Wallet security checklist - 15 rules that protect your money

A blockchain has no "support desk" that returns money. Security is entirely on you, but the good news is that most losses come from a handful of repeating mistakes. This checklist covers nearly all of them. The basics about keys are in the articles wallet and keys and public-key cryptography.

Rules for the seed phrase and keys

1. Write the seed phrase on paper or metal. Do not photograph it or save it in notes, a cloud or a messenger. Anything connected to the internet can be hacked.
2. Keep a copy in another place. A fire or flood must not destroy the only copy.
3. Tell nobody the phrase. Not support, not an "admin", not a "recovery specialist". Real support will never ask for it.
4. Do not enter the phrase on websites. The only legitimate place to enter it is the recovery screen of the wallet itself, downloaded from an official source.

Rules for choosing a wallet

1. Use a hardware wallet for large sums. The key never leaves the device, and you confirm every action with a button on the device itself.
2. Download a wallet only from official sources. Check the website address and the publisher in the app store. Fake extensions are a common way of theft.
3. Separate your wallets. One for storage (the "vault"), another for everyday operations (the "deal wallet"). Keep in the working one exactly as much as the operations need.

Rules for signatures and approvals

1. Read what you sign. Look carefully at what the wallet shows: which contract, which network, which function, which amount. If the text is unclear, do not sign.
2. Be careful with "unlimited" approvals. An approve with a huge amount lets a contract spend all your tokens until you revoke it (how it works). Give an exact amount or revoke approvals after use.
3. Check and revoke approvals periodically. There are special approval-viewing services and block explorers for this (guide).
4. Do not sign "empty" messages of unclear content. A signature may be a permission to pull tokens or transfer rights.

Rules for addresses and websites

1. Check the recipient's address in full - the start, the end and the middle. Do not blindly copy an address from the transaction history (address poisoning).
2. Bookmark the sites you need and go through the bookmarks, not through links from email, chats and ads.
3. Check a contract's address before working with it. Compare against an official source (how to verify a contract).
4. Try with a small amount. Send a new recipient or service a minimum amount first to check, then the rest.

What to do if something goes wrong

If you suspect the seed phrase or key is exposed:

1. Immediately create a new wallet with a new phrase on a clean device.
2. Move everything that remains onto it, starting with the most valuable assets.
3. Revoke approvals on the old address (if you still can).
4. Do not use the old wallet again.

If a scammer is already watching the address, they may intercept new deposits automatically, so you must act fast.

If you signed a malicious approval: revoke it urgently before the tokens are pulled.

If you sent money to the wrong place: sadly the transaction is irreversible. You can contact the recipient if it is a known service, but should not count on a refund.

Extra measures for deals

• Agree in advance on the network, token and amount. Check details through the service's website, not only through chat.
• Check the addresses of the parties and the guarantor in the deal card (lifecycle).
• Beware of urgency. Pressure ("transfer right now") is the main sign of fraud (red flags).
• Save the conversation and evidence in case of a dispute (evidence guide).

A quick check

Before signing any transaction, ask yourself:

• Did I start this action myself?
• Do I understand exactly what I am signing?
• Are the network, address and amount right?
• Did I reach the site through my own bookmark?

If the answer to even one question is "no", stop.

What to read next

Find out how scammers act in practice: phishing and address poisoning. For the technically curious - how a wallet gets all its keys from one phrase: HD wallets.