How to Protect Privacy in Crypto Apps on Your Phone (2026 Guide)

To protect crypto apps on a phone, put them in a locked, separate space: Private space on Android 15 or later, or a locked and hidden app on iOS 18 or later. Never keep a recovery phrase as a screenshot or photo. Replace SMS codes with a hardware security key or passkey, and add a PIN to your mobile carrier account. Check the full address before every transfer. Keep only small amounts in a phone wallet. Each step below covers a known attack, and the sources are official documentation and incident reports.

What the threat looks like now

The numbers are useful because they show how people actually lose crypto.

• Theft from individuals is frequent, though each loss is smaller. Chainalysis (18 December 2025) counted more than $3.4 billion stolen from January to early December 2025. One exchange breach in February 2025 made up about $1.5 billion of that. The same report counted about 158,000 personal wallet compromises affecting at least 80,000 unique victims. The value taken from individuals fell to about $713 million, from roughly $1.5 billion in 2024.
• Malware goes after recovery-phrase screenshots. On 5 February 2025, Kaspersky's researchers described SparkCat. This malicious SDK was found in apps on both Google Play and Apple's App Store and had been active since at least March 2024. It used text recognition to search photo galleries for wallet recovery phrases and uploaded the matching images. The infected Google Play apps had been downloaded more than 242,000 times.
• Physical attacks are rising. Decrypt (6 August 2026) reported a Chainalysis count of 46 violent attacks on crypto holders through late June 2026, with more than $30 million stolen in the first half of the year. Home invasions made up 37% of documented incidents, up from 26% in 2023. Chainalysis says known cases likely understate the problem because many attacks go unreported. These figures come from news coverage of the report, not from the report itself.
• SIM swaps lead straight to crypto accounts. The FBI's IC3 (8 February 2022) received 1,611 SIM-swap complaints in 2021, with adjusted losses of more than $68 million. Its warning named virtual currency accounts as a target.

Step 1: Isolate wallet apps from the rest of the phone

Android: Private space (Android 15 and later)

Google's Android 15 documentation describes Private space as a separate user profile behind an extra lock. You can use the device lock or a separate one.

• Apps inside are separate copies. You install them fresh from an app store because existing apps cannot be moved in.
• Files, media and accounts stay apart from the main space.
• When the space is locked, its profile stops. Its apps are hidden from recents, notifications, settings and other apps, and they cannot run in the foreground or background.

Setup is under Settings > Security & privacy > Private space, though the menu path varies by phone maker. Using a separate Google account for the space keeps more data out of the main profile. For a wallet, choose a lock that is different from your screen lock, and set the space to lock every time the device locks.

Android: work profile tools

On older Android versions, a work profile gives similar separation. Google's developer documentation says the work and personal profiles use separate storage areas, and most intents do not cross between them by default. Shelter is a free, open-source app that creates a work profile, installs apps inside it and can "freeze" them so they cannot run when you are not using them. Its own README warns that Shelter "is only as safe as the Work Profile implementation of the Android OS you are using."

iPhone: locked and hidden apps (iOS 18 and later)

iOS has no separate app profile. Since iOS 18, Apple lets you lock an app with Face ID, Touch ID or the passcode, or hide it in a locked hidden apps folder. Apple says content from a locked or hidden app, such as messages or emails, is hidden from search, notifications and other places across the system. To set this up, long-press the app icon and choose Require Face ID (or Touch ID), then Hide and Require Face ID if you want it out of sight.

A correction to the earlier version of this guide: iOS has no "Private Space" setting. That name belongs to Android's feature.

