How to buy and store crypto safely

Why this chapter exists

Most people who lose crypto do not lose it to a broken blockchain. They lose it at the edges: a fake website, a leaked recovery phrase, a deposit sent without the required tag, an exchange that stops paying out. The network itself usually does exactly what it was told to do.

So the practical question is not "which coin", it is "how does the money get from my bank to a place only I control, and what can go wrong on the way". The usual route has three stops. Your Israeli bank sends shekels to an exchange (a company that matches buyers and sellers). You buy the coin there. Then you withdraw it to a cold wallet, a device that keeps your private key offline.

An exchange is like a currency-exchange counter that also keeps your balance in its safe. A cold wallet is like a safe at home that only you can open. The exchange is convenient for buying. The safe is better for keeping. Both are covered below, with the specific companies that passed our per-coin checks.

This page covers eight coins that the site profiles: XRP, Stellar (XLM), XDC, Algorand (ALGO), Hedera (HBAR), IOTA, Quant (QNT) and Cardano (ADA). For each coin's own pitfalls, see its page under /coins, for example XRP or Cardano. For click-by-click walkthroughs, see the step-by-step guides.

Choosing an exchange

Seven criteria matter. None of them alone is enough.

The criteria

1. Regulation and licensing. In Israel, brokers and custodians of virtual currencies fall under the Capital Market, Insurance and Savings Authority (רשות שוק ההון, ביטוח וחיסכון) under the Supervision of Financial Services law. According to Globes, the first licences were granted in September 2022: first to the infrastructure company HBH, then to Bits of Gold, which Globes contrasts with HBH as an active broker. ^[3][4][43] Those sources are law-firm and press summaries; we did not find an official gov.il register page in our research, so check the Authority's own list of licensed providers yourself. A foreign exchange with no Israeli licence may still serve Israelis, but then Israeli supervision does not protect you.
2. Accessibility to Israeli residents. An exchange may not be open to you. The evidence comes in three strengths: an explicit "available in Israel" statement, mere absence from a restricted-countries list, or nothing at all.
3. ILS deposit and withdrawal, and Israeli bank compatibility. Israeli banks treat crypto transfers as higher risk. In May 2022 the Supervisor of Banks amended Directive 411 so that crypto-related payment services are classed as high-risk and require stronger controls, and each bank must set a policy for such services. A bank may not refuse a payment service only because it relates to virtual currency when the provider is licensed in Israel, and it may decline unlicensed providers only on the basis of a well-founded risk assessment. The amendment came into force six months after publication, on 9 November 2022. ^[1][2] In practice, expect questions about source of funds (source of funds). An exchange that takes ILS directly can avoid a currency conversion step, but it does not remove the bank's questions.
4. Fees. Trading fee, deposit fee, withdrawal fee, and the spread between buy and sell price. Fees change often and differ by payment method, so read the exchange's own fee page on the day. We do not publish fee numbers here because they would be out of date quickly.
5. Proof of reserves. A claim, usually reviewed by a third party, that the exchange holds the customer assets it says it holds. It is a partial check, not a guarantee, because it says little about the exchange's debts.
6. Security track record, with dates. Has the exchange been hacked, frozen withdrawals, or gone bankrupt? See the failures below.
7. Per-coin support. Not every exchange lists every coin. This is the criterion that removed one well-known Israeli name from the table (see below).

Exchange failures worth knowing

Celsius paused withdrawals on 12 June 2022 and filed for Chapter 11 protection in New York on 13 July 2022. FTX filed for Chapter 11 in Delaware in November 2022. ^[5] In both cases customers who left assets on the platform became creditors in a bankruptcy rather than owners of coins they could withdraw. This is the core reason to understand custodial risk: while coins sit on an exchange, you hold a claim against the company, not the keys.

Verified profiles

The profiles below use only what the official pages and public APIs showed at the time of writing. "Available in Israel" is stated with the strength of its evidence.

Kraken. Supports XRP, XLM, XDC, ALGO, HBAR, QNT and ADA; IOTA is not listed. ^[6] Israel is not on Kraken's list of prohibited regions, which is an absence of a ban and not an explicit licence for Israeli residents. ^[7] Kraken's asset list shows no ILS among its fiat currencies, so a shekel deposit is not supported. ^[6] Its proof-of-reserves page describes a procedure by an independent third-party accountant with a snapshot dated 30 June 2026; the page does not name the firm or fix the schedule. ^[8]

Bybit. Supports XRP, XLM, XDC, ALGO, HBAR, QNT and ADA. Israel does not appear in Bybit's published list of restricted jurisdictions, again an absence and not an explicit licence. ^[9][10] ILS support was not verified.

