Auditing your own setup

Run a crypto setup for a few years and it drifts into disorder: exchange accounts you stopped using, wallets you created to try something, an approval from a DeFi app you touched once, an old handset left as-is after an upgrade. Each is small, but assets and permissions you are not tracking are ones you will not notice being abused. An audit makes the invisible part visible.

Split it into five. First, accounts: which exchanges, what balance, which two-factor method, what the withdrawal whitelist looks like. Second, wallets: per address, its purpose, its balance and which seed phrase it derives from. Third, approvals: for each address, list the live ones and revoke what you no longer need.

Fourth, backups: where the media holding your seed phrases are and how many exist; whether they are still legible (faded ink, damaged stamping); and — most importantly — whether you can actually restore from them. A restore test means recovering into a fresh wallet app and checking the addresses match, and it must be done on a trusted, malware-free device in as offline a state as you can manage. Without that check, a backup's status is simply unknown. Fifth, devices: list everything still logged into a wallet or an exchange, sign out of what you no longer use, and revoke sessions for devices you sold or disposed of.

Then work the list in priority order: an account with a large balance still on SMS two-factor, an address carrying an unlimited approval, an asset whose backup exists in only one place. Start there. Note also that the inventory itself is sensitive. Do not park it in a shared cloud document — print it and store it apart from your keys, or keep it encrypted and offline.