Never share your recovery phrase with anyone or type it into a site: Ethereum.org says to never, for any reason, share it, and no legitimate support agent needs it. Keep the phrase offline on paper, use a hardware wallet for amounts you would hate to lose, copy recipient addresses from saved contacts rather than history (address poisoning), avoid unlimited approvals and revoke old ones, and treat unexpected tokens and "support" messages as hostile. Transfers are irreversible, so verify before you send. If a phrase was exposed, move to a new wallet with a new phrase. This is security guidance, not financial advice.
The short version
- Find your recovery phrase. It should be on paper, offline. If it is in a screenshot, a cloud note, an email or a messaging app, move it to paper and delete the digital copies.
- Decide what is a "spending" amount and what is a "savings" amount. Keep small, frequently used amounts in a convenient wallet and anything you would hate to lose on a hardware wallet bought from the maker or an authorised reseller.
- Bookmark the sites and apps you use from the wallet maker's own site, and open them from bookmarks, not from links in messages or ads.
- Review token approvals and revoke the ones you do not use. Ethereum.org links a guide on how to revoke smart contract access.
- Save the addresses you pay regularly in your wallet's address book so you never need to copy one from history.
Go deeper
- Full guide, with the reasoning, the sources and an FAQ: Crypto Wallet Security: A Checklist With Trade-offs
- Practise it: Crypto Wallet Security Lab is a scored scenario where you make the calls and see what each one costs.
- More checklists and labs: the PlayCISO cyber hygiene checklist and all tools.
Originally published on PlayCISO. Drafted with AI assistance.