OKX. Supports XRP, XLM, ALGO, HBAR, IOTA and ADA; XDC and QNT are not listed. OKX's app-availability page lists Israel among the countries and regions where OKX is available, which is the strongest direct statement we found for a global exchange. ^[11][12] ILS support was not verified.

Crypto.com. Supports XRP, XLM, ALGO, HBAR, QNT and ADA. Its help center lists Israel among the regions where Crypto.com Web is available. ^[13][14] ILS support was not verified.

Bits of Gold. An Israeli service. Its help center lists nine supported coins, of which two are in our set: XRP and ADA. It accepts ILS as the only fiat deposit currency. ^[15][16] One news report called it Israel's first crypto trading licence, but Globes reported in September 2022 that it was the second crypto licence, after HBH, and that unlike HBH (an infrastructure company) it is an active broker. We could not confirm its licence number on its own pages; check the regulator's list. ^[4][43]

Coinbase. Its asset list was confirmed from the public exchange API: XRP, XLM, ALGO, HBAR, QNT and ADA. ^[17] Israel availability and ILS deposits are unverified: Coinbase's help pages block automated access, so we could not read them. Check Coinbase's own country list before opening an account.

Bitstamp. The public API shows XRP, XLM, XDC, ALGO, HBAR, QNT and ADA pairs enabled. ^[18] We found no current official Bitstamp page confirming Israel availability, so it is unverified.

Coin support at a glance

Coin lists come from each venue's public API or official pages; a listed coin does not mean the exchange accepts Israeli customers.

Before you deposit anything, open the exchange's own sign-up flow and see whether it lets you verify an Israeli identity document. That single test beats any table, including this one. Also read the withdrawal page for the coin you want, because some coins cannot be withdrawn on every network.

Choosing a cold wallet

A hardware wallet is a small device that creates and stores your private key inside itself and signs transactions without ever exposing the key to your computer. Think of it as a pen that signs for you without letting anyone see the signature stamp. A software wallet runs on a phone or computer, which is more convenient and also more exposed to malware.

The criteria

1. Secure element. A tamper-resistant chip designed to protect secrets. Trezor states that the Safe 5 has an EAL6+ certified secure element; that is a vendor claim we did not see independently audited. ^[21] For the other wallets we did not verify secure-element details, so we do not claim them.
2. Open source. Open code lets outsiders inspect it. Trezor's firmware is public on GitHub. ^[22] Ledger's companion app is public (MIT) while its secure element is not open, so we mark it partial. ^[23] Keystone's firmware is public. ^[24] Tangem's Android app is public, which we mark partial. ^[25]
3. Per-coin support and the companion app. The wallet may hold a coin only through a specific app, or only through a third-party wallet. Support is not all-or-nothing.
4. Price. Shown as a range from the vendor's own product pages.
5. Recovery. What happens if you lose or break the device. Every reputable wallet uses a seed phrase. Some add optional extras (see Ledger Recover below).
6. Track record. Past incidents with dates, and how the vendor handled them.

Verified profiles

Ledger. Its own coin pages cover all eight coins. For seven of them the page directs you to the Ledger Wallet app, and for IOTA it shows MetaMask. For XDC it says support comes through third-party wallets without naming one, so we list no app for XDC. ^[26] Price from 69 USD on the vendor shop at the time of writing.

Track record: in 2020 Ledger's marketing and e-commerce database was accessed through an API key, exposing about one million email addresses, with a subset also including names, postal addresses, phone numbers and orders. Ledger said payment data, passwords and funds were not affected, ^[27] In December 2020 data from that breach was posted on a hacker forum, reportedly including names, postal addresses and phone numbers of about 272,000 device buyers. ^[44] In January 2026 Ledger alerted customers to a separate incident at Global-e, a commerce provider that handled purchases on Ledger.com; customer names and contact details were involved, Ledger said no payment data was affected, and that its own platform and devices were not breached. ^[45] The practical lesson is that customer contact details can leak, so treat unexpected emails that mention your order with suspicion. In 2023 Ledger announced Ledger Recover, an optional paid service from Coincover that splits an encrypted copy of your key into fragments held by three parties, any two of which can rebuild it. ^[28] The announcement caused a backlash, and Ledger's CEO responded on 23 May 2023 by saying the service would be optional and promising more open-sourcing. ^[29] It is a trade-off, not a verdict: some people value a recovery backup, others do not want any copy of the key to exist outside their hands.

