The guide is a starting point. New, corroborated guidance appears here and alongside the chapters it affects.
Latest source review: 2 Nov 2026
2 Nov 2026 · SOURCE UPDATE
Verify messaging invitations and linked devices
CISA’s Mobile Communications Best Practice Guidance version 2, dated 24 November 2025, adds protections for private messaging apps. Do not scan group-invitation links or QR codes from unknown sources; verify an invitation with the group creator or administrator through a separate channel; treat unexpected in-app alerts that request a PIN or one-time code as suspicious; and review linked devices, keeping only those needed and removing unintended devices. End-to-end encryption still does not protect an account or endpoint that has been taken over.
Singapore Police said on 28 October 2026 that, since 10 September, at least two reported cases involving tampered Ledger hardware wallets purchased from some retail stores had caused about S$3.5 million in total losses. Preliminary investigations found malicious hardware components capable of capturing recovery phrases or private keys; police investigations remain ongoing and Ledger is reviewing the cases. If a device may be affected, do not enter a recovery phrase or conduct further transactions on it, and contact the provider through an independently verified official support channel. If a recovery phrase or private key may already be compromised, the police advisory says to consider moving remaining assets using an uncompromised device to a new trusted wallet with a newly generated recovery phrase. These are preliminary findings concerning reported devices, not evidence that all retail hardware wallets are affected.
Case update: suspect arrested in Spain under French warrant
On 20 March 2026, Spain's Guardia Civil said it detained in Benalmadena a person sought under a European Arrest Warrant issued by France in connection with the kidnapping and torture of a crypto-wallet company founder and his wife. This is an arrest- and warrant-stage development, not a conviction or final judicial determination. The original January 2025 case facts and stated limits remain unchanged.
Paris, Milan, London, Zurich, Geneva, Lisbon, Barcelona, Madrid and Vienna join the guide. This is the 28 October 2026 baseline, with 18 additional official sources. The guide has not yet received a full independent security-expert review.
Official-source changes can become dated updates. Ambiguous legal, medical, custody or physical-protection changes stay in the review queue. Community posts supply questions to investigate, not verified facts.