Crypto Wallet Security Lab: Weigh the Trade-offs
First wallet, plenty of tips, and a lot of people who want your recovery phrase. Choose where keys live, spot fake support and lookalike addresses, and decide what to approve, then see what each choice costs. Prefer to read first? Start with the crypto wallet security checklist.
You are Dana Okafor, setting up and using a crypto wallet for the first time. Your friend Rafa has used one for years and keeps sending you tips. Across 12 decisions you choose where keys live, how to handle the recovery phrase, and how to react to fake support, lookalike addresses, airdrops and approval requests. Everything here is fictional, including the wallet app. Each call is scored 0 to 10 with the reason. This is security practice, not financial advice.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab: a fictional person sets up and uses a crypto wallet and has to decide where keys live and what to trust.
- You make 12 scored decisions: hot versus hardware wallet, the recovery phrase, a site that asks for it, fake apps, fake support, address poisoning, test transactions, surprise tokens, approvals, links, backups and a leaked phrase.
- The reasoning follows Ethereum.org's security guidance, the FTC's cryptocurrency scam advice, wallet-maker help pages and published research on address poisoning.
- Free to play. You get a final score and grade, a shareable scorecard and next-step links. A downloadable debrief is available with a paid plan.
- Defensive and educational only. Every person and the wallet app are fictional. It is not financial advice and does not recommend any wallet brand.
Frequently asked questions
Is this connected to a real wallet?
No. The people and the wallet app are fictional. Nothing connects to a blockchain or to any wallet, and nothing you choose moves real funds.
Is this financial advice?
No. The lab is about protecting access to a wallet. It says nothing about what to buy, hold or sell, and it does not recommend a wallet brand.
Where does the advice come from?
From Ethereum.org's security page, the FTC's page on cryptocurrency and scams, wallet makers' help pages on recovery phrases, and published research on address poisoning. The blog checklist links each source.
Why is the recovery phrase never shared?
Because anyone who has it controls the wallet. Ethereum.org says never to share it for any reason, and wallet makers say their support will not ask for it.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum. Every answer comes with a short reason, so you learn why a choice helps or hurts.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.