Security first

Build better habits.
Protect what matters.

Practical wallet security guidance for recovery phrases, official downloads, transaction reviews, token approvals, and scam warning signs.

Protect the recovery arrangement

A private key or recovery phrase can allow another person to control assets. Keep recovery information private and follow the wallet's documented backup procedure. Ordinary screenshots can sync into cloud services and expose sensitive information in unexpected places.

Understand which information recovers access and which merely unlocks a device. If your wallet uses a different arrangement, such as a smart account or provider-assisted recovery, read its specific rules. Do not create a seed-phrase routine for a product that does not use one.

Make installation a deliberate step

Find the official developer website and follow its published download instructions. Check the publisher identity, device support, and permissions. Treat unsolicited support messages, sponsored results, and copied websites as things to verify.

Keep supported wallet software and the operating system current. Separate your ordinary browsing and messaging habits from the handling of recovery material. A hardware signer reduces some exposure, but it cannot decide whether your intended transaction is wise or whether the destination is trustworthy.

Use a pause-before-signing checklist

  1. Purpose: explain what this request is intended to accomplish.
  2. Source: confirm the application and official domain.
  3. Account: confirm the right wallet and network.
  4. Effect: review assets, destination, amount, approvals, and fees.
  5. Exit: know whether and how the action can be undone.

If the request does not match your intention, reject it and investigate. A transaction preview or simulation can be helpful, but it should not replace understanding the action and its limitations.

Know what disconnection changes

Disconnecting an application from a wallet interface does not necessarily cancel token permissions that were previously recorded on-chain. Use documented tools to review and, where appropriate, revoke approvals.

Exposed signing keys are a different problem from a risky token allowance. Revoking an allowance does not make an exposed key secret again. Follow the affected wallet's official incident guidance and seek help through independently verified channels.

Respond without adding a second problem

If a request, transfer, or message seems wrong, stop interacting with it. Preserve nonsecret transaction identifiers and screenshots of the suspected message, without capturing recovery material. Do not pay a stranger who promises guaranteed recovery.

Use the scam warning-sign guide, the backup and recovery guide, and our sending checklist to understand the next step for your situation.

Official reading

Use these primary sources to check current details before making a decision.

From the Wallet Journal

Keep your knowledge moving

All articles