Step 2: Close the clipboard and screenshot gaps

• Clipboard (Android). Since Android 10, an app cannot read the clipboard unless it is the default keyboard or the app in focus. On Android 12 and later, the system usually shows a notice when an app reads the clipboard ("APP pasted from your clipboard"). If you see that notice from an app you did not paste into, uninstall the app.
• Clipboard previews (Android 13 and later). Android 13 shows a preview of copied text. Apps that copy passwords or similar data should mark them as sensitive so the preview hides them. Not every wallet does this, so clear the clipboard after copying an address or key.
• Screenshots and photos. After SparkCat, Kaspersky's advice is direct: do not keep screenshots of recovery phrases or other secrets in your gallery. Write the phrase on paper or metal and keep it offline. If a phrase has ever been in your photos or cloud backup, treat it as exposed and move the funds to a new wallet.

Step 3: Lock down your phone number and logins

The FBI's SIM-swap guidance and CISA's mobile communications guidance (December 2024, revised 13 March 2026) agree on these steps:

• Stop using SMS as a second factor. CISA notes that SMS codes are not encrypted and can be intercepted by anyone with access to telecom infrastructure.
• Use phishing-resistant authentication. CISA puts hardware security keys first and accepts passkeys as an alternative. Once a key is enrolled, turn off weaker methods.
• Set a PIN or passcode on your mobile carrier account.
• Use a password manager and a different password for every account.
• Never give your carrier PIN or password to someone who calls you. Hang up and call the carrier's customer service line yourself.
• Do not post your holdings, phone number or home address publicly.
• Treat a sudden loss of mobile signal as a warning sign and contact your carrier immediately.

Step 4: Harden the device itself

• Stolen Device Protection (iPhone, iOS 17.3 and later). When the phone is away from familiar places, some actions need Face ID or Touch ID with no passcode fallback. Examples are using saved passwords, turning off Lost Mode and erasing the device. Changing your Apple Account password or device passcode also requires a one-hour security delay. It needs two-factor authentication, Find My and Significant Locations turned on. To enable it, go to Settings > Face ID & Passcode > Stolen Device Protection.
• Secure Enclave. On iPhone, the Secure Enclave is a separate security subsystem isolated from the main processor. When choosing a wallet, check whether it says it uses this hardware to store keys.
• Lockdown Mode (iOS 16 and later). Apple describes Lockdown Mode as extreme, optional protection for people who may be personally targeted by sophisticated attacks. It blocks most message attachments, some web technologies, and connections to accessories while the phone is locked. CISA recommends it for highly targeted people. Most users will not need it, but someone publicly known to hold large amounts of crypto may.
• Updates. Install operating-system updates promptly. Retire phones that no longer receive security updates.

Step 5: Check every address yourself

In address poisoning, an attacker sends a tiny transfer from an address that matches the start and end of an address you use. They hope you later copy that address from your transaction history. On 3 May 2024, on-chain security firm Cyvers flagged a victim who lost 1,155 Wrapped Bitcoin, worth about $68 million, in a single transfer, as reported by Cointelegraph. Cointelegraph later reported that the attacker returned most of the value after negotiations.

To protect yourself:

• Never copy a recipient from your transaction history.
• Save trusted recipients in the wallet's address book.
• Compare the whole address, not just the first and last few characters.
• For large amounts, send a small test transfer first and confirm it arrived.

Step 6: Keep small amounts on the phone and plan for coercion

Keep only spending money in a phone wallet. Larger holdings belong in a hardware wallet or a multi-signature setup, where one stolen device or one coerced person cannot move everything. Physical attackers often find victims through data leaks and social media, so keep wallet apps off your home screen, turn off lock-screen notifications for them, and use a separate email address for crypto accounts.

If you think you are compromised

1. Move the remaining funds to a new wallet with a new recovery phrase, created on a device you trust.
2. If your phone suddenly has no service, call your carrier.
3. Change passwords and reset two-factor settings, starting with your email account.
4. Record transaction hashes, addresses and timestamps.
5. Report the incident to local police. In the US, also file a complaint at ic3.gov.

Limitations: the 2026 physical-attack figures come from news coverage of Chainalysis rather than the report itself, and phone menu names vary by maker and software version.