UK investor protection desk
Your crypto is only as safe as the platform and wallet you use. The Duke Crypto tracks custody failures, exchange security, scam patterns and the limits of UK protection.
For information only. Crypto assets can fall sharply in value.
Security starts before the deposit
Check who holds the keys, how withdrawals work and what happens when a platform fails.
Protection limit: crypto investments are not protected by the Financial Services Compensation Scheme (FSCS). Check the provider's status and terms before sending funds.
01 / Platform review
A registered business can still have weak controls. Work through the evidence, then decide how much counterparty risk you can accept.
Evidence beats reputation.
Five questions
Tick each item only when you have checked the provider's written evidence. Five checks indicate a lower operational concern, though no exchange is risk-free.
02 / Cryptocurrency custody
Control of the private key changes the failure you need to plan for. Choose a custody model deliberately.
The seed phrase is the master key.
Write it by hand, keep it offline and never give it to a support agent or website.
The provider manages keys and transaction signing. This is practical for active trading, yet withdrawals depend on its systems, solvency and account controls.
Small trading balances and regular transactions.
Account freezes, insolvency, hacks or poor internal access controls.
A hot wallet gives you the keys while remaining connected to the internet. Use a separate device profile, verify addresses and keep only an amount you can monitor closely.
Small payments and applications you use often.
Malware, phishing and a copied seed phrase.
A hardware wallet keeps signing away from a continuously connected computer. Buy from an authorised UK retailer, initialise it yourself and test recovery with a small amount.
Longer-term holdings that do not need daily access.
Lost recovery words, fake devices or unsafe backups.
Keep two written copies in separate secure places.
Confirm every address on the device screen.
Never photograph or store the phrase in cloud notes.
Never approve a surprise wallet connection.
03 / Scam watch
A convincing logo is not proof of a genuine service. Check the URL, slow down the payment and report suspicious contact.
A message claims your wallet needs an urgent security check, then copies the seed phrase entered into a lookalike page.
Unexpected urgency, a shortened URL and requests for recovery words. Type the official address yourself and contact the provider through its published channel.
A social media profile copies an exchange's name and offers to fix a withdrawal problem after you send an upfront payment.
Private messages, a request for remote access and a promise that payment will release your funds. Genuine support will not ask for your seed phrase.
A private chat shows fabricated account statements and asks for a larger payment to release supposed profits.
Guaranteed returns, countdowns and a fee before withdrawal. Report suspected fraud to Action Fraud and keep every message, receipt and wallet address.
If money has moved: contact your bank immediately, preserve evidence and report the incident.
Send a report04 / Complaints and protection
FOS jurisdiction depends on the firm, activity and complaint route. Crypto itself does not gain FSCS protection because a complaint is raised.
Start with the regulated firm.
Keep the final response, account records and a clear timeline before contacting an ombudsman.
Step 1 / Provider complaint
Set out what happened, when it happened and the remedy you want. Attach evidence without sending private keys.
Step 2 / Final response
A final response should explain the decision and the next complaint route. Read the scope carefully; service complaints and asset price losses are different issues.
Step 3 / Independent review
FOS may consider complaints about eligible financial businesses and activities. Confirm current jurisdiction directly before relying on a protection route.
Protection boundary
FSCS protection does not cover ordinary crypto investment losses. A platform’s marketing language cannot change that limit.
05 / Incident analysis
Large losses rarely come from one dramatic flaw. Access controls, hot-wallet exposure and slow detection often compound each other.
2014 / Mt. Gox
Long-running operational failures hid missing bitcoin and delayed a clear response.
Key lesson: independent balances and withdrawal controls need regular review.
2016 / Bitfinex
A compromised access model allowed a large transaction to leave a hot wallet.
Key lesson: multi-signature design is only useful when keys and approvals are separated.
Recurring pattern
A single operational wallet can turn one stolen credential into a platform-wide event.
Key lesson: limit balances, separate duties and publish a credible incident process.
Diversify accessAvoid placing every holding with one counterparty.
Set withdrawal limitsUse account controls before an incident starts.
Read exclusionsInsurance terms can exclude cyber events or user error.
06 / Action plan
Move quickly, keep evidence intact and tell the right organisation. Small details can connect a wallet address to a wider case.
Report suspected fraud in England, Wales and Northern Ireland.
Check warnings and learn how investment scams present themselves.
Tell The Duke Crypto about a suspicious platform or security incident.
We send incident notes and practical checks when the facts are clear.
Make the next decision with evidence
Use the checklist, protect your seed phrase and keep a clear record of every provider promise.