What is the single most important thing for crypto wallet security?

Protecting your seed phrase. It is the master key that can rebuild your entire wallet on any device, so keeping it offline and never sharing it matters more than any other single step. Anyone who reads it can take everything.

Should I store my seed phrase on my phone or in a password manager?

No. Keep it offline on paper or metal. Anything digital, including notes, photos, cloud storage, and even password managers, can be breached, synced, or scanned. A physical backup stored securely and out of sight is far safer for a recovery phrase.

Is a hardware wallet really necessary?

For long-term or larger holdings, yes. A hardware wallet keeps your private keys on an isolated device that must physically confirm each transaction, so even a fully compromised computer cannot move your funds. For small, active amounts, a reputable software wallet can be acceptable.

How do most people actually lose their crypto?

Rarely through broken cryptography. Losses usually come from entering a seed phrase into a fake site, approving a malicious transaction or signature, falling for a confidence or fake-support scam, or a SIM swap. Nearly all of it targets the person, not the math.

What is a token approval and why does it matter?

It is permission you grant a smart contract to move your tokens. Malicious approvals are now a leading drain vector because the theft happens through a signature you authorize. Grant only the amount needed, and revoke old approvals periodically with a reputable tool.

Why should I stop using SMS two-factor authentication for crypto?

Because a SIM-swap attack can move your phone number to a criminal's device, sending your text codes to them. Both CISA and NIST advise against SMS as a second factor. Use an authenticator app, which generates codes locally and is not tied to your number.

Someone contacted me offering to recover my stolen crypto. Is it real?

No. Anyone who contacts you first promising to recover lost funds for an upfront fee is running a second scam on victims of the first. The FTC warns against paying such offers. Reporting fraud to the FBI's IC3 or the FTC is free.

What is a hot wallet versus a cold wallet?

A hot wallet is connected to the internet, convenient for daily use, and more exposed. A cold wallet, typically a hardware device, keeps keys offline. A common approach is to split funds: savings in cold storage, a small spending amount in a hot wallet.

What is address poisoning?

An attacker seeds your transaction history with an address that closely resembles one you use, often via a zero-value transfer, hoping you copy it from your history later and send funds to them. Always verify the full address, not just the first and last characters.

Are 12-word and 24-word seed phrases both safe?

Yes. Both are defined by the BIP-39 standard; 12 words encode 128 bits of entropy and 24 words encode 256 bits. Even 128 bits is computationally infeasible to brute-force, so your storage habits, not the word count, are what determine safety.

How often should I review my wallet security?

Treat it as ongoing. Review and revoke unused token approvals on a regular schedule, such as monthly, and confirm your seed-phrase backups are still safe and legible periodically. Revisit your whole setup after any major change to your holdings or the apps you use.

My wallet may be compromised. What should I do first?

Act quickly but follow a plan. If your seed phrase is exposed, create a brand-new wallet with a new phrase on a clean device and move salvageable funds there; do not reuse the old phrase. If only an approval is malicious, revoking it may be enough. Follow a structured incident guide.

Crypto Wallet Security Checklist: Secure Self-Custody

Private by design. This checklist runs entirely in your browser. Nothing you tick is sent to any server, tied to an account, or shared — progress is saved only in this browser (localStorage). CamoCrypt will never ask for your seed phrase, private key, or to connect your wallet. No legitimate tool does.

Securing a crypto wallet comes down to a short list of habits, done consistently: protect the seed phrase that controls your funds, keep the bulk of your holdings offline, scrutinize every transaction you sign, and lock down the phone number and devices attached to your accounts. This checklist walks through each of those in order, from the single most important step to the finer points that matter once the basics are in place.

It is written for anyone holding their own crypto rather than leaving it on an exchange, whether you are setting up a first wallet or tightening an existing one. Self-custody means you alone control the keys, which is the entire point of crypto, and also the entire risk: with no company standing behind your account, the safeguards below are the ones actually keeping your funds safe. None of this requires technical skill, only attention.

Why crypto self-custody security is different

Ordinary online security assumes a safety net. If a card is stolen, the bank reverses the charge; if you forget a password, you reset it. Crypto has none of that. A confirmed blockchain transaction is final: there is no chargeback, no fraud department, and no one who can claw funds back once they leave your wallet. When you hold your own keys, you are the bank, the vault, and the customer-support line all at once.

That permanence changes the goal. Because a mistake usually cannot be undone, security here is about prevention rather than recovery. A single leaked seed phrase or one careless signature can drain an account in seconds, and the money is simply gone. This is also why attackers invest so heavily in tricking people rather than breaking cryptography: the math protecting a wallet is effectively unbreakable, so the weak point is almost always the human holding the keys.

