The Security Guide is a reference, ranked by risk. This page is the other thing you need: a sequence. If you have one free, unhurried day, doing the steps below in this order covers every base — and the order matters, because several steps depend on the ones before them. Each step is one line of what and why; the details live on the linked page. Everything here is universal — no particular token, chain, or protocol required.
Time: most of a day. Rushing is where mistakes happen. Steps 1–4 depend on one another and fit in the day; the rest can spill into the week.
Before You Start — What to Gather
Have these in hand (or ordered) before the day begins, so no step stalls on a missing part. Prices as of mid-2026 (hardware wallets and security keys rechecked 2026-09-23):
- A private email that exists only for crypto — made first, so the hardware-wallet order and every crypto account use it, and vendors know a persona, not a person (why).
- A hardware wallet — bought new, direct from the manufacturer ($59–249); a marketplace or second-hand unit can arrive pre-seeded, with the seller keeping the phrase. Which one and why: the Wallets guide. A pickup point keeps a home address off the shipping record; the reasoning, including the 2020 vendor breach that turned a customer list into home addresses, is in Physical Security & OPSEC.
- A metal seed backup — one plate or capsule ($45–120), or a DIY steel plate with letter stamps ($10–25). Options compared on the Seed Phrase page.
- Two hardware security keys ($29–58 each) — for logins, not the wallet; two because a lone key’s main guarantee is lockout. What they protect: Two-Factor Authentication. Optional but strongly recommended.
- Pen and paper — for the disk-encryption recovery keys; kept on paper with your physical backups, a recovery key stays off the machine it unlocks.
- The computer you’ll dedicate to crypto (or your everyday one, to harden).
- Your phone — it’ll carry the authenticator app.
- Two storage places decided in advance — where the metal backup lives, and a second location, so seed and hardware wallet are never stealable in the same sixty seconds.
The Order
- Orient — 15 minutes of reading, no transactions. Skim the Security Guide’s numbered cards, ranked by risk with the highest first, so you know why each step below exists. Security you understand survives; rituals don’t.
- Harden the machine — about an hour. Everything else happens on this computer, so it comes first: the Mac setup guide or the Windows setup guide, top to bottom. Recovery keys go on paper.
- Set up the hardware wallet — the careful hour. Unbox and verify it, generate the seed on the device, stamp the seed into metal, add a passphrase if the wallet will use one, then do the practice restore: note the first receiving address, wipe the device, restore from the metal, enter the passphrase if there is one, and confirm the same address appears. The wallet still holds nothing at this point. Kept in the same metal or the same place as the seed backup, the passphrase opens the hidden wallet for whoever finds both. Forgotten, it takes the hidden wallet with it: the seed alone brings back only the standard wallet (the passphrase, found or forgotten). The step-by-step for both backup standards and the passphrase: the backup guide; the reasoning: Seed Phrase security and the Wallets guide. This is the step where the money actually becomes safe — take it slowest.
- Place the backups. Metal backup to its home, hardware wallet to a different one — the split-location rule from Physical Security & OPSEC. Kept apart, one fire, flood or burglary cannot take the hardware wallet and its only backup together. The seed metal on its own still opens the standard wallet for whoever finds it, and a passphrase found with it opens the hidden wallet as well.
- Lock the browsers down. Two browsers, two jobs: Brave signs (one wallet extension plus Bitwarden, bookmarks only), and hardened Firefox with arkenfox does all the reading. The setup is in the Browsers guide.
- Build the account perimeter — about an hour. In this order: a password manager (the crypto email’s password goes into it), then 2FA on the four accounts that matter, the crypto email among them (register both security keys where the account takes them and the authenticator app where it doesn’t, or if you skipped the keys; remove SMS wherever the account allows it; set the carrier port-freeze PIN), then move any exchange or on-ramp account still on your identity email over to the crypto email.
- Learn the ten-second habits — 20 minutes of reading. Transaction & signing hygiene and social engineering: the attacks that beat hardware, and the habits that beat them back.
- Read the runbook once, now. If you think you’re compromised is written for a bad hour — read it before that hour, so the order of moves is already in your head.
- Do one small practice run. Open a second account in the passphrase wallet from Step 3, a practice account, so the address you hold on only ever receives (Quantum Security). Send the practice account a small test amount of the network’s own coin (PLS on PulseChain, ETH on Ethereum; that coin pays the fee on every send) from an exchange or another wallet, with the same network picked on the sending side. Confirm it arrived in the wallet app the hardware wallet is connected to; on PulseChain that is a wallet such as Internet Money Wallet or MetaMask with the device connected, since Trezor Suite does not list PulseChain. Then lock the device, reopen the passphrase wallet from cold, and send from the practice account once, approving on the device screen.
- Homework for the week: the estate plan. Crypto Inheritance — the letter-of-instruction pattern takes an evening, and it’s the one step nobody can do later.
When You’re Done
You’ll have covered machines, money, logins, habits, the bad day, and the day after you’re gone — every base the Security Guide ranks, in an order where each step protected the next. Revisit yearly; the inheritance guide pairs the review with tax season.
Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the link stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.