Security
Wallet Safety Guide
Concise guidance on seed phrases, phishing, token approvals, hardware wallets, and transaction verification.
9 topics
Your seed (recovery) phrase is the master key to every account derived from your wallet. Anyone who has it controls your funds.
Risk: A leaked seed phrase cannot be revoked. Funds can be moved instantly and permanently.
Preventive steps
- 1Write it down offline on paper or a metal backup — never in screenshots, notes apps, email, or cloud storage.
- 2Store backups in at least one secure physical location you control.
- 3Never type your seed phrase into a website, form, chat, or browser extension prompt.
- 4No legitimate support team, wallet provider, or tool will ever ask for it.
A private key controls a single account. Exporting it creates another copy that must be protected just like a seed phrase.
Risk: Exported keys left in files, clipboards, or password managers synced to compromised devices can be stolen.
Preventive steps
- 1Avoid exporting private keys unless you have a specific, understood reason.
- 2If you must export one, never paste it into websites or share it with anyone.
- 3Clear your clipboard after handling sensitive data and be wary of clipboard-monitoring malware.
- 4Keep the operating system, browser, and wallet software up to date.
Phishing tricks you into revealing secrets or signing malicious transactions through convincing messages, emails, or ads.
Risk: Urgent messages about 'account issues', 'wallet validation', or 'claim deadlines' are common attack patterns.
Preventive steps
- 1Treat unsolicited direct messages offering help, rewards, or support as suspicious by default.
- 2Do not click links in emails or messages — navigate to services from a saved bookmark instead.
- 3Slow down when a message creates urgency or fear; pressure is a manipulation technique.
- 4Verify announcements through more than one official channel.
Attackers clone popular sites and social accounts, often using look-alike domains or sponsored search results.
Risk: A single character difference in a domain can lead to a site built to drain connected wallets.
Preventive steps
- 1Bookmark official sites and use the bookmarks rather than search results or ads.
- 2Check the full domain carefully for misspellings, extra words, or unusual extensions.
- 3Confirm official links from the project's verified documentation or repository.
- 4Be cautious with accounts that copy names and avatars but have recently changed handles.
Token approvals allow a smart contract to move specific tokens from your wallet. Unlimited approvals persist until revoked.
Risk: Approving a malicious or later-compromised contract can allow it to transfer your tokens without further prompts.
Preventive steps
- 1Read the approval request: which token, which spender, and what amount.
- 2Prefer limited approvals that match the amount you intend to use.
- 3Review and revoke unused approvals periodically using a reputable approval-management tool or your block explorer.
- 4Be extra careful with signature-based approvals (permits), which may not look like transactions.
A hardware wallet keeps private keys on a dedicated device and requires physical confirmation to sign.
Risk: Hardware wallets reduce key-theft risk but cannot stop you from approving a malicious transaction yourself.
Preventive steps
- 1Buy devices only from the manufacturer or authorized resellers.
- 2Initialize the device yourself and never accept a device with a pre-written recovery phrase.
- 3Always verify transaction details on the device screen, not only in the browser.
- 4Keep firmware updated through the manufacturer's official software.
Every signature authorizes something. Understanding what you sign is the most effective safeguard you have.
Risk: Blind signing unreadable data or unexpected messages can authorize transfers or approvals.
Preventive steps
- 1Check the destination address, network, asset, and amount before confirming.
- 2Compare addresses character by character — do not rely only on the first and last few characters.
- 3Send a small test transaction to new addresses when the amount is significant.
- 4Reject any request you do not fully understand; you can always try again later.
Connecting a wallet shares your public address. The risk comes from what you sign after connecting.
Risk: Malicious sites can request signatures that appear harmless but grant permissions or transfer assets.
Preventive steps
- 1Connect only to sites you have verified and actually need to use.
- 2Use a separate wallet with limited funds for experimental or new applications.
- 3Disconnect sites you no longer use from your wallet's connected-sites settings.
- 4Be suspicious of sites that request a signature immediately after connecting without a clear reason.
Unknown tokens that appear in your wallet are often bait that leads to phishing sites or malicious contracts.
Risk: Trying to sell or 'claim' an unexpected token can trigger a malicious approval.
Preventive steps
- 1Ignore unknown tokens and NFTs you did not expect to receive; hide them in your wallet if possible.
- 2Do not visit websites mentioned in token names, NFT images, or descriptions.
- 3Verify real airdrops through the project's official channels before interacting.
- 4Be skeptical of offers promising guaranteed returns, doubled deposits, or exclusive allocations.