How should I store my seed phrase?

Store it offline. Write your seed phrase on paper or stamp it into metal, and keep it somewhere private and durable — ideally with a backup in a second location. Never take a photo of it, type it into a note, email, or cloud drive, or enter it into any website. Anyone who reads those words controls your funds, so keeping them off any internet-connected device is the whole game.

Do I need a hardware wallet?

If you're holding a meaningful amount for the long term, a hardware wallet is strongly recommended. It keeps your private keys on a dedicated offline device and signs transactions internally, so even a malware-infected computer can't extract your keys. For small, active balances a reputable software wallet may be enough, but cold storage is the standard for serious holdings.

What is an approval scam and how do I avoid it?

An approval scam tricks you into signing a token approval that lets a malicious contract spend your tokens later — no draining transaction needed at the time. Avoid it by reading every signature request, being wary of surprise airdrops and 'claim' buttons, approving only the amount you need, and periodically revoking allowances you no longer use.

Why should I verify a transaction before signing it?

Because your signature is what actually moves value, and malware or a spoofed site can show one thing while asking you to sign another. Always confirm the destination address, the amount, and the network on the wallet screen — and on a hardware wallet, on the device's own display — before approving. A few seconds of checking prevents irreversible loss.

Crypto Wallet Security: How to Keep Your Keys Safe

Self-custody hands you full control of your money — and full responsibility for protecting it. Good crypto wallet security isn't complicated, but it's unforgiving: there's no undo button and no support line. This is the practical playbook for keeping your keys, and your funds, genuinely safe.

In crypto, your keys are your money. Whoever controls the private key controls the funds — permanently and irreversibly. That's the source of self-custody's power and its danger in one sentence. There's no bank to call, no fraud department to reverse a bad transfer, no way to recover a lost seed phrase. The good news is that the entire discipline comes down to a handful of habits that, once they're routine, make you a very hard target.

This guide covers the fundamentals: how to handle your seed phrase, why hardware wallets matter, the difference between hot and cold storage, how phishing and approval scams actually work, and the single habit that stops most losses — verifying transactions before you sign.

Your seed phrase is the master key — treat it that way

When you create a self-custody wallet, it generates a seed phrase: usually 12 or 24 words. Those words are a human-readable backup of your private keys. Anyone who has them can recreate your wallet and drain everything, on any device, anywhere. Almost every catastrophic loss in crypto traces back to a compromised or lost seed phrase. Protecting it is the whole ballgame.

Solid seed phrase hygiene:

Keep it completely offline. Write it on paper, or better, stamp it into a metal backup plate that survives fire and water. The moment your seed phrase touches an internet-connected device, it's exposed to whatever that device is exposed to.
Never photograph it. A photo lands in your camera roll, which usually syncs to the cloud — now your master key lives on someone else's server.
Never type it into anything. No notes app, no email, no spreadsheet, no password manager, and above all no website. The only legitimate place to enter a seed phrase is directly into wallet software when you're restoring a wallet — never in response to a prompt from a site or a message.
Make a redundant backup. Store a second copy in a separate secure location so a single fire, flood, or theft doesn't wipe out your only record.
Consider a passphrase. Many wallets support an optional extra word (a "25th word") that adds a layer even if the written phrase is found. If you use one, back it up with the same care — losing it locks you out too.

Simple rule to carry forever: your seed phrase should never be spoken to a person, typed into a screen, or stored anywhere with a network connection. If anyone asks for it — support, giveaway, wallet "validation" — it's a scam, every single time.

Hot vs cold: match storage to the job

Not all wallets carry the same risk, and understanding the split helps you place your funds sensibly.

A hot wallet is connected to the internet — a browser-extension or mobile wallet like MetaMask, Keplr, or Phantom. Its keys live on a device that also browses the web, installs apps, and receives messages. Hot wallets are convenient and perfect for everyday activity: swaps, small balances, interacting with apps.

A cold wallet keeps its keys offline, disconnected from the internet. Cold storage is where you keep savings — the holdings you don't touch often and can't afford to lose. Because the keys never sit on an online machine, the most common attack vectors simply can't reach them.

The practical pattern most careful users adopt is to treat a hot wallet like the cash in your pocket and cold storage like the safe at home. Keep a working amount hot for daily use, and move anything substantial into cold storage. That way a compromised laptop or a bad signature can only ever reach a limited balance.

