Securing a Self-Custody Wallet

In self-custody, whoever holds the recovery phrase controls the wallet. No legitimate organisation will ever need it.

Practical habits

• Store recovery words offline and never type them into a website
• Review and revoke unnecessary token approvals regularly
• Read signing requests carefully before confirming
• Consider a hardware wallet for significant holdings

If you suspect compromise, move remaining assets to a new wallet created on a clean device.

Common ways wallets are compromised

• Fake wallet apps or browser extensions that imitate well-known brands
• Phishing websites that ask you to "verify" or "synchronise" your wallet by entering recovery words
• Malicious token approvals that allow a contract to move your tokens later
• Remote-access software installed at the request of a fake support agent

Before you connect to a new application

Check the website address carefully, download wallet software only from the official source, and be wary of airdrops or tokens you did not expect to receive. When a signing request appears, read what it will allow — an unlimited approval is very different from a single transfer. If something is unclear, cancel and research it first.

Blockchain transactions are generally irreversible once confirmed. Good habits are the most effective protection.

This article is general educational information and is not legal or financial advice.