The US Crypto Safety & Tax Checklist (2026–27)

1. Store

• Know what's on an exchange and what's in a wallet you control.
• Rule of thumb: what you trade stays on the exchange, what you hold long-term goes to a wallet you control.
• Buy a hardware wallet only from the official store, never from marketplace resellers. Trezor · Ledger
• Write your recovery phrase on paper or metal. Never photograph it, never type it into a website.
• No one, not support, not a "recovery service", not a Discord mod, ever needs your phrase.
• Send a small test amount and practice a restore before moving everything.

2. Buy

• The exchange is licensed to operate in your state.
• You understand the fees (spread vs maker/taker). Compare the total on a $500 buy. Kraken · Coinbase
• App-based 2FA or a passkey is on. SMS 2FA is off.
• Withdrawal address allowlist is on.
• You never "invest" through someone who contacted you first.

3. File

• Every sale, swap and purchase made with crypto can be a taxable event, not just cashing out.
• US brokers report your crypto sales to the IRS on Form 1099-DA: gross proceeds from 2025 sales; from 2026 sales also cost basis, but only for coins bought after 2025 and kept on the same exchange.
• Coins you moved in from another wallet, or bought before 2026, show no basis on the form. You need your own records.
• Self-custody wallets don't send a 1099-DA, but those sales are still taxable.
• Export your full history from every exchange and wallet before year-end, and use a crypto tax tool or a CPA. CoinLedger · Koinly
• Put April 15 in your calendar.

Bonus: scam red flags

• Guaranteed returns, or "send X and get 2X back".
• Urgency: "only today", "your account will be closed".
• "Support" that messages you first.
• Address poisoning: a look-alike address in your history. Always copy from your own saved contacts.
• A website asking you to "approve" or "sign" to claim something.
• A "recovery service" that promises to get stolen funds back for a fee.

Tax sources: IRS, Instructions for Form 1099-DA.