Trezor. Supports XRP, XLM, QNT and ADA through Trezor Suite. XDC and IOTA work only through third-party wallet apps that Trezor does not name. Trezor does not support Algorand (ALGO) or Hedera (HBAR): its own coin pages for both say so. ^[30][31] One caveat: a Trezor page on supported coins says Stellar needs third-party apps, while its XLM page says Trezor Suite; confirm on the day. Price range 59 to 249 USD on the vendor's product pages. Fully open-source firmware. ^[22]

Track record: on 17 January 2024 Trezor reported unauthorised access to a third-party support ticketing portal, affecting people who had contacted support since December 2021, up to 66,000 contacts, for whom names or usernames and email addresses may have been exposed. It said no funds were compromised. ^[32][47] Press later reported attackers abusing Trezor's support contact form so that phishing emails arrived from the genuine help address; Trezor said its own systems and user data were not accessed. ^[33] In August 2026 Trezor disclosed a further incident at its shipping provider ShipMonk, which exposed customer names, shipping addresses, email addresses and phone numbers; the affected count was later raised from nearly 14,000 to about 81,000, according to BleepingComputer, and Trezor said its own systems and devices were not compromised. ^[46]

Keystone. Its firmware changelog names companion apps for four of our coins: XRP and ADA via Keystone Nexus, IOTA via Nightly Wallet, and XLM via xBull Wallet. Algorand, Hedera, Quant and XDC appear only on a generic asset list without a companion app or changelog entry, so we do not count them as verified. ^[34] Price from 149 USD. Firmware is public; we did not verify a secure element.

Tangem. A card-style hardware wallet. Its help center lists XRP, XLM, XDC, ALGO, HBAR and ADA, with Hedera available only for Tangem hardware wallets and not its mobile wallet. IOTA and Quant were not found. ^[35] Price from 59.9 USD, the lowest listed product, not matched to a particular set.

Coin support at a glance

Where a coin needs a third-party app, the table says so; check that app's own reputation separately.

Summary of the gaps: no single wallet here is a clean answer for all eight coins. Ledger covers all eight, with XDC and IOTA going through other software. Trezor lacks ALGO and HBAR. Keystone and Tangem each cover only part of the set. If you hold coins across several networks, you may need more than one device.

Security deep dive

The seed phrase is the account

Your seed phrase (usually 12 or 24 words) is a master backup for all your keys. Anyone who sees it can empty your wallet from anywhere, and no company can reverse that. Treat it as the wallet itself, not as a password.

• Write it on paper or metal, offline. Do not photograph it, store it in a notes app, email it, or type it into a website.
• Neither Ledger nor Trezor will ever ask you to type your recovery phrase into a website or app; a request to do so is a scam. ^[36][37]
• An optional passphrase adds an extra word that creates a separate hidden wallet. It adds protection and also adds a new way to lose everything if you forget it.

Buy only from the official store

Buy the device from the maker's own shop or a reseller the maker lists. A pre-owned or marketplace device may have been tampered with, or may arrive with a "recovery card" already filled in. Check the packaging, initialise the device yourself, and write down the seed phrase that the device shows you. Never use one that came with words pre-written.

Phishing and fake apps

Phishing means being tricked into giving away secrets on a fake page. Typical forms: an email about a "security incident" with a link, a paid search ad for a fake wallet site, a fake wallet app in a store, a direct message offering "support". Trezor and Ledger both publish lists of these patterns. ^[36][37]

Habits that help: type or bookmark the address of the exchange yourself; never follow links from emails; install wallet software only from the vendor's own links; and treat any message that creates urgency as suspicious.

Two-factor authentication

Turn on 2FA everywhere, using an authenticator app or a hardware security key and not SMS. A text message can be diverted if someone takes over your phone number, and that is a common route into exchange accounts. Use a unique password in a password manager. Enable the exchange's anti-phishing code if it offers one.

