Security habits and threat models

Threat model first

Ask: who is likely to come after my bitcoin, and how? For most people the honest answers are, in order: my own mistakes, remote scammers and malware, a burglar, and only then anything exotic. Design for the likely threats first.

The habits

• Accounts. A unique password for every service that touches bitcoin, including your email, in a password manager. Two-factor with an authenticator app or hardware key. Never SMS; SIM swaps are routine.
• Devices. Keep the phone, computer and hardware wallet updated. Download wallet software only from the developer's site and verify signatures where offered.
• Transactions. Confirm addresses on the hardware screen. Send a test amount first for anything large. Beware address poisoning: compare the whole address, not just the ends.
• Backups. Tested by restore, on metal, in two places.
• Discretion. Do not post holdings, wallet screenshots or exchange balances. Do not tell people you hold bitcoin. The five-dollar wrench attack (someone forcing you to sign) is defeated mostly by nobody knowing there is anything to take.
• Separation. Spending money in a hot wallet; savings in cold storage; never the whole stack on one device.

Plan for the worst day

If your phone is stolen today, what can the thief do? If your house burns, what survives? If you die, who can find the coins? If any answer is "everything is lost", fix that first.