Crypto wallet security best practices are the habits that stop theft and loss: keep most funds in a hardware wallet, store the recovery phrase offline, use phishing-resistant two-factor authentication on exchange accounts, revoke unused token approvals, and verify every address before sending. Most crypto losses come from scams and stolen keys, not broken cryptography.
Why do crypto wallets get hacked?
Attackers rarely break blockchain cryptography. They target the person holding the keys. The FBI's Internet Crime Complaint Center (IC3) received 181,565 complaints involving cryptocurrency in 2025, with reported losses of $11.37 billion, and phishing and spoofing was the most-reported crime type of the year with 191,561 complaints (FBI IC3 2025 Internet Crime Report). The common routes to a drained wallet are:
- Social engineering: fake support agents, fake investment platforms and phishing pages that ask for a recovery phrase or a login code.
- Malicious approvals: a signature that lets a contract spend your tokens, often requested by a fake airdrop or mint page.
- Malware: clipboard hijackers that swap a pasted address, fake wallet apps and browser extensions.
- Account takeover: SIM swaps and reused passwords used to break into exchange or email accounts.
- Loss: a missing or damaged backup, which locks you out as permanently as a theft.
How should you split funds between cold, hot and burner wallets?
Separating wallets by purpose limits how much any one mistake can cost. A hardware wallet keeps keys on a dedicated device; a software wallet keeps them on an internet-connected phone or computer.
| Wallet role | What it holds | How it is used |
|---|---|---|
| Cold (hardware) wallet | Long-term savings you rarely move | Signs only planned transfers; never connects to new or unknown apps |
| Hot (software) wallet | A spending balance you could afford to lose | Everyday payments and trusted apps |
| Burner wallet | Only enough for one task plus network fees | New decentralised apps, mints and airdrops; emptied afterwards |
How do you protect your recovery phrase?
A recovery phrase is the 12 to 24 words defined by the BIP-39 standard that can rebuild every key in a wallet. Write it by hand, keep it offline, never photograph it or store it in cloud notes, and never type it into a website. A fire-resistant metal backup kept somewhere private protects against fire and flood. Our guide to storing a recovery phrase offline compares paper, metal and split backups.
Which account protections matter most?
- Phishing-resistant 2FA: CISA calls FIDO/WebAuthn security keys and passkeys the only widely available phishing-resistant method and treats SMS codes as a last resort, and NIST SP 800-63B-4 classes SMS as a "restricted" authenticator. Our explainer on two-factor authentication for crypto ranks each option.
- Unique passwords: use a password manager so a breach at one site cannot unlock your exchange account.
- A locked-down email: your email can reset every other password, so give it the strongest 2FA you use anywhere.
- Updated devices: install wallet apps only from the developer's official site or app-store listing, and keep the operating system patched.
How do token approvals put your wallet at risk?
On Ethereum and BNB Smart Chain, a decentralised exchange or marketplace needs your permission (an "approval" or "allowance") to move tokens on your behalf. Many apps request an unlimited allowance by default. If that contract is later exploited, or the site was malicious all along, the attacker can transfer the approved tokens without your recovery phrase. Off-chain "permit" signatures and NFT "set approval for all" requests work the same way.
- Read every signing prompt; if a wallet shows an approval when you expected a simple swap, stop.
- Approve only the amount you plan to use when the app allows it.
- Review and revoke old allowances with a block explorer's token approval checker (Etherscan, BscScan).
Fake mint and airdrop pages are the usual source of malicious approvals; see how to spot crypto phishing for examples.
How do you send crypto without costly mistakes?
- Check the whole address. "Address poisoning" scams send you tiny transfers from look-alike addresses so you copy the wrong one from your history.
- Match the network. USDT exists on several chains; sending BEP-20 USDT to an address on another network can lose it.
- Send a test amount first for large or first-time transfers, and confirm it arrives before sending the rest.
- Verify on the device screen, not only on your computer, when using a hardware wallet.
Advanced protections: which extra steps suit large holdings?
Once a balance would be painful to lose, these measures remove the risk that one stolen piece of paper or one compromised device empties the wallet.
Passphrase (the "25th word")
BIP-39 lets you add an optional passphrase on top of the recovery phrase. Every passphrase produces a different valid wallet, so a thief who finds your written words sees only the wallet without the passphrase. Store the passphrase separately; losing it means losing the funds behind it.
Shamir backup (SLIP-39)
Shamir's Secret Sharing splits a wallet secret into shares, for example 3 shares of which any 2 rebuild the wallet. Under the SLIP-39 standard, holding fewer shares than the threshold reveals nothing about the secret, so one stolen or burned share is neither a theft nor a loss. Only some hardware wallets support it, and it is not compatible with ordinary BIP-39 phrases.
Personal multi-signature wallet
A 2-of-3 multi-signature setup uses three separate keys, ideally on hardware from different vendors kept in different places, and needs any two to move funds. Our guide to how multi-signature wallets work explains thresholds and their trade-offs.
Air-gapped signing
Some hardware wallets sign transactions without a USB or Bluetooth connection, passing data by QR code or memory card. This reduces exposure to malware on the computer, although you must still check what you are signing.
What should you do if a wallet is compromised?
Move any remaining funds to a new wallet created on a clean device, revoke approvals and report the theft. The full checklist is in what to do if your wallet is hacked.
Self-custody or a custodial fund?
Wealtii is a custodial service, so you do not manage a recovery phrase for your Wealtii funds; your account password and authenticator-app 2FA are what you protect. In exchange you rely on Wealtii as custodian. Fund assets are held 1:1 in a Gnosis Safe 3-of-3 multi-signature vault on BNB Smart Chain that anyone can check on BscScan, and they are not lent or staked. Wealtii is not regulated, has no insurance and has not yet had a third-party security audit. Details are on the Wealtii security and custody page.
Frequently Asked Questions
What is the most important crypto wallet security practice?
Protect your recovery phrase. Anyone who sees it controls every coin in that wallet, on every blockchain the wallet supports. Write it down offline, never type it into a website or app other than the wallet itself, and never share it with anyone who contacts you, including people who claim to be support staff.
Is a hardware wallet enough on its own?
No. A hardware wallet keeps private keys off your computer, but it cannot stop you from approving a malicious transaction or revealing your recovery phrase to a scammer. Pair it with an offline backup, careful reading of every signing prompt, and a separate low-value wallet for new apps.
How often should I revoke token approvals?
Check your approvals at least every few months and after using any new decentralised app. Block explorers such as Etherscan and BscScan offer token approval checkers that list which contracts can spend your tokens. Revoking costs a small network fee but removes access you no longer need.
Should I add a passphrase to my hardware wallet?
A passphrase (sometimes called a 25th word) protects you if someone finds your written recovery phrase, because the phrase alone opens a different, empty wallet. The trade-off is that a forgotten passphrase cannot be reset, so you must back it up separately from the recovery phrase.
Sources & References
- FBI Internet Crime Complaint Center — 2025 Internet Crime Report (accessed 21 Oct 2026)
- CISA — Implementing Phishing-Resistant MFA (October 2022) (accessed 21 Oct 2026)
- NIST SP 800-63B-4 — Digital Identity Guidelines: Authentication (accessed 21 Oct 2026)
- BIP-39 — Mnemonic code for generating deterministic keys (accessed 21 Oct 2026)
- SLIP-0039 — Shamir's Secret-Sharing for Mnemonic Codes (accessed 21 Oct 2026)
Disclaimer: This content is for educational purposes only and does not constitute financial, tax, or legal advice. Digital assets are volatile and carry risk of loss.
