The six habits that protect a crypto holder most are: keep the position small enough to survive a 70–80% fall, know what dollar-cost averaging does and does not do, check a project before you buy, control who holds your keys, learn the patterns scams follow, and keep records the tax authority can check. Two things changed recently. In December 2025 the US SEC published investor guidance on crypto custody. From January 1, 2026, US brokers must report cost basis on certain digital-asset sales to the IRS. Each section below is based on what regulators, the FBI and large asset managers have published.
Tip 1: Size the position for the worst case
Bitcoin has gone through "major selloffs of 70-80% from peak to bottom" on its way to record highs, according to the BlackRock Investment Institute's paper Sizing Bitcoin in Portfolios (December 11, 2024). Size the position for that kind of fall, not for the price you hope for.
What large asset managers have published
| Source | Date | Guidance |
|---|---|---|
| BlackRock Investment Institute | Dec 11, 2024 | 1–2% bitcoin is "a reasonable range" for a multi-asset portfolio, if the investor expects wider adoption and can bear sharp falls |
| Morgan Stanley Global Investment Committee | Reported Oct 2025 | Up to 4% for opportunistic growth portfolios, 3% for market growth, 2% for balanced growth, 0% for wealth-preservation or income portfolios |
BlackRock explains its cap in terms of risk, not return. In a hypothetical 60/40 portfolio, a 1% bitcoin allocation accounted for about 2% of total portfolio risk. A 2% allocation accounted for about 5%, and a 4% allocation for about 14%. For comparison, an average "Magnificent 7" stock accounted for about 4%. A small allocation can carry a large share of a portfolio's swings.
These are model-portfolio frameworks from two firms, not personal advice. Before you set any figure, write down your emergency fund, your near-term bills and your planned goals. Anything you invest in crypto should come from money that is left after those.
Tip 2: Know what dollar-cost averaging actually does
Dollar-cost averaging (DCA) means investing a fixed amount at set intervals. A common belief is that DCA earns more than investing a lump sum. Vanguard's research says otherwise. Its February 2023 paper Cost averaging: Invest now or temporarily hold your cash? found that investing a lump sum at once beat common cost-averaging strategies about two-thirds of the time. Measured over one year on MSCI World Index returns from 1976 to 2022, the lump sum came out ahead in 68% of periods. Vanguard also found that cost averaging beat holding cash about 69% of the time.
So DCA is a tool for managing behaviour, not a way to earn more. It suits someone who would otherwise keep the money in cash out of fear of buying at the top, and it limits regret if the price falls right after a purchase. Vanguard's study covers broad equity markets, not crypto. No study of the same standard was found for crypto.
Tip 3: Check a project before you buy
The FTC's consumer guidance gives the clearest warning signs: "Only scammers will guarantee profits or big returns," and "Scammers make big claims without details or explanations." Questions worth answering before you buy:
- What does it do? If you can't explain in one sentence what the token is for, after reading its documentation, you don't understand the risk.
- Who controls supply? Find out whether supply is capped or inflationary, how much insiders hold, and when locked tokens unlock.
- Who is behind it? Check whether the team is identifiable, whether the code is public, and whether past roadmap promises were delivered.
- Has the code been audited? An audit does not guarantee safety. A project with no audit is a red flag.
- Where did you hear about it? The FTC says: "Never mix online dating and investment advice." A new online contact who offers to help you invest in crypto fits a known scam pattern.
Tip 4: Decide who holds your keys
The SEC's Office of Investor Education and Assistance published Crypto Asset Custody Basics for Retail Investors in December 2025. Its main points:
- A wallet holds a private key that authorises transactions. If the key is lost, it cannot be replaced, and neither can access to the assets.
- A seed phrase (recovery phrase) can rebuild the wallet. Anyone who has it can take control of the funds, so store it securely and never share it.
- Hot wallets are connected to the internet: convenient, but exposed to hacking. Cold wallets are offline: generally safer from hacking, but they can be lost, damaged or stolen.
- With third-party custody, the custodian may rehypothecate assets (lend them out as collateral) or commingle them with other customers' assets. In the SEC's words: "If the third-party custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets."
Custodian risk is real. On or about February 21, 2025, about $1.5 billion in virtual assets was stolen from a centralised exchange. In a public service announcement on February 26, 2025, the FBI attributed the theft to North Korea and named the activity "TraderTraitor."
Practical steps that follow from this:
- Hold on a platform only what you are actively using.
- Turn on two-factor authentication.
- Keep the seed phrase offline.
- Treat anyone who asks for it as a thief. That includes anyone claiming to be support staff.
What does the Form 1040 crypto question mean for you?
Answer a few questions about what you did with crypto this year to see how the IRS treats it and what record you need.
This year, did you sell or otherwise dispose of crypto you held as an investment?
