Changpeng Zhao Shares How to Protect Crypto Assets from Theft and Loss

Former Binance CEO Changpeng Zhao (CZ) outlined the principles of secure cryptocurrency storage, highlighting three priorities: preventing asset theft, protecting against accidental loss of access, and planning for inheritance. According to him, security measures should be tailored to the value of the assets and the owner's level of technical expertise. For self-custody, CZ advises protecting private keys, making backups in different locations, and planning access recovery in advance. Keys and transaction signing should be kept on a separate computer without internet connection, software should only be installed from official sources, and checked for malicious code. For mobile wallets, he recommends a separate phone with factory settings, without root access and jailbreak, which should be kept offline outside of transfers and updates. For hardware wallet owners, CZ advises choosing devices from reputable manufacturers, protecting them from theft, and verifying the recipient's address directly on the screen. However, such devices do not eliminate all risks: software issues, physical attacks, and unreliable storage of copies can lead to loss of funds.

To protect against key loss, CZ recommends several backups in different locations: paper, metal carriers, encrypted USB drives. Each method has limitations: paper can be damaged, metal can be lost, digital copies require reliable encryption. He warns against photographing keys and taking screenshots, which can sync with the cloud, and advised checking the recovery procedure in advance. Separately, CZ touched on inheritance: transferring private keys gives immediate access to funds and creates risks, so an alternative could be a Dead Man's Switch mechanism, sending instructions after prolonged inactivity. Before using it, the service should be checked, and instructions for the recipient are better encrypted, for example, through their public PGP key.

On centralized exchanges, the infrastructure is managed by the provider, but account security remains the user's responsibility. CZ advises assessing the exchange's reputation, its security resources, and the resilience of its business model, considering counterparty risk. To protect accounts, he recommends unique complex passwords in a password manager, two-factor authentication focusing on hardware keys or apps instead of SMS, a separate email address for each exchange, withdrawal address whitelists, API key protection, and accessing sites through verified bookmarks. He specifically warned about SIM swap attacks, where attackers intercept SMS codes. In conclusion, CZ advises distributing assets between exchanges and personal wallets: self-custody provides control over keys but requires responsible backup, and a separate wallet ensures access to some funds if the exchange is temporarily unavailable.