CZ Shares 2026 Crypto Security Guide: Prevent Theft, Prevent Loss, Plan for Inheritance

Binance founder and former CEO Changpeng Zhao (CZ) shared a condensed crypto-security guide on X, saying he made the shortened version after realizing his original Binance blog post on keeping crypto "#SAFU" in 2026 was too long and wordy. His core advice: match security measures to the value of your holdings and your technical ability, addressing three priorities — prevent theft, prevent accidental loss, and provide for inheritance. On self-custody, he noted private keys authorize access to funds and seed phrases generate those keys, so anyone who obtains either can control the associated crypto; self-custody requires secure devices, reliable backups, and a workable recovery plan.To prevent key theft, he recommended a dedicated offline computer for storing keys and signing transactions, software installed only from official sources via clean removable media, malware checks on downloads, disk encryption, a dedicated phone reset before wallet installation and kept offline with a strong passcode, and established hardware wallets — while verifying destination addresses on the device before approving transfers, protecting backups as carefully as the device itself, and cautioning that hardware wallets remain vulnerable to software flaws, physical attacks and insecure backups. To prevent key loss, he advised multiple protected backups in separate locations: paper is simple to create but vulnerable to damage, loss, transcription errors and unauthorized reading; metal is more durable but still readable by others; encrypted USB drives allow geographically separated backups but require strong encryption and technical care — and he warned against photographs or screenshots of keys that may sync to cloud accounts. For inheritance, he suggested providing a recovery process without unnecessarily exposing funds during one's lifetime, noting sharing keys gives recipients immediate spending access and storing keys with an intermediary carries similar risks; a dead man's switch can release instructions after prolonged inactivity but should be researched and tested first, and recovery instructions should be encrypted for the intended recipient — for example with their PGP public key — rather than left unencrypted in scheduled messages.On centralized exchanges, CZ said exchanges manage custody and infrastructure but users remain responsible for account security, urging users to evaluate reputation, security resources, testing practices and the sustainability of the business model, treat unusually generous incentives or unclear revenue sources cautiously, and recognize that exchange custody carries counterparty risk. Among his 11 account-security measures: a separate email address for each exchange with strong two-factor authentication, preferably a hardware security key; avoiding phone-based recovery that could expose accounts to SIM-swap attacks; unique passwords stored in a protected password manager; whitelisting withdrawal addresses; keeping API keys private; completing identity verification to support ownership checks and inheritance procedures; securing devices physically; and avoiding phishing by opening exchanges through trusted bookmarks or carefully typed addresses, never entering credentials after unsolicited links and treating unexpected contact from purported exchange staff cautiously. He closed by advising users to choose a custody mix — allocating funds between exchanges and personal wallets according to technical ability, security practices and access needs — since self-custody requires independent key protection and recovery, exchange custody requires trust in the provider and strong account protection, and a separate wallet can provide access during exchange maintenance.