet. If the hot wallet gets compromised, the damage is small and contained.
Phishing clones are the #1 drainer vector. Type the URL once, bookmark it, and only ever use the bookmark — never search results, never links from chats.
Every time you interact with a contract you may grant a spending approval. Revoke what you don't need anymore (revoke.cash and similar tools exist for this). An old approval to a dead contract is a liability.
Unlimited approvals, "setApprovalForAll", random signature requests — if you can't explain what it does, don't sign it. Legitimate services don't need endless permissions.
Sending to a new address or chain? Send a test amount, confirm it lands, then move the rest.
Support doesn't DM you. Giveaways don't DM you. Anyone who slides into your DMs with a "fix" or an "opportunity" is a thief. Every time.
Wallet firmware updates patch real problems. Do them — but only through the official wallet app, never through a link someone sends you.
Two backups, two locations, protected against fire and water separately. And no — a photo of the backup on your phone doesn't count.
Anything urgent is a scam. Anything requiring your seed phrase is a scam. Everything else, sleep on it before signing.