Portfolio, taxes, security & ops

Separate the portfolio (long-term allocations decided in advance: e.g. 50% BTC, 30% ETH, 10% alt bets, 10% stables) from the trading book (risk-managed positions from your playbook). Mixing them — 'my trade became an investment' — is how losses get rationalized into bags.

Markets move allocations away from target. Band rebalancing restores them mechanically: when any asset drifts more than a set band (say ±5 percentage points) from target, trade back to target. Note what the rule quietly does: it sells what ran up and buys what lagged — systematic sell-high-buy-low, with zero forecasting, plus a written reason for every trade.

Rules differ by country, but the common pattern surprises beginners: in many jurisdictions a crypto-to-crypto swap is itself a taxable event — trading ETH for SOL realizes a gain or loss on the ETH, no fiat involved. Perp PnL, staking rewards, LP fees, and airdrops each often have their own treatment. 'I never cashed out' is frequently not a defense.

The operational rule is universal: record everything, from day one. Every trade's date, pair, size, price, fees, venue; deposits and withdrawals; reward receipts. Exchange APIs and portfolio trackers automate most of it — but exchanges die and take histories with them (ask any FTX user), so export regularly. Then get jurisdiction-specific advice from a professional; this lesson is operations, not tax advice.

Traders lose more to operational failures than they like to admit: SIM-swapped SMS 2FA, phished exchange logins, API keys with withdrawal rights leaking, hot wallets holding life savings. Every one of these is preventable with configuration, not vigilance.

The baseline: app or hardware-key 2FA (never SMS) on every venue; withdrawal address whitelisting with a time-lock, so even a fully compromised login can't drain to an attacker's address; API keys without withdrawal permission; capital split by function — trading capital on venues, everything else in cold storage. Assume any single system can be compromised and arrange things so that alone is survivable.

A crypto wallet doesn't *hold* coins — it holds the private key that authorizes moving them on-chain. "Not your keys, not your coins" means: if a third party controls the key (an exchange), they control your asset, and your balance is really just an IOU.

Self-custody removes that counterparty risk but moves the entire burden of key security onto you. There is no password reset.

Every on-chain action consumes gas — a unit of computational work. Your fee is `gas used × gas price`, and the gas price floats with network demand. The same swap can have very different costs as blockspace demand changes.

Gas limit is the maximum work authorized, not necessarily the amount consumed. Failed state-changing transactions can still pay for computation already performed. Layer-2 fees can combine execution with data-posting costs, so do not apply one network's formula or typical price to every chain.

To trade a token on a DEX you grant an approval — permission for a contract to move that token on your behalf. Malicious sites trick you into approving a *drainer* contract with an unlimited allowance, then sweep the token whenever they like. The signature looks innocuous.

Capital weight is not risk weight. A 10% allocation to a highly volatile token can contribute more drawdown than a 40% allocation to a less volatile asset. Contribution also depends on covariance: several different tickers may express the same crypto beta, liquidity, or smart-contract factor.

Estimate volatility and correlations over multiple windows, examine stressed periods, and set concentration limits by mandate and failure dependency. Rebalancing restores weights; it does not guarantee diversification when correlations converge toward one during a broad liquidation.

Historical volatility misses failures that did not occur in the sample. Add scenarios: broad crypto gaps, correlations approaching one, stablecoin depeg, exchange withdrawal freeze, oracle error, bridge exploit, gas spike, and collateral haircuts. Map gross and net exposure after derivatives rather than reading wallet balances independently.

Write portfolio limits for directional exposure, leverage, asset and venue concentration, protocol dependency, daily/weekly loss, and unavailable collateral. A limit needs an owner, measurement frequency, warning threshold, hard threshold, and action—not merely a number in a document.