- Yes → next question
- No → next question
Did you make those sales through a US broker?
- Yes, a US broker → Capital gain or loss: answer Yes
- No, a foreign broker or no broker → Capital gain or loss, possibly with no form: answer Yes
Did you receive crypto as payment, or as mining or staking income?
- Yes → Ordinary income: answer Yes
- No → next question
Was all your activity buying crypto with cash, holding it, or moving it between your own wallets?
- Yes → Answer No
- No, I did something else → Check the IRS guidance for your case
The IRS treats digital assets as property, so each sale produces a capital gain or loss. US brokers report gross proceeds on Form 1099-DA for transactions from January 1, 2025, and also cost basis for certain sales from January 1, 2026. Keep your own record of the date, amount, price and fees for each trade so you can show what you paid. If you also received crypto as payment or staking income, that part is ordinary income.
Each sale still produces a capital gain or loss. The 2025 reporting requirement generally applies to US brokers, so a customer of a foreign broker may receive no Form 1099-DA. The IRS says you must report all income, gains and losses whether or not you receive one, so your own record of date, amount, price and fees is what shows your cost basis.
Crypto received as payment, or as mining or staking income, is ordinary income for US tax purposes. Record the date, amount and price when you received it; if you later sell it, that sale is a disposal with its own gain or loss.
If you only bought crypto with cash, held it, or moved it between your own wallets, the IRS says you answer No to the digital-asset question on Form 1040. Keep your purchase records: without a cost-basis record you can't show what you paid when you sell later.
This tool covers only the cases the article describes: sales, income received in crypto, and buying, holding or moving between your own wallets. For anything else, check the IRS digital-asset pages or ask a tax professional before answering.
This covers only the US federal treatment the article describes from IRS guidance: it does not calculate tax owed, cover state or non-US rules, or replace advice from a tax professional.
Tip 5: Learn the patterns scams follow
According to the FTC, "Only scammers demand payment in cryptocurrency." Government agencies and legitimate businesses don't demand crypto by email, text or social media. Speed matters because "cryptocurrency payments typically are not reversible." Once you pay, you can usually get the money back only if the person you paid sends it back. Patterns the FTC lists:
- Someone posing as a government agency who demands that a fine be paid in crypto
- An online romantic contact who asks for crypto or offers to manage your investments
- A job offer that requires an upfront fee
- An unexpected link in a text, email or social media message
Tip 6: Keep records the tax authority can check
For US tax purposes, the IRS states that "digital assets are considered property, not currency." Selling or otherwise disposing of crypto held as an investment produces a capital gain or loss. Crypto received as payment, or as mining or staking income, is ordinary income. Every Form 1040 asks whether you received or disposed of a digital asset during the year. If you only bought crypto with cash, held it, or moved it between your own wallets, you answer No.
Broker reporting is being phased in:
- Transactions from January 1, 2025: US brokers report gross proceeds on Form 1099-DA.
- Transactions from January 1, 2026: brokers also report cost basis for certain sales.
- Foreign brokers: the 2025 requirement generally applies to US brokers, so a customer of a foreign broker may receive no form.
The IRS states that "whether or not you receive a Form 1099-DA, you must report all income, gains and losses from digital asset transactions." For each trade, record the date, amount, price and fees. Without a cost-basis record, you can't show what you paid.
Rebalancing: keep the size you chose
Prices drift, and an allocation that was 2% can grow well beyond that after a rally. Checking on a fixed schedule, such as quarterly, and trimming back to the target keeps the risk at the level you chose in Tip 1. If you are in the US, remember that each sale is a taxable disposal (Tip 6).
Frequently asked questions
How much of a portfolio do large firms put in crypto?
BlackRock calls 1–2% bitcoin "a reasonable range" for multi-asset portfolios. Morgan Stanley's Global Investment Committee was reported to cap crypto at 2–4% depending on the portfolio's risk profile, and at 0% for wealth-preservation and income portfolios.
Does dollar-cost averaging beat investing a lump sum?
Usually not on returns. In Vanguard's study of global equities from 1976 to 2022, the lump sum won 68% of one-year periods. DCA beat holding cash about 69% of the time and lowers the risk of regret.
Is it safe to leave crypto on a platform?
It carries custodian risk. The SEC warns that you may lose access if a custodian is hacked, shuts down or goes bankrupt, and the FBI linked a roughly $1.5 billion theft from an exchange in February 2025 to North Korea.
What does DYOR mean?
"Do your own research": read the project's documentation, check token supply and insider holdings, check whether the team can be identified and whether the code has been audited, and ignore promises of guaranteed returns.
Limitations: the regulatory and tax points come from US agencies (SEC, IRS, FTC, FBI), and the allocation figures are model guidance from two asset managers. Rules and suitability differ by country and by person. This article is not investment, tax or legal advice.
