How to Keep Your Crypto Secure: 2FA and the Habits That Actually Help
Two recent security incidents, and the lesson for everyday users: six habits that actually protect your crypto and your accounts, starting with two-factor authentication.
Within ten days, two major security incidents made the headlines. No ordinary user could have prevented either of them. Both are still a good reminder of how much you can control yourself.
What happened
PHP2Shell, 20 to 21 October 2026. PHP is a programming language that runs behind many websites and online services. Details of two critical flaws leaked before a fix was ready, and PHP released patched versions on 21 October. According to CERT-EU, every PHP installation serving web requests was at risk until it was updated. Website operators had to patch. Users could only wait.
A record exchange hack, 29 October 2026. Binance confirmed an attack that hit around USD 6.3 billion in funds, with about USD 3 billion frozen. The exchange says attackers may have got in through a staff member's laptop. It says it found no evidence of a private key leak and will cover all losses. The figures may still change (Blick has the Swiss coverage).
Two kinds of risk
Platform risk is what happens inside someone else's systems: a website, an exchange, an app. You can't patch their servers or secure their employees' laptops.
Account risk is how someone gets into your account or your wallet. That part is largely in your hands, and it's where good habits make the biggest difference.
1. Turn on two-factor authentication
Two-factor authentication (2FA) asks for a second proof besides your password: something you have, like your phone, or something you are, like your fingerprint. Switzerland's National Cyber Security Centre recommends using it wherever possible, and at the very least for email, online banking and social media.
Not all 2FA is equal:
- Strongest: passkeys or a hardware security key. They only work on the real website, so a fake login page can't capture them.
- Good: an authenticator app. It generates codes on your phone that change every few seconds.
- Weakest: SMS codes. They can be intercepted, for example if someone takes over your phone number.
Start with your email account. Whoever controls your inbox can reset most of your other passwords. Keep your backup codes somewhere offline.
2. Use a different password everywhere
When a website is breached, stolen passwords get tried on other sites. Flaws like PHP2Shell are exactly the kind that lead to breaches. A password manager makes unique passwords effortless: you remember one, it remembers the rest.
3. Keep your devices updated
The exchange hack reportedly started with a single compromised laptop. The same applies at home: your phone and computer are the front door to your accounts and your wallet. Install updates promptly, use a screen lock, and only install apps from official stores.
4. Expect phishing after big news
Scammers use headlines. After a major hack, expect fake messages about “compensation”, “refunds” or “verifying your account”.
- Never share your recovery phrase, private key or a 2FA code. No genuine provider will ever ask for them.
- Open the website or app yourself instead of clicking a link in a message.
- Treat urgency as a red flag. Real providers don't give you ten minutes to act.
5. Know who holds your keys
With a custodial service, the provider holds the keys to your crypto. It can help you if you lose access, but your funds depend on how well it protects its own systems.
With a non-custodial service, you hold the keys. A breach of the provider's systems doesn't hand attackers your keys, but backing up your recovery phrase is your job.
Neither model is risk-free. What matters is knowing which one you use and what that means for you.
6. Check every address, and test first
Crypto transfers can't be reversed. Check the full receiving address, not just the first and last characters, because scammers create look-alike addresses. For larger amounts, send a small test transaction first.
Your checklist
- 2FA on your email, ideally with a passkey or an authenticator app
- 2FA on every crypto and banking account
- A unique password for every account, stored in a password manager
- Phone and computer up to date
- Recovery phrase backed up offline, never as a photo or in the cloud
- Bookmarks for the sites you use, instead of links from messages
Security is never one setting. It's a few habits, kept up.
Official sources
National Cyber Security Centre (Switzerland): Double up on securing your access
CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP
Last reviewed: 30 October 2026. This article is not investment advice.
FAQ
- What is two-factor authentication (2FA)?
- 2FA asks for a second proof of identity on top of your password, usually a code from an app or a tap on your phone. Even if someone steals your password, they can't log in without that second factor.
- Is SMS-based 2FA better than nothing?
- Yes, clearly. SMS codes can be intercepted, so an authenticator app or passkey is stronger, but any 2FA is far better than a password alone.
- What is a passkey?
- A passkey replaces your password with a key stored on your device, unlocked with your fingerprint, face or PIN. It only works on the website it was created for, so a fake login page can't use it.
- Would 2FA have protected me in the exchange hack?
- No. That attack happened inside the exchange's own systems, not through customer logins. 2FA protects your account from people who try to log in as you.
- I clicked a suspicious link. What should I do?
- Change the password of the affected account from a different, trusted device, and log out all active sessions. If you entered your recovery phrase anywhere, treat that wallet as compromised and move your funds to a new wallet straight away.
- Where should I store my recovery phrase?
- Offline: written on paper or engraved on metal, kept somewhere safe. Never as a photo, in a cloud folder, in your email or in a notes app, and never share it with anyone.
- What if I lose the phone I use for 2FA?
- Use the backup codes you saved when you set up 2FA. If you don't have them, contact the provider's support, who will need to verify your identity before restoring access.
Related reading
Crypto-assets involve significant risk. Their value can rise or fall, and you may lose part or all of your investment. This article is for informational purposes only and does not constitute investment advice, legal advice, an offer, or a solicitation. Eti-Tech AG is a VQF SRO member and a Swiss VASP.
Crypto, The Swiss Way.