How to Secure Crypto: A 15-Minute Security Checkup

Disclosure: None of the tools linked in this post are affiliate links, and Money Maker Toolz earns nothing if you use them. See our disclosures. This post is educational only. No tool can make you fully safe.

Why run a crypto security checkup this week?

Three security stories landed on Oct 21–22, 2026. None of them is a crypto exchange hack, but each is a reminder that the services around your crypto can be a weak point.

Railway asked all users to rotate keys. In its Oct 21 security disclosure, the hosting platform Railway said an unauthorized third party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." It recommended that all users "immediately roll all environment variables, including any API keys," and said "All deployments are paused while we investigate" (Railway).

Railway followed up on Oct 22 with guides on the credential reset and on rotating Redis credentials (credential reset guide, Redis guide, status page).

CISA urged immediate PHP patching. On Oct 21, CISA said two PHP flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed "php2shell"), allow "unauthenticated remote code execution," and urged updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. At publication, CISA said it "has not observed exploitation" (CISA).

Security researchers citing AWS reported exploitation attempts from Oct 17, before disclosure (Datadog Security Labs). EU agencies also issued a joint statement via ENISA.

Japanese banks paused some services as a precaution. Kyodo reported on Oct 22 that "MUFG Bank halts some services, possibly due to PHP flaw" (Kyodo). Mainichi, carrying Kyodo, said MUFG described it as "extraordinary system maintenance," with services including online opening of investment trust accounts unavailable (Mainichi).

Jiji, via Nippon.com, reported MUFG "halted some transactions through its online banking service," that Mizuho and Daiwa Securities ran emergency maintenance, and that the Japanese Bankers Association said there was no impact on interbank settlement (Nippon.com). These were precautionary halts, not a reported breach of MUFG.

The takeaway is simple: you can't control a platform's servers, but you can control your passwords, logins, keys and wallet permissions. That's what the checkup below covers.

What is the 15-minute crypto security checkup?

The times are our rough planning estimates, not measured figures. Some steps, like setting up a password manager fully, will take longer the first time.

How do you check if your email was in a data breach?

Have I Been Pwned lets you "Check if your email address is in a data breach," and offers "Notify Me" alerts for future breaches (Have I Been Pwned).

Check the email you use for exchanges first. If it shows up in a breach, change that account's password and any account that reused it.

For transparency: the Have I Been Pwned homepage showed a "Try 1Password" partner promo when we checked it.

Why should you use a password manager for crypto accounts?

A password manager lets you use a long, unique password for every exchange and email account, so one leaked password doesn't open the rest. CISA's guidance on strong passwords is a good starting point (CISA).

Bitwarden's pricing page shows "Get Started Free," a Family plan described as "a shared vault for six users," and a free Authenticator app ("Free 2FA, no account needed") (Bitwarden pricing). Individual paid prices were not captured, so they're not stated here.

1Password's pricing page loads its prices with JavaScript, and we did not capture prices or trial terms (1Password pricing). Check them directly.

How do you turn on MFA for crypto accounts?

Multi-factor authentication adds a second check, beyond your password, before someone can sign in. CISA explains the options in its "Turn on MFA" guide (CISA).

Start with your email account, because it can reset everything else. Then do each exchange and your password manager.

Read CISA's page for its view on which MFA methods to choose. An authenticator app such as Bitwarden's free one is one option; a hardware security key is another.

What are token approvals and why revoke them?

When you use a decentralized app, your wallet often grants it permission to move a token. Those permissions can stay open long after you stop using the app. Revoke.cash explains this in its guide to what token approvals are.

Revoke.cash describes itself as a way to "Inspect and revoke token approvals to protect your wallet from exploits and scams." It claims "2M+ Total Users, 20M+ Approvals Revoked, 80+ Networks Supported" (Revoke.cash); those are the vendor's own figures.

Connect your wallet, review approvals you no longer need, and revoke them. Revoking is an on-chain transaction, so it usually costs a network fee.

How do you block crypto phishing sites?

Phishing pages that imitate wallets and exchanges are a common way people lose funds. A blocklist extension can warn you before you sign something on a known bad site.

ScamSniffer offers a "free browser extension for individuals" and says it tracks "phishing sites, wallet drainers, and scammer addresses," with "258K+ domains & malicious addresses on the blocklists" (ScamSniffer).

ScamSniffer's own 2025 report claims crypto phishing losses fell 83% to $84M. That's the vendor's figure, not an independent one.

Should you rotate exchange API keys after a platform breach?

Yes, if a service holding your keys reports a breach, follow its instructions. Railway's notice told all users to roll every environment variable, including API keys (Railway).

If you run a bot, dashboard or tax tool connected to an exchange, give it a read-only API key when it only needs to read. A read-only key can't place trades or withdrawals if it leaks.

After rotating, delete the old key on the exchange side, not just in the app that used it.

Should you move crypto to cold storage?

For holdings you don't plan to touch, a hardware wallet keeps private keys off your everyday computer. Ledger says "Hardware wallets store your private keys offline" and that its devices use a Secure Element chip (Ledger).

Trezor states "100% open-source code & design," and claims "2+ million users" and "12+ years of open-source security" (Trezor). Those are the vendor's own figures.

Compare them in our Ledger vs Trezor comparison, or browse the wallets category. We did not check ELLIPAL, SafePal, Rabby, MetaMask or Phantom for this post, so their features aren't covered here.

Whatever you choose, store your recovery phrase offline and never type it into a website.

FAQ

What is the fastest way to secure crypto?

Start with the account that can reset all the others: your email. Give it a unique password from a password manager and turn on MFA, then repeat for each exchange.

How do I protect my crypto wallet from hackers?

Revoke token approvals you no longer use, add a phishing-blocking extension, and keep your recovery phrase offline. For long-term holdings, consider a hardware wallet.

Were the PHP flaws CISA warned about being exploited?

When CISA published on Oct 21, it said it "has not observed exploitation." Security researchers citing AWS reported exploitation attempts from Oct 17. We found no CISA Known Exploited Vulnerabilities entry for these CVEs when we checked.

Was MUFG hacked?

The reports we found describe precautionary service halts and maintenance linked to the PHP flaw, not a breach. Kyodo, Mainichi and Jiji all reported the halts on Oct 22.

Do I need to do anything about the Railway breach?

Only if you, or a tool you use, host apps on Railway. Railway told all users to rotate environment variables, including API keys.

Are these security tools free?

Have I Been Pwned's check, ScamSniffer's individual extension and Bitwarden's free plan and Authenticator are described as free on their sites. Hardware wallets cost money; check vendor pages for prices.

---

Risk disclosure: This article is for education only and is not financial, legal or security advice for your specific situation. No tool or checklist guarantees your funds are safe. Crypto assets are volatile and losses from hacks, scams or mistakes are often irreversible. News details reflect reports available on Oct 22, 2026 and may change. Money Maker Toolz has no affiliate relationship with the tools in this post; see our disclosures.