Hardware wallets: the practical gold standard

The most accessible form of cold storage is a hardware wallet — a dedicated physical device (Ledger, Trezor, and others) that stores your private keys in a secure chip and never exposes them, even to the computer it's plugged into.

The magic is in how it signs. When you approve a transaction, the unsigned details are sent to the device, the device signs internally, and only the finished signature comes back. The private key never leaves the hardware. So even if your computer is riddled with malware, the attacker can't extract the key — it was never on the computer to begin with.

Getting the most from a hardware wallet:

Buy new, from the official manufacturer or an authorized reseller. Never use a second-hand device or one with a pre-filled seed phrase — that's a classic trap.
Generate the seed on the device itself and back it up offline, exactly as described above.
Verify every transaction on the device's own screen. The physical display is trustworthy even when your computer isn't; it's your source of truth.

For anyone holding a meaningful amount long-term, a hardware wallet is the single highest-impact upgrade to your crypto wallet security. It converts "my computer must be perfectly clean" into "my keys are safe even if it isn't."

Phishing and approval scams: how funds actually get stolen

Here's a counterintuitive truth: most stolen crypto isn't taken by cracking encryption. It's handed over by users who were tricked. The attack surface is you, not the math. Two families of scam dominate.

Phishing aims to capture your seed phrase or get you to sign on a fake site. It shows up as a lookalike domain of a real app, a fake wallet pop-up, a "your wallet needs validation" email, a support impersonator in your DMs, or a malicious ad above the real search result. The tell is almost always a request that a legitimate service would never make — enter your seed phrase, sign this urgent message, connect here to "unlock" your account.

Approval scams are subtler and don't need your seed phrase at all. To trade a token on a DEX, you grant the contract permission (an "allowance") to move that token. Scammers dress up a malicious approval as an airdrop claim, a mint, or a game action. You think you're claiming a reward; you're actually authorizing a contract to spend your tokens whenever it likes. Because the allowance persists, the drain can come minutes or months later, seemingly out of nowhere.

Defenses that work against both:

Navigate from your own bookmarks, never from ads, DMs, or unsolicited links. Confirm the exact domain every time.
Distrust urgency and surprises. "Claim now," countdown timers, and unexpected airdrops are engineered to make you act before you think.
Approve only what you need. Prefer exact-amount approvals over unlimited ones, and periodically revoke old allowances with a reputable approval-checker or your wallet's permissions manager.
Read the signature request. If a wallet asks you to approve spending or "setApprovalForAll" when you only meant to claim something, stop.

Verify before you sign — the habit that saves you

If you internalize one thing, make it this: your signature is the only thing that moves your money, so read what you're signing. Malware and spoofed sites work by showing you one thing on the page while asking your wallet to sign another — swapping a destination address, inflating an amount, or slipping in an approval.

Before you approve any transaction, check three things on the wallet screen — and on a hardware wallet, on the device's own display:

The destination address. Confirm it matches where you actually intend to send. Verify the full string, not just the first and last characters — address-poisoning attacks rely on lookalikes.
The amount and the token. Make sure the value and asset are exactly what you meant, with no surprise extra approvals bundled in.
The network. Confirm you're on the chain you think you are.

Slow is smooth here. A few seconds of checking is the cheapest insurance in crypto, because once you sign, it's final. There is no reversing a confirmed transaction.

Where non-custodial design fits in

Everything above assumes you hold your own keys — which is exactly the point of non-custodial tools. A well-built non-custodial app never takes possession of your assets; it reads your balances to show your portfolio and prepares transactions, but your wallet holds the keys and your signature is the only thing that authorizes a move.

This is the model AveraChain is built on. It connects across Cosmos, EVM and Solana to give you one unified, real-time view of everything you hold, and lets you act — swap, schedule orders, stake — from a single screen. Because it's non-custodial, it works with the security habits in this guide rather than around them: you can connect a hardware wallet, and every action still lands in your own wallet for you to verify and sign. Your keys never leave your control, and nothing moves without your approval. AveraChain is currently in development and launching soon, with this non-custodial foundation baked in from the start.

Strong crypto wallet security is really just a short list of habits: keep your seed phrase offline and private, use a hardware wallet for anything significant, split funds between hot and cold, treat urgency and surprise as red flags, and verify every transaction before you sign. Make those routine and you get the full freedom of self-custody with very little of its downside — your keys, your coins, firmly in your own hands.