A wallet holds keys. It does not hold “coins in an app” the way a bank app holds a balance. If someone gets your keys, or tricks you into signing a bad transaction, the funds can leave for good. This guide stays practical. No scare theater.
Who this is for
Beginners setting up self-custody, and intermediate users who want a cleaner safety checklist. If you only use an exchange account, still read the seed-phrase section. You may move off-exchange later.
Prerequisites
- A device you control
- Willingness to write a seed phrase on paper (not in screenshots)
- Time to verify URLs and transaction details slowly
Steps
1. Choose the right custody for the job
Exchange accounts are convenient. They also introduce venue risk. Self-custody gives you control and responsibility. Many people use both: a small hot wallet for spending, colder storage for savings. Match the tool to the job.
2. Protect the seed phrase
Your seed phrase is the master backup. Anyone with it can recreate the wallet. Store it offline. Never type it into a “support” website. Never share it in chat. See seed phrase and self-custody.
3. Verify sites and extensions
Phishing sites copy logos well. Bookmark official URLs. Check extension names carefully. If a stranger DMs you with help, it is almost never help.
4. Read approvals before you sign
Token approvals can let a contract move funds later. Unlimited approvals are common and dangerous. Revoke unused approvals with a reputable revoke tool for your chain. If you do not understand the prompt, do not sign it.
5. Test with a small send
When you move size to a new address, send a tiny test first. Confirm arrival. Then send the rest. This feels slow. It is cheaper than a mistyped address.
6. Separate “daily driver” money from “I cannot lose this” money
Hot wallets are fine for amounts you can afford to learn with. Life-changing sums belong behind better operational hygiene: hardware devices, offline backups, fewer browser connections. See hot wallet and cold wallet.
Common mistakes
- Storing seed phrases in cloud notes or photos
- Signing because a site looked urgent
- Keeping savings on the same wallet you use for every new mint and airdrop
- Ignoring gas fees until a transfer fails mid-panic
If something already feels wrong
Stop signing. Move remaining funds to a fresh wallet generated offline if you still control the keys. Rotate passwords on exchange accounts. Do not paste your seed into any “recovery” form. Real support will not ask for it.
Related: how to follow crypto news without getting played (phishing often arrives as breaking news).
Browser wallet reality check
Most people meet self-custody through a browser extension. That is fine for learning. It is also where phishing is easiest. Keep a separate browser profile for wallet use if you can. Fewer random tabs means fewer surprises.
When a site asks to connect, ask what it needs. Viewing a balance is different from spending rights. If the prompt looks like a blank check, treat it like one.
Backup drill (do this once)
On a calm day, practice restoring a throwaway wallet from its seed on a second device. Confirm you can recover. Then delete the throwaway. The first time you restore should not be during a panic.
If that drill feels annoying, good. Annoying drills prevent expensive lessons. Pair this with the literacy guide so you do not click “urgent” recovery links from social feeds.