The plan runs four weeks. Week one covers what you actually hold, week two gets your tools set up, week three prepares you for a bad day, and week four looks years ahead. Every seventh day is a check-in with the 30-point self-audit, so you can see your score move.
Week 1 · The basics: know what you actually hold
Day 1 · What a private key really is
Do: Save the standalone offline copy of the iancoleman.io/bip39 tool, disconnect from the internet, then open it and generate a throwaway test seed phrase. Watch how the phrase turns into private keys, public keys and addresses. Never put real money on it, and close the page when you are done.
Read: Private Keys and Seed Phrases: A Practical Custody Guide
Day 2 · Map every wallet you have
Do: Make a simple table of every place you hold crypto: exchange or self-custody, hot or cold, which chain. Include the easy-to-forget ones, like an old exchange account, a crypto balance inside PayPal, Venmo or Cash App, or a browser wallet you set up once and never opened again.
Read: Self-Custody Wallets: From Browser Apps to Hardware Signers
Day 3 · Hot vs. cold: where do you stand?
Do: Decide whether your setup today is all hot, all cold, or a mix of both. For most people the mix is the goal: a small hot wallet for spending, cold storage for the rest.
Read: Cold Wallet vs Hot Wallet: A Holder’s Working Split
Day 4 · Size up your exchange
Do: For each exchange you use, check who regulates it and whether it publishes proof of reserves. If it doesn’t, think about moving part of your balance to another exchange or into self-custody.
Read: How to Evaluate a Crypto Exchange Before You Deposit
Day 5 · Upgrade your two-factor
Do: On every crypto-related account, and on the email behind it, switch two-factor from text-message codes to an authenticator app (Google Authenticator, Authy or similar) or to a passkey or hardware key. While you are at it, ask your mobile carrier what number-lock or port-out protection it offers and turn it on.
Read: The Truth About 2FA, Passkeys, and Recovery Codes
Day 6 · The phishing landscape
Do: Go through every place a seed phrase could be sitting online: cloud drives, your photo library, notes apps, email. Treat anything that is online as readable by someone else, and make sure no seed phrase lives there.
Read: Crypto Phishing Scam Atlas 2026 (a long one, so feel free to split it over two days)
Day 7 · Week one check-in
Do: Take the 30-point self-audit. See whether a week of work has lifted your score by about 5 points from where you started.
Read: Nothing new today. Skim your notes from days 1 to 6.
Week 2 · Setup: get the tools and routines in place
Day 8 · Store the seed phrase properly
Do: If your seed phrase is still on paper, order a steel backup today. A Cryptosteel, a Billfodl or a similar stamped steel plate all do the job.
Read: Five Seed Storage Methods That Survive Real Life
Day 9 · Pick a hardware wallet
Do: If you don’t own one yet, order one. A Trezor Safe 3, a Ledger Nano S Plus or a Keystone 3 Pro are all reasonable starting points. Buy straight from the manufacturer’s own store, not from a third-party marketplace listing.
Read: Hardware Wallet Comparison · Ledger, Trezor, Keystone, Coldcard
Day 10 · Lock down MetaMask
Do: Open MetaMask and go through the seven settings in the article one by one, changing each as recommended.
Read: MetaMask Security Settings for Daily Use
Day 11 · Passkeys in 90 seconds
Do: Turn on a passkey for at least one of your main exchange accounts, and do the same for your Apple or Google account.
Read: Passkeys in 90 Seconds for Crypto Accounts
Day 12 · Set up the hardware wallet
Do: When the device arrives, reset it, let it generate a brand-new seed phrase, copy that phrase onto your steel backup, and send in a small test amount. If it asks for a firmware update, run it only from the manufacturer’s official app.
Read: Private Keys and Seed Phrases (reread the BIP-39 section) and Hardware Wallet Firmware Update
Day 13 · Rehearse a recovery (don’t skip this one)
Do: Take your backup and restore the wallet on a second device or a freshly reset hardware wallet. If the addresses match, your backup works. This is the step people skip, and it is the one that matters most.
Read: Five Seed Storage Methods That Survive Real Life (the recovery rehearsal section)
Day 14 · Week two check-in
Do: Take the self-audit again. The target is another 5 to 8 points over last week.
Read: Nothing new. Write yourself a short note on what went smoothly this week and where you got stuck.
