Very few people lose crypto because someone cracked the cryptography. They lose it because they typed twelve words into a website that looked like their wallet's, or signed a transaction they did not read, or replied to a friendly "support agent" who messaged them first. Crypto wallet security is overwhelmingly about people and process, not maths. Get a few habits right and you close off most of the ways funds actually disappear.
How crypto wallets work: keys, not coins
A wallet does not "contain" coins. Your coins live on the blockchain; the wallet holds the private keys that authorise moving them. Whoever has the keys controls the funds – which is the whole point of self-custody, and the whole risk.
Most modern wallets generate keys from a seed phrase (also called a recovery phrase), usually 12 or 24 words drawn from a standard list defined in BIP-39. From that one phrase, the wallet can derive every key and every address it will ever use. Lose the device and the phrase restores everything. Leak the phrase and someone else can restore everything too.
How to store a seed phrase safely
The seed phrase is the single most valuable secret you own in crypto. Treat it accordingly:
- Write it down offline. Paper works; a metal backup survives fire and water better.
- Never photograph it, type it into a notes app, email it or store it in cloud drives. Anything online can be reached by malware or a compromised account.
- Never enter it into a website, ever. Legitimate services do not ask for it. The only time you type it is when restoring a wallet on a device you trust.
- Store it where you can find it and others cannot. Consider two copies in separate secure locations.
- Consider a passphrase (sometimes called the "25th word"). It creates an entirely separate wallet from the same seed, so a stolen phrase alone is not enough. But if you forget the passphrase, there is no recovery.
- Plan for inheritance. A perfectly hidden seed that dies with you is a loss too. Write clear instructions for a trusted person, kept separately from the phrase itself.
Hardware wallets: what they protect and what they don't
A hardware wallet is a small device that generates and stores your keys offline and signs transactions internally. Your computer prepares the transaction; the device shows the details on its own screen and signs only when you confirm with a physical button.
What that protects against:
- Malware on your computer cannot read the keys, because the keys never leave the device.
- Remote theft requires physical access to the device plus its PIN.
What it does not protect against:
- Signing something malicious. If you approve a harmful transaction on the device, it will sign it faithfully. Always read the address and amount on the device screen, not just on your monitor.
- A leaked seed phrase. If the phrase is exposed, the hardware is irrelevant.
- Tampered devices. Buy directly from the manufacturer or an authorised reseller, never second-hand, and never use a device that arrives with a pre-filled seed phrase card – that is a scam.
A sensible setup for many people: a hardware wallet for long-term holdings, a separate "hot" wallet with small amounts for daily use and experimenting with apps.
Common crypto scams and how they work
| Scam | How it works | Defence |
|---|---|---|
| Phishing sites | A lookalike site for a wallet or exchange asks for your seed or login | Bookmark official sites; never enter a seed online |
| Wallet drainers | A malicious dApp asks you to sign an approval or "permit" that lets it move your tokens | Read every signature request; use a separate hot wallet |
| Fake support | Someone on social media or Discord offers help and asks for your seed or screen share | Real support never DMs first or asks for the seed |
| Address poisoning | Attacker sends a tiny transaction from an address that looks like one you use, hoping you copy it later | Verify full addresses, not just first and last characters |
| Clipboard malware | Malware swaps a copied address for the attacker's | Check the pasted address on the hardware wallet screen |
| Pig-butchering and romance scams | A long-built relationship leads to a fake "investment platform" | Treat unsolicited investment tips from new contacts as a red flag |
| Fake airdrops and tokens | Unknown tokens appear in your wallet with a link to "claim" | Ignore them; interacting can trigger a drainer |
The common thread: almost every scam needs you to do something – type the phrase, sign the transaction, send the funds. Urgency is the tell. Legitimate processes rarely require you to act in the next ten minutes.
Token approvals: the risk most people forget
On Ethereum and similar chains, using an app often requires an approval: a permission letting a smart contract move a certain token from your wallet. Many apps request unlimited approvals for convenience. That permission persists after you leave the site. If the contract is later exploited, or was malicious from the start, it can take those tokens at any time.
Good habits: approve only the amount you need when the option exists, and periodically review and revoke old approvals using a reputable approval-checking tool or your wallet's built-in feature.
A crypto wallet security checklist
- Seed phrase written offline, stored in two secure places, never digitised
- Hardware wallet bought new from the manufacturer for long-term holdings
- Separate hot wallet with small balances for everyday use
- Official sites bookmarked; links from messages and ads never clicked
- Every address and amount checked on the device screen before signing
- Unused token approvals revoked regularly
- Two-factor authentication with an authenticator app (not SMS) on exchange accounts
- Inheritance instructions written and stored separately
Security is a habit, not a product
No device or app delivers crypto wallet security on its own. It comes from a short list of habits applied every time: guard the seed phrase, read what you sign, verify addresses and distrust anyone who contacts you first. That discipline costs a few minutes. Skipping it can cost everything in the wallet, with no bank to call and no transaction to reverse.
This article is for education only and is not financial or investment advice.
