You set your wallet up properly. Backups in two places, an access code you remember, two-factor on the exchange. Good.
That was eighteen months ago. Since then your holdings have tripled, you’ve moved house, and you couldn’t say with certainty where the second backup card ended up.
Long-Term Crypto Security Plan
That’s the gap a long-term crypto security plan closes. Not another checklist a way of revisiting the one you already have, because the setup that suited a small holding in a one-bedroom flat isn’t the setup that suits what you own now.
The short answer
A long-term plan has three parts: a setup matched to what you actually hold, a review cadence so it doesn’t drift, and a list of life events that should trigger a review regardless of the calendar.
Most people do the setup once and never revisit it. That’s where the risk accumulates.
Why “set it up once” stops working
Your security setup is a snapshot of a moment. Everything around it keeps moving.
Your holdings change
The arrangement that suited $2,000 is not the arrangement for $50,000. Two backup cards in the same suburb is a reasonable trade-off for a small holding and a poor one for a life-changing sum.
Nobody consciously decides to under-protect a larger holding. It happens because the holding grew and the setup didn’t.
Your circumstances change
You move house. You separate, or move in with someone. A backup card lives with a family member you’ve since fallen out with. You change email providers and the recovery address on your exchange account is one you no longer read.
Each of these silently changes your security position, and none of them announces itself.
Your memory changes
The access code you set two years ago and haven’t typed since is not as retrievable as you assume. The “obvious” hiding place for a backup is only obvious while you remember choosing it.
The world changes
Exchanges fail or exit markets. Two-factor methods that were adequate become weak. Devices get discontinued.
Match the setup to what you hold
The single most useful thing in a long-term plan: a rule that says what setup applies at what level, so growth triggers a change rather than sneaking past.
Set your own thresholds — these are a starting point, not a prescription.
| Holding | Storage | Backups | Additional |
|---|---|---|---|
| Small — you’d shrug it off | Reputable exchange, app-based 2FA | N/A | Nothing more needed |
| Meaningful — a bad month if lost | Hardware wallet | 2 devices, separate buildings | Access code you’ll recall |
| Significant — a bad year | Hardware wallet | 3 devices, one off-site | Inheritance plan documented |
| Life-changing | Hardware wallet, possibly split across wallets | 3 devices, one in professional custody | Legal and inheritance advice |
The thresholds are personal. What matters is having them written down, so that crossing one prompts a decision instead of passing unnoticed.
Our guide to wallet versus exchange storage covers where the first threshold sits in more detail.
The life events that should trigger a review
Calendar reviews catch drift. Life events catch the sudden changes, and they matter more.
Review your setup whenever:
- You move house — where did the backups go, and are they still separated?
- Your holdings cross a threshold you set above
- A relationship changes — someone who held a backup, or knew your code
- Someone in your plan dies or becomes unwell: an executor, a family member holding a card
- You change email providers: recovery addresses on every exchange account
- You change phone numbers: 2FA and account recovery paths
- An exchange you use has problems: withdrawal delays, ownership changes
- You lose a device, even temporarily
- You update your will
The house move is the one that catches people. Backups deliberately stored in separate places get boxed together, moved together, and unpacked into the same drawer.
Set a review cadence
Twice a year is enough for most people, and it takes about twenty minutes.
The twice-yearly review
- Check your holdings against your thresholds. Has anything crossed a line?
- Locate every backup device. Physically. Not “I’m fairly sure it’s at Mum’s.”
- Test one of them. Tap a card, confirm it opens the wallet.
- Review token approvals and revoke anything you no longer use.
- Check your 2FA is app-based everywhere, and that you still have backup codes.
- Confirm your recovery email and phone are current on every exchange account.
- Re-read your own notes — do they still make sense to you?
Our security checklist covers each item properly. The plan’s job is to make sure you actually work through it twice a year rather than once, ever.
