// wallet security awareness
Billions in crypto are lost every year — not to hacked blockchains, but to phishing, weak passwords, and exposed seed phrases. