Crypto Wallet Security: A Checklist With Trade-offs

The most important rule of crypto wallet security is that your recovery phrase (also called a seed phrase) is the wallet: whoever has it controls the funds, so you never share it and never type it into a website. Ethereum.org puts it bluntly: never, for any reason, share your recovery phrase or private keys. Everything else in this checklist is about avoiding the situations where someone talks, tricks or rushes you into breaking that rule, or into signing something you did not understand.

This is security guidance only. It says nothing about what to buy, hold or sell and does not recommend a wallet brand. Because a transaction cannot be undone, the cost of a mistake is higher than with a bank card. The FTC notes that cryptocurrency payments typically are not reversible, and that if you lose access to a wallet, no one can typically help you recover the funds.

Do this now: the 15-minute pass

1. Find your recovery phrase. It should be on paper, offline. If it is in a screenshot, a cloud note, an email or a messaging app, move it to paper and delete the digital copies.
2. Decide what is a "spending" amount and what is a "savings" amount. Keep small, frequently used amounts in a convenient wallet and anything you would hate to lose on a hardware wallet bought from the maker or an authorised reseller.
3. Bookmark the sites and apps you use from the wallet maker's own site, and open them from bookmarks, not from links in messages or ads.
4. Review token approvals and revoke the ones you do not use. Ethereum.org links a guide on how to revoke smart contract access.
5. Save the addresses you pay regularly in your wallet's address book so you never need to copy one from history.
6. Turn on the strongest sign-in on the exchange and email accounts connected to your crypto. A passkey beats an SMS code.
7. Write down a recovery plan: where the backup lives and who could find it if you could not.

You can rehearse the choices below in the Crypto Wallet Security Lab, a scenario with fictional people and a fictional wallet where nothing real is at stake.

Hot wallet or hardware wallet: the trade-off

A hot wallet is software on a device that is online: a phone app or a browser extension. A hardware wallet keeps the private key on a dedicated device and signs transactions there. Ethereum.org describes hardware wallets as the most secure option for storing private keys because the key stays on the device and never touches the internet.

• Hot wallet: quick to set up and easy for small, frequent use, but the key lives on a device that also installs apps, opens links and can be infected.
• Hardware wallet: better protection against malware on your computer, but it costs money, can be lost, and you still have to read what you are signing. Buy from the maker or an authorised reseller, never from a social media ad or a used listing, because a tampered device defeats the point.
• Exchange account: you trade key management for reliance on the exchange's security and your account protections. That is a custody decision with its own risks, not an absence of risk.

Many people use two wallets: one small, convenient wallet for everyday use and one hardware wallet for the rest. The point is to limit what a single mistake can cost.

The recovery phrase: handle it like a master key

Wallet makers' help pages say to write the phrase down offline and never share it, and that their support will not ask for it. Ethereum.org also advises against screenshots. Practical rules:

• Write the words on paper, in order, and check them once. Do not photograph the paper.
• Never type the phrase into a website, a chat, a form or a "verification" tool. The only place it belongs is the restore screen of a wallet app or device you trust, on your own device, when you are recovering your own wallet.
• Do not store it in email, cloud notes, password managers shared with others or messaging apps.
• A phrase cannot be changed. If it is exposed, the fix is a new wallet, not a new password.

The trade-off with backups is real. One copy is a single point of failure (fire, flood, loss). Every extra copy is another place to protect. Decide on purpose, and test your recovery with a small amount before you rely on it.

How to tell it is a scam

Fake support

Ethereum.org has a "Support scams" section warning that scammers impersonate support personnel for popular wallets, exchanges or blockchains. Public questions in communities attract private messages from accounts claiming to be the help desk. Real support will not ask for your phrase and will not need a screen share to "validate" your wallet. Use only the support route listed on the maker's own site.

Fake wallet apps and sites

Copycat apps, search ads and lookalike domains are used to collect phrases. Start from the wallet maker's own site, typed or from a bookmark. An ad label, a promised bonus or a link from a stranger are all reasons to stop. The FTC's advice to never click a link in an unexpected text, email or social media message applies here too.

Fake airdrops and surprise tokens

Ethereum.org describes airdrop scams in which a project sends you an asset and a site then prompts you to sign something harmful in order to "claim" it. If a token you did not ask for appears, ignore it. Hide it in the wallet if you wish, but do not visit the site, connect your wallet or sign.

Urgency and guaranteed returns

The FTC says no legitimate business will demand you send cryptocurrency in advance and that only scammers guarantee profits or big returns. A countdown timer on a "frozen balance" is the same pressure in a different form. For related patterns, see our guides to AI scams and WhatsApp scams.

Address poisoning: don't copy from history

In address poisoning, an attacker generates an address that matches the first and last characters of one you already use, then plants it in your history with a tiny or zero-value transfer. If you later copy the most recent entry instead of the real address, your payment goes to the attacker. A USENIX Security 2025 paper by Tsuchiya and colleagues, available on arXiv, measures the attack on Ethereum and BNB Smart Chain. The attack succeeds even though your keys are never compromised, because it targets what you copy and paste.