The upside is that the same finality that makes crypto unforgiving also makes it genuinely yours. No one can freeze your wallet, reverse your payments, or seize funds through your account provider, because there is no provider. Understanding that trade-off is the foundation for everything else here. It is worth grasping how public and private keys actually establish ownership, and the difference between custodial and non-custodial setups, which comes down to who holds the keys.

Seed phrase and backups: the master key

Your seed phrase, also called a recovery phrase, is the single most important thing to protect. It is a list of ordinary words, usually 12 or 24 of them, defined by the BIP-39 standard. Those words encode the entropy from which every private key in your wallet is derived, which means anyone who reads them can rebuild your wallet and take everything, from any device, anywhere. The wallet app is just a window; the phrase is the key to the building.

Treat it accordingly. Write it on paper or stamp it into metal, and store it offline. Never photograph it, type it into a note, email it to yourself, save it in a password manager, or store it in cloud storage, because anything digital can be breached, synced, or scanned. Keep at least one backup in a separate physical location to survive fire, flood, or loss, and consider splitting copies so no single location holds everything.

Nobody legitimate ever needs it

No wallet developer, exchange, support agent, or airdrop will ever ask for your seed phrase. Any request for it is a scam, full stop. The most common losses come not from clever hacks but from people entering their phrase into a convincing fake site or “wallet validation” prompt. We cover the recurring patterns in how people lose seed phrases, which is essential reading before you rely on any single backup method.

Choosing and setting up a wallet

Wallets fall into two broad families. A software (hot) wallet is an app on your phone or browser, connected to the internet and convenient for everyday use. A hardware (cold) wallet is a dedicated physical device that generates and stores your private keys on an isolated chip; the keys never leave it, and every transaction must be confirmed by pressing a button on the device itself. Even if the computer you plug it into is fully compromised, an attacker cannot extract the keys or move funds without the device in hand.

For anything beyond small, active balances, a hardware wallet is the standard for self-custody. A practical approach is to split your holdings: keep long-term savings on a cold wallet you rarely connect, and a small “spending” amount in a hot wallet for daily activity. That way a compromise of the convenient wallet cannot reach your main funds. Our side-by-side on hardware versus software wallets goes deeper on the trade-offs.

Set it up safely

Buy hardware wallets only from the manufacturer or an authorized reseller, never secondhand, and generate a fresh seed phrase yourself during setup rather than trusting any pre-filled card. Download software wallets only from official sources, and verify you have the genuine app before entering anything, because fake wallet apps are a common lure. For larger holdings, a multisig setup that requires several keys to approve any transfer removes the single point of failure entirely.

Token approvals and transaction signing: the modern drain vector

On networks like Ethereum, using most apps requires granting a smart contract permission to move your tokens. This is the approval mechanism, and it is now the leading way individual wallets get drained, because the theft happens through a signature you willingly provide, using a feature working exactly as designed. You are not tricked into revealing a key; you are tricked into authorizing a transfer.

Two functions do most of the damage. An ERC-20 approve or gasless permit can grant a contract the right to move your tokens, sometimes an unlimited amount. For NFTs, setApprovalForAll is a single switch that hands over transfer rights to your entire collection on that contract in one signature. Phishing sites disguise these as routine “verify wallet” or “claim” steps. Because a permit is an off-chain signature with no gas fee, it feels harmless, which is precisely why it is dangerous; industry analyses attribute a large share of phishing losses to permit-style signatures.

Build the habit

Read what your wallet shows before signing: which contract, which token, and whether the amount is limited or unlimited. When possible, approve only the amount you need rather than an unlimited allowance. Periodically review and cancel old permissions using a reputable checker such as Revoke.cash or a block explorer’s approval tool, as explained step by step in how to revoke token approvals. Understanding how signature phishing turns a routine-looking permit or approve prompt into a drain is the deeper lesson worth internalizing.

Account and device security

The wallet is only as safe as the phone, computer, and accounts around it. Start with your phone number, because it is a surprisingly weak link. In a SIM-swap attack, a criminal convinces your carrier to move your number to a device they control, after which every call and text, including your login codes, goes to them. For this reason, move any two-factor authentication tied to your crypto away from SMS. Both CISA and NIST advise against SMS as a second factor; authenticator apps generate codes locally on your device, so they keep working even if your number is stolen. Add a PIN or port-out lock to your carrier account as an extra barrier, covered in what is SIM swapping and how to prevent it.

On your devices, the fundamentals still matter. Keep your operating system, browser, and wallet software current, since updates close the holes attackers rely on. Install as few browser extensions as possible, as a malicious one can read and alter what you see on a page. Treat downloads and unexpected attachments with suspicion, and never run software sent to you by a stranger, even a helpful-sounding one.

