Most crypto losses don't come from broken cryptography. They come from a handful of quiet, repeatable mistakes — a reused password, a seed phrase typed into a browser, 2FA that lives on the same phone as the exchange app. The habits that matter most are boring and specific: keep the seed phrase offline, separate your 2FA device from your trading device, verify URLs before you log in, and move large balances off any hot wallet. Get those four right and you've closed the doors most attackers actually use.
Habit one: treat your seed phrase like a physical key, not a file
A seed phrase is the master key to a wallet. Anyone who sees it owns the funds, and no support desk can reverse that. The rule is blunt: it never touches a keyboard, a photo roll, or a cloud note.
Offline storage that survives a house move
Write it on paper or stamp it into metal, store it somewhere you'd trust with a passport, and keep a second copy in a different physical location. A fireproof box in one apartment isn't redundancy if the whole building is the risk.
The mistake people actually make
They screenshot the phrase "just for a minute" during setup, then forget the screenshot. Months later a cloud backup syncs it to a laptop that picks up malware. That single image is the whole loss.
Habit two: keep 2FA on a device that isn't your trading phone
SMS codes are the weakest link in the chain — SIM-swap attacks exist precisely because they work. Authenticator apps and hardware security keys are stronger, and the key detail is separation: if your exchange login, your email, and your 2FA all live on one handset, a single stolen phone unlocks everything.
Here's the practical split:
- Trading device: the phone or laptop you log in from, kept updated and free of random apps.
- 2FA device: a separate phone or a hardware key that stays home.
- Recovery codes: printed and stored with your seed phrase backup, not in your inbox.
Say you hold ¥300,000 of BTC on an exchange and your phone is snatched on the Yamanote line. If 2FA was SMS on that same phone, the thief has a window to reset passwords before you even reach a police box. If your authenticator lived on a tablet at home, the thief has nothing usable. Same theft, wildly different outcome.
Habit three: verify the URL and the app before you type a password
Phishing pages for Japanese exchanges are convincing — correct logos, correct fonts, a domain that's one character off. The habit that beats them is mechanical, not clever: type the address yourself or use a bookmark, and check the domain carefully every single time.
On mobile, install the exchange app from the official store listing and open it directly rather than tapping links in emails or DMs. bitFlyer, like any regulated Japanese exchange, publishes its official domain and app details on its own site — confirm them there once, bookmark them, and stop trusting links from anywhere else. If a message creates urgency ("your account will be frozen in 24 hours"), that urgency is the tell. Close it and log in your own way.
Habit four: right-size your hot wallet
Hot wallets are for spending and trading. Cold storage is for holding. The habit is deciding the line in advance, not in the moment.
| Balance type | Where it should live | Why |
|---|---|---|
| Daily trading float | Exchange or hot wallet | You need fast access |
| Long-term holdings | Hardware wallet | Offline keys, no browser exposure |
| Anything you can't afford to lose | Hardware wallet, backed up | Removes the single biggest attack surface |
Move funds deliberately. A ¥50,000 trading float on an exchange is reasonable; six months of savings sitting there because "it's convenient" is a choice you'll regret if the account is ever compromised.
Habit five: slow down when you're excited
Every major scam — fake giveaways, "support" agents in DMs, romance-style investment pitches — runs on urgency and emotion. The counter-habit is a self-imposed pause: no transaction within an hour of an unsolicited message, and no seed phrase ever shared with anyone claiming to help. Real support never asks for it.
Frequently asked questions
Is SMS 2FA good enough for a Japanese crypto exchange?
It's better than nothing, but it's the weakest common option because SIM-swap attacks can intercept codes. An authenticator app or a hardware security key is meaningfully stronger. Whichever you choose, keep the 2FA device separate from the phone you trade on.
How often should I move funds off an exchange?
There's no single right schedule — it depends on how much you trade and how much you're holding. A common approach is to leave only a working float on the exchange and sweep the rest to a hardware wallet after each significant buy. Decide your threshold once, then stick to it.
What should I do if I think my seed phrase leaked?
Assume the wallet is compromised and move the funds to a freshly generated wallet immediately. Don't reuse the old phrase, and don't wait to see whether anything happens. After that, review how the leak occurred — a screenshot, a cloud note, a phishing page — so it doesn't repeat.
Does using a regulated exchange like bitFlyer remove the need for these habits?
No. Regulation addresses how the platform operates, not how you protect your login and keys. Account takeovers, phishing, and seed-phrase theft all happen at the user's end. Treat your exchange account with the same care as your bank login — and your self-custody wallet with more.
Pick one habit from this list and fix it today — start with wherever your seed phrase currently lives.