• Use your wallet's saved contacts or ask the recipient to send the address again.
• Compare the whole address, not only the start and end.
• Ignore unsolicited tiny transfers. Do not reply to them.
• Remember that a transaction is irreversible. Ethereum.org says to check that the recipient address exactly matches the one you intend.

Test transactions: useful, with a limit

For a large transfer to a new address, a small test first can confirm the address and network are right. The trade-off is an extra fee and a little time. It does not protect you if the address itself came from a poisoned history, because a lookalike address works perfectly well, so verify where the address came from as well.

Approvals and signatures: read before you sign

Many apps ask you to sign an approval so a smart contract can spend a token on your behalf. Ethereum.org advises you not to allow unlimited spend limits and to set limits for only the amount a transaction needs. An unlimited approval stays open until you revoke it, so a compromised app or contract can move that token later. Convenience and exposure trade directly here.

• Read what you are approving. If the wallet shows only unreadable data and you cannot tell what it does, do not sign.
• Set a spending limit that matches today's need.
• Review approvals every few months and revoke the unused ones.

Account-level features raise related questions. Our EIP-7702 delegation risk explainer covers what it means to let an account run delegated code, and the signing service controls checklist shows how organisations protect signing keys, which is useful context for developers.

Backups and inheritance

Plan for loss and for the day you cannot act. Keep one tested backup in a safe place, ideally away from where you live, and leave instructions that a trusted person could find in the right circumstances. Avoid telling many people the phrase: everyone who knows it can spend it. A digital photo of the paper brings back the exposure you avoided by writing it down.

If your seed phrase was exposed

1. Stop using the old wallet and do not enter the phrase anywhere else.
2. Create a new wallet with a new phrase on a trusted, clean device.
3. Move assets to the new wallet promptly. An attacker may wait.
4. Revoke approvals on the old wallet where you can, and change passwords on connected accounts.
5. Report it. In the US, the FTC and the FBI's Internet Crime Complaint Center (IC3) take reports of cryptocurrency scams.
6. Beware of recovery offers. Strangers who promise to recover funds for a fee are a common second scam.

Prevent it next time: a checklist

• Recovery phrase on paper, offline, never typed into a site.
• Hardware wallet for amounts you could not afford to lose, bought from an official source.
• Apps and sites opened from bookmarks, not from messages or ads.
• Saved contacts for addresses; never copy from history.
• Small test for new addresses, with the address source verified.
• No unlimited approvals; revoke the unused.
• Ignore surprise tokens and private "support" messages.
• A tested backup and a plan for someone you trust.
• Strong sign-in on connected email and exchange accounts. See the Digital Footprint Check for what is publicly findable about you.

Frequently asked questions

What is the safest way to store crypto?

There is no single answer. Ethereum.org calls hardware wallets the most secure option for storing private keys because the key stays on the device and never touches the internet. A phone app is more convenient but its key lives on a device that also browses and installs apps. Match the wallet to what you could afford to lose.

Who should I give my seed phrase to?

Nobody. Ethereum.org says to never, for any reason, share your recovery phrase or private keys, and wallet makers say their support will not ask for it. Anyone who has the phrase controls the wallet.

What is address poisoning?

An attacker sends a tiny or zero-value transfer from a lookalike address so it appears in your transaction history, hoping you later copy it instead of the real one. Researchers describe it in a USENIX Security 2025 paper. Use saved contacts or ask for the address again, and compare the whole address.

What is a token approval and why revoke it?

An approval lets a smart contract spend a token from your wallet. Ethereum.org advises against unlimited spend limits and links a guide on revoking contract access. Review approvals you no longer use and revoke them.

Can I get my crypto back if I send it to the wrong place?

Usually not. Ethereum.org says a transaction sent on Ethereum is irreversible, and the FTC says cryptocurrency payments typically are not reversible. Check the address before you send.

What if I typed my seed phrase into a fake site?

Treat the wallet as compromised. A phrase cannot be changed, so create a new wallet with a new phrase on a trusted device, move assets promptly and report the scam to the FTC and the FBI's IC3.

Sources

• Ethereum.org: Stay safe in the Ethereum ecosystem (security)
• Ethereum.org: How to revoke smart contract access to your crypto funds
• FTC Consumer Advice: What to know about cryptocurrency and scams
• Tsuchiya et al.: Blockchain Address Poisoning (USENIX Security 2025, arXiv)
• FBI Internet Crime Complaint Center (IC3): report a scam
• Example of a wallet maker's help centre: recovery phrase guidance (named as a source, not an endorsement)

This is general security guidance, not financial advice, and does not endorse any wallet or exchange. Wallet menus and wording change by version; follow your wallet maker's official help pages for current steps.