Week 3 · Risk and emergencies: plan for the worst day
Day 15 · If you got phished today
Do: Run every wallet through revoke.cash and revoke any approval you haven’t used in six months. Cleaning these up now can stop a future phishing attempt cold.
Read: Checking and Revoking Token Approvals: The Complete Guide (step by step) and Private Key Leak Response: The First 24 Hours
Day 16 · Run an emergency drill
Do: Pretend you just found out one of your wallet keys has leaked. Walk through the first-30-minutes sequence from the article, in your head or on paper, and time yourself. How fast could you get the funds out?
Read: Private Key Leak Response (read it once more)
Day 17 · Make test transfers a habit
Do: From today on, every withdrawal or transfer starts with a small test amount, just above that coin’s minimum withdrawal. Send the rest only once the test has arrived. Do it until it’s automatic.
Read: USDT on the Wrong Network: What Can Still Be Fixed
Day 18 · What if your wallet brand disappears?
Do: Look up the derivation path your hardware wallet uses. As long as it uses BIP-39 and a standard path, you can restore your funds in another wallet even if the company behind it shuts down.
Read: What If Your Hardware Wallet Brand Disappears?
Day 19 · Is your seed phrase in the cloud?
Do: One last sweep of everywhere a seed phrase might be hiding: iCloud Notes, Google Keep or Drive, email drafts, texts you sent yourself, screenshots in your camera roll. If you find one, delete it and move the funds to a new wallet.
Read: Can You Photograph a Seed Phrase?
Day 20 · Set up Flashbots Protect
Do: Add the Flashbots Protect RPC to MetaMask so it is ready if you ever need to move funds out of a compromised wallet. You don’t have to use it every day, but have it configured.
Read: Flashbots (glossary entry)
Day 21 · Week three check-in
Do: Take the self-audit again. The target is 22 or higher.
Read: Nothing new. Go back over the emergency steps and write a one-page “if something goes wrong today” plan. Print it and keep it in a drawer.
Week 4 · The long term: plan for the next five to ten years
Day 22 · Map your holdings and concentration
Do: Make a full list of how much sits in each wallet, exchange and chain. Then work out your biggest single point of failure: what percentage of everything sits in one place?
Read again: Self-Custody Wallets (the section on where on the ladder you should sit)
Day 23 · Spread across more than one exchange
Do: If more than 30% of your total holdings sits on a single exchange, start moving part of it today, either to a second exchange or into self-custody.
Read again: How to Evaluate a Crypto Exchange Before You Deposit
Day 24 · Consider Shamir backup or multisig
Do: If losing your crypto would change your life, look seriously at a SLIP-39 Shamir backup or a Safe (formerly Gnosis Safe) multisig. Read up today and decide tomorrow whether to do it.
Read: Five Seed Storage Methods That Survive Real Life (the Shamir section) and the multisig glossary entry
Day 25 · Start your estate plan
Do: Write instructions for at least one family member or friend you trust: if I’m gone, here is how to get these assets back. It can be encrypted. What matters is that it exists.
Read: If I Die, Can My Spouse Access My Crypto?
Day 26 · Get your taxes straight
Do: Find out how your crypto is taxed. In the US, the IRS treats crypto as property, so selling, swapping or spending it can trigger a taxable gain. Even if you owe nothing this year, know which records to keep, and bring in a CPA if your situation is more than simple.
Read: How Are Crypto Taxes Handled in the US?
Day 27 · Bookmark the corrections page
Do: Bookmark the corrections page and check it once a month. Articles get updated as things change, and that page is where you’ll see what moved.
Read: Skim the current corrections to see how updates are handled.
Day 28 · Explain it to someone outside crypto
Do: Over a cup of coffee, explain private keys, wallets and exchanges to someone who is curious about crypto but doesn’t know where to start. If you can make it clear to them, you really understand it.
Read again: The first section of Private Keys and Seed Phrases
Day 29 · Schedule next quarter’s review
Do: Put a reminder on your calendar three months out. On that day, take the self-audit, revoke stale approvals and update your holdings list. Make it a quarterly habit.
Read: Nothing today.
Day 30 · Final check and a letter to yourself
Do: Take the self-audit one last time. The target is 25 or higher. Then write a letter to yourself a year from now: what you have already put in place, and what you should add next year.
Read: Browse the Hodler’s Handbook home page, note the articles you haven’t read yet, and come back to them when you need them.