Write it down
The plan only works if it exists outside your head. A single document listing:
- What you hold and roughly where
- Where each backup device is
- Who else knows anything, and what
- When you last reviewed it
Keep no access codes or seed phrases in it. This is a map of your arrangements, not a key to them. Stored badly it’s a liability; stored sensibly it’s what makes everything else survivable.
Planning for what happens without you
The part almost nobody does, and the one where the loss is total.
If something happens to you tomorrow, does anyone know the wallet exists, where the cards are, or what to do with them? For most people the honest answer is no and that means the crypto is simply gone.
What your executor actually needs
- That it exists. Nothing else matters if nobody knows to look.
- Where the device is. A card with an executor, a lawyer, or a named safe deposit box.
- How to use it. Basic instructions: install the app, tap the card.
- The access code, held separately from the device and released appropriately.
The tension to resolve
Anyone who has both the card and the code has full access while you’re alive. Anyone who has only one has nothing when you’re gone.
Common approaches: card with a family member and code with a lawyer, or instructions sealed with your will. There’s no single right answer but leaving it unaddressed is the one clearly wrong option.
This is a conversation to have with a lawyer, particularly around how digital assets are described in a will. Our comparison of the 2-card and 3-card sets covers why a third device makes this practical.
The New Zealand specifics worth building in
No deposit guarantee. Crypto exchanges here aren’t regulated like banks and there’s no scheme covering your holdings. That’s a permanent feature of your risk picture, not a temporary one.
Offshore platforms mean offshore law. Where an exchange is incorporated determines whose insolvency process governs your balance. Worth knowing which of yours are which, and worth re-checking when platforms change ownership.
Keep records for tax. Dates, amounts, transaction hashes, NZD values. Moving between your own wallets generally isn’t a disposal, but selling is, and Inland Revenue expects you to show your cost base. Reconstructing years later is miserable.
Natural events are a real backup consideration. Earthquakes, flooding and storms displace whole suburbs here, not single houses. Two backups three streets apart is one event from zero.
What a plan looks like in practice
A worked example. Someone holding a meaningful but not life-changing amount:
- Trading balance on a reputable exchange, app-based 2FA, small enough to lose without damage
- The bulk in a hardware wallet, three devices
- Card one at home, in use
- Card two at a family member’s house in another city
- Card three with their lawyer, referenced in their will
- Access code memorable, not written on any device, with instructions sealed alongside the will
- A one-page document listing what exists and where, no codes
- Diary reminders in March and September
- Written thresholds for when to upgrade the arrangement
That’s not elaborate. It’s an afternoon to set up and twenty minutes twice a year to maintain and it addresses the failure modes that actually happen.
FAQs
How often should I review my crypto security?
Twice a year is enough for most people, plus a review whenever a life event occurs moving house, a relationship change, crossing a holdings threshold, or changing email or phone provider.
What should be in a crypto security plan?
What you hold and where, where each backup device is, who else knows anything, your review dates, and thresholds for when to upgrade your arrangements. Never access codes or recovery phrases.
Do I need a plan for a small holding?
Not an elaborate one. But writing down your thresholds is worth doing early, because it’s growth that catches people out the setup stays still while the holding doesn’t.
What happens to my crypto if I die?
Nothing automatic. If nobody knows the wallet exists or how to reach it, the funds stay where they are permanently. A backup device with an executor or lawyer, referenced in your will, is the practical solution.
Should I tell my family I own crypto?
Someone needs to know it exists, or it’s lost when you are. How much detail you share, and who holds what, is the decision but “nobody knows” is not a plan.
Are crypto exchanges regulated in New Zealand?
Not in the way banks are, and there’s no deposit guarantee covering crypto holdings. Consumer law and the exchange’s own terms are what you have. Build that into your thinking rather than assuming protection exists.
What’s the most commonly missed item?
Testing backups. People set them up, never verify them, and discover at the worst possible moment that something doesn’t work. Tapping one card twice a year takes thirty seconds.