Bookmark, don’t search

A large share of thefts start with a fake site that ranks in search results or ads. Save the real address of every wallet, exchange, and app you use as a browser bookmark, and reach them only through that bookmark. Verify the domain every single time before connecting your wallet or signing anything.

Spotting scams before they reach your wallet

Most losses today are social, not technical. In confidence scams often called “pig butchering,” someone builds a relationship over weeks through a dating app, social media, or a “wrong number” text, then steers you toward a fraudulent investment platform that shows fake profits to lure larger deposits, which can never be withdrawn. The FBI’s 2024 Internet Crime Report tied billions in reported losses to this pattern alone. The defense is simple to state and hard to feel in the moment: never take investment advice from someone who contacted you first, and be deeply skeptical of any platform introduced by a new online acquaintance.

Fake support is the other everyday threat. Scammers pose as wallet or exchange help staff in chat groups, social replies, and search ads, then ask you to “validate” your wallet or share your recovery phrase. Real support never does this. Honeypot tokens are a further trap: assets engineered so you can buy but not sell. When in doubt, slow down; urgency is the scammer’s main tool.

Know the anatomy

The more familiar these scripts are, the less they work. We break down the confidence scam in detail in how the long con works. Fake-support scripts and honeypot tokens follow equally recognizable patterns, and address poisoning, where an attacker seeds your history with a lookalike address hoping you copy it later, is another quiet one worth learning to spot.

What to do the moment a wallet is compromised

If you suspect your wallet is compromised, act fast but deliberately, because the wrong first move can make things worse. Speed matters: an attacker with your keys or a live approval may be draining funds in real time. The priority is to move whatever remains to safety and to cut off the access the attacker has.

If your seed phrase may be exposed, assume the entire wallet is lost and that any address derived from that phrase is unsafe forever. Do not simply move funds to another account within the same wallet; create an entirely new wallet with a brand-new seed phrase, ideally on a clean device, and transfer any salvageable assets there. Watch out for a cruel trap called a sweeper bot: if a compromised wallet still holds the native gas token, attackers automate instant transfers, so incoming gas can vanish before you can act.

Follow a calm sequence

If the problem is a malicious approval rather than a stolen phrase, revoking that specific permission may stop the bleeding without abandoning the wallet. Because the right steps depend on exactly how the compromise happened, and because panic leads to costly errors, follow a structured plan rather than improvising: our step-by-step wallet compromised guide walks through triage in order. Above all, ignore anyone who suddenly appears offering to recover your funds, a point the next sections return to.

A beginner-to-advanced security roadmap

Good security is a progression, not a switch you flip once. Trying to do everything at day one leads to abandoned steps and false confidence. Instead, layer protections as your holdings and confidence grow, so each habit is solid before you add the next.

Beginner

Start with the essentials that stop the most common losses. Write your seed phrase on paper and store it offline. Never share it with anyone or type it into a website. Bookmark the real sites you use and reach them only that way. Move crypto-related two-factor off SMS and onto an authenticator app. Keep only small amounts in a hot wallet while you learn.

Intermediate

Add a hardware wallet for your longer-term holdings and split funds between that cold wallet and a small hot wallet. Learn to read what you are signing, and make reviewing and revoking old token approvals a routine. Add a PIN or port-out lock to your mobile carrier account. Learn to read a block explorer so you can verify transactions independently.

Advanced

Consider a metal seed backup for fire and water resistance, and a separate “burner” wallet for connecting to new or untrusted apps so your main funds are never exposed. For significant holdings, multisig requires several keys to approve any transfer, removing the single point of failure entirely. Learn to verify a contract address before interacting with it.

How to use this checklist and how the score works

The interactive checklist above turns everything on this page into concrete, tickable actions. Work through it top to bottom rather than cherry-picking, because the items are ordered roughly by impact: the earliest steps, around your seed phrase and the finality of transactions, prevent the losses that are impossible to undo, while later items harden the edges. If you only have ten minutes today, completing the first few well is worth more than skimming all of them.

Your score is weighted, not a simple count. Items that guard your master key and your most catastrophic failure modes carry more weight than smaller refinements, so the number reflects real risk reduction rather than how many boxes you happened to tick. A high score with the critical items done means something very different from the same score reached through minor tweaks, which is why the checklist flags the load-bearing steps.

Make it a routine

Security is not one-and-done. Some items, especially reviewing and revoking token approvals and confirming your backups are still safe and legible, are worth repeating on a regular schedule, such as monthly or quarterly. Treat this page as a reference you return to, revisit the checklist after any major change to your holdings or setup, and browse our crypto security guides and wallets and custody library to go deeper on any single step.

Crypto Wallet Security Checklist

The interactive security checklist

01Seed phrase & backups

02Wallet setup

03Approvals & signing

04Account & device security

05Scam awareness

06Emergency readiness