Address whitelisting and the test transaction

Most exchanges offer address whitelisting: withdrawals can only go to addresses you saved earlier, often with a delay before a new address becomes active. That delay is useful because a thief who gets into your account cannot instantly send funds to a new address.

Before the first big transfer to a new address, send a small test transaction, wait for it to arrive, and only then send the rest. A few cents of fees is cheap insurance.

Verify on the device screen

Malware can change the address you see on your computer screen. The wallet's own screen is the one place it cannot easily change. When you receive, display the address on the device and compare it character by character with what the computer shows. When you send, read the recipient and amount on the device before you confirm.

Memo and destination tag pitfalls

Some networks use one shared exchange address for many customers, and a second field tells the exchange which customer to credit. If you leave it out, the funds can arrive but not be credited to you. Always read the exchange's deposit page for the coin. This is the single most common avoidable loss for the coins in this set. See also memo and destination tag and network selection in the glossary.

• XRP (XRP Ledger). A destination tag is a 32-bit number attached to a payment. The XRP Ledger documentation says it indicates the beneficiary of the payment, and that receiving a payment without a required tag is a problem because it is not obvious which customer to credit and may need manual intervention. A recipient account can also be set to reject payments that lack a tag. ^[38] If an exchange shows a tag, you must enter it.
• Stellar (XLM). Stellar transactions have an optional memo field for extra identifying information. Stellar's docs say memos used to be how people told apart individual accounts in a pooled account, a job that muxed accounts now handle. ^[39] Exchanges that still use pooled deposit addresses typically ask for the memo. The exchange's page decides, not Stellar's.
• Hedera (HBAR). A Hedera transaction has an optional memo, limited to 100 bytes of UTF-8 and visible to everyone on the network. ^[40] We found no Hedera document saying exchanges require it, so rely on the exchange's own deposit instructions, and never put private information in a memo.

For IOTA, Cardano, Algorand, XDC and Quant, the same rule holds: read the deposit page for a memo or network note and obey it. Network selection also matters for tokens that exist on several chains; Quant's QNT, for example, is a token, so choose the network that the receiving address supports.

Exchange risk

Coins on an exchange are a claim on the company. After the 2022 failures above, treat an exchange as a place to trade, not as long-term storage. Keep only what you are actively using there. A proof-of-reserves page is a useful sign but not a guarantee: Kraken's, for example, describes a review by an unnamed independent accountant at a snapshot date. ^[8] We did not verify equivalent pages for the other exchanges, so we make no claim about them.

Inheritance basics

If you are the only person who knows where the seed phrase is, your family cannot recover anything if something happens to you. Inheritance planning means writing where the backups are, who can open them, and what to do, without putting the seed phrase itself in a document that is easy to find. A lawyer (עורך דין) can help you design a will that fits. Test your plan occasionally.

Common scams, including address poisoning

• Address poisoning. A scammer sends a tiny amount from an address whose first and last characters look like one you used before, hoping you later copy it from your history. Ledger and Trezor both warn about this and advise not to rely on the first and last few characters. Ledger notes that it does not compromise your keys or seed phrase, but a payment to the wrong address is gone. ^[41][42] Always paste from a saved address book or whitelist, and verify the full address.
• Fake support. Real support never asks for your seed phrase and never asks you to install remote-control software.
• Fake "recovery" services that promise to retrieve lost coins for a fee.
• Giveaways, "double your coins" offers and romance or investment chats that move you to an unfamiliar app.
• Unsolicited tokens or NFTs in your wallet with a link to "claim" something.

Official lists from the wallet makers go further; keep them handy. ^[36][37]

Israeli taxation in brief

Buying and holding is not itself a tax event in Israel, but selling, swapping one coin for another or spending coins generally is, and your bank may ask for records. The full treatment is in the tax guide. Keep a record of every purchase, transfer and sale: date, amount, price in ILS, and fees. Exchange statements may disappear if the exchange does, so download them regularly.

Next steps

• Read the step-by-step guides for the hands-on setup: exchange sign-up, ILS transfers, wallet setup and your first transfer to cold storage.
• Open the page of the coin you are researching under /coins, for its specific pitfalls.
• Read the tax guide before your first sale.
• Revisit this page when you change exchange or wallet: availability and support change.

Sources