A wallet holds keys. It does not hold “coins in an app” the way a bank app holds a balance. If someone gets your keys, or tricks you into signing a bad transaction, the funds can leave for good. This guide stays practical. No scare theater. The goal is a repeatable safety routine you can keep when the market is boring and when a headline is screaming.
Self-custody is powerful because it removes a venue middleman. It is also unforgiving because there is no friendly call center that can reverse a signature you approved while tired. Treat that tradeoff with respect and you will make fewer expensive mistakes.
Who this is for
Beginners setting up self-custody, and intermediate users who want a cleaner safety checklist. If you only use an exchange account, still read the seed-phrase section. You may move off-exchange later. People who already “know this stuff” often skip the boring parts until a phishing DM arrives at midnight. This guide is for them too.
It is also for anyone helping a friend set up a wallet. Walking someone through custody is a responsibility. If you rush them, you inherit part of the blast radius when they paste a seed into a fake support form three weeks later.
Prerequisites
- A device you control
- Willingness to write a seed phrase on paper (not in screenshots)
- Time to verify URLs and transaction details slowly
- A plan for where paper backups live when you travel or move apartments
- Acceptance that convenience and maximum security rarely peak at the same setting
Steps
Do not try to perfect every layer on day one. Get the seed offline, learn to read prompts, and separate spending money from savings money. Advanced tooling can wait until the basics feel boring.
1. Choose the right custody for the job
Exchange accounts are convenient. They also introduce venue risk. Self-custody gives you control and responsibility. Many people use both: a small hot wallet for spending, colder storage for savings. Match the tool to the job. A weekend NFT mint does not need the same vault as rent money you cannot replace.
Ask what failure looks like for each bucket. Exchange failure can mean withdrawal queues, freezes, or insolvency drama. Self-custody failure can mean phishing, malware, or a lost backup. Naming the failure mode keeps you honest about which risk you are actually choosing.
If you are new, start with a small amount you can emotionally afford to lose while learning. That is not pessimism. It is tuition with a hard cap. Scale custody quality as balances grow, not after a scare forces the issue.
2. Protect the seed phrase
Your seed phrase is the master backup. Anyone with it can recreate the wallet. Store it offline. Never type it into a “support” website. Never share it in chat. See seed phrase and self-custody.
Write it clearly. Check the word list against the wallet’s official word list if you are unsure of spelling. Store at least one copy somewhere fire-and-water aware. A single sticky note in a laptop sleeve is not a plan. A photo in a cloud album is an invitation.
People lose funds by “just emailing myself a copy for later.” Later arrives as a breach, a shared family iCloud, or a phone repair shop with lingering access. Paper feels old-fashioned because it is. Old-fashioned is often the point.
If you ever typed a seed into a keyboard that might be compromised, treat those keys as burned. Move funds to a new wallet created on a clean path. Do not negotiate with maybe.
3. Verify sites and extensions
Phishing sites copy logos well. Bookmark official URLs. Check extension names carefully. If a stranger DMs you with help, it is almost never help. Fake support agents thrive on urgency, screenshots of your ticket number, and polite pressure to “verify” a wallet.
Extension stores can host lookalike names. Read the publisher, the install count pattern, and whether the URL matches what the project documents. When in doubt, wait. A delayed mint is cheaper than a drained account.
Search results can be poisoned around breaking news. Pair this guide with how to follow crypto news without getting played. Phishing often arrives dressed as a listing, an airdrop, or a “mandatory migration.”
4. Read approvals before you sign
Token approvals can let a contract move funds later. Unlimited approvals are common and dangerous. Revoke unused approvals with a reputable revoke tool for your chain. If you do not understand the prompt, do not sign it.
Connection is not the same as spending permission. Viewing a site can require a connection. Moving tokens usually requires a clearer approval or transfer prompt. If a prompt looks like a blank check, treat it like one. Blind signing on hardware devices deserves the same skepticism as blind clicking in a browser.
Keep a short log of what you approved and why. When a protocol falls out of use, revoke. Hygiene is not glamorous. Neither is explaining to yourself how a forgotten approval emptied a bag.
5. Test with a small send
When you move size to a new address, send a tiny test first. Confirm arrival. Then send the rest. This feels slow. It is cheaper than a mistyped address. Copy-paste errors, wrong network selections, and memo-less deposits to exchange addresses that require memos all still happen to careful people.
Check the network, the asset, and the destination address character by character for the first and last groups. If a UI auto-fills an address from a recent phishing site you visited, that auto-fill is not your friend. Clear it and paste from your own verified book.
For large moves, split across time if that reduces operational risk for you. Speed is rarely the scarce resource. Correctness is.
6. Separate “daily driver” money from “I cannot lose this” money
Hot wallets are fine for amounts you can afford to learn with. Life-changing sums belong behind better operational hygiene: hardware devices, offline backups, fewer browser connections. See hot wallet and cold wallet.
Do not connect the savings wallet to every new mint, claim portal, and mystery airdrop checker. That pattern turns a vault into a daily driver by accident. Keep experimental activity on an experimental wallet with experimental balances.
Revisit the split when balances change. A hot wallet that was fine at a small size can become reckless after a rally. Update the architecture on calm days, not during a liquidation scramble.
Common mistakes
- Storing seed phrases in cloud notes or photos
- Signing because a site looked urgent
- Keeping savings on the same wallet you use for every new mint and airdrop
- Ignoring gas fees until a transfer fails mid-panic
- Reusing one address everywhere public so every airdrop hunter can map your holdings
- Updating wallet software from a random link in a reply guy thread
- Assuming hardware wallets make phishing impossible
- Skipping the test send because “I already double-checked”
Hardware wallets raise the bar. They do not remove the need to read what you sign. Social engineering still works if you approve the wrong payload carefully.
If something already feels wrong
Stop signing. Move remaining funds to a fresh wallet generated offline if you still control the keys. Rotate passwords on exchange accounts. Do not paste your seed into any “recovery” form. Real support will not ask for it.
Document what you clicked, what you signed, and when. That record helps you avoid repeating the same trap. It also helps you explain the incident without rewriting history to protect your ego.
Related: how to follow crypto news without getting played (phishing often arrives as breaking news), and how to read a market snapshot so panic price moves do not push you into rushed transfers.
Browser wallet reality check
Most people meet self-custody through a browser extension. That is fine for learning. It is also where phishing is easiest. Keep a separate browser profile for wallet use if you can. Fewer random tabs means fewer surprises.
When a site asks to connect, ask what it needs. Viewing a balance is different from spending rights. If the prompt looks like a blank check, treat it like one. Disable unused extensions. Lock the wallet when you walk away. These are small frictions that block large accidents.
Mobile wallets have their own risks: malicious clipboard apps, overlay attacks, and rushed approvals on a small screen. Zoom the details. If you cannot read the contract interaction clearly, do not approve it from a bumpy train seat.
Backup drill (do this once)
On a calm day, practice restoring a throwaway wallet from its seed on a second device. Confirm you can recover. Then delete the throwaway. The first time you restore should not be during a panic.
If that drill feels annoying, good. Annoying drills prevent expensive lessons. Pair this with the literacy guide so you do not click “urgent” recovery links from social feeds.
After the drill, write a one-page custody map for yourself: where the seed lives, which wallet is hot, which is cold, which exchange accounts matter, and who you would call if you were incapacitated. Estate planning is part of safety even if crypto culture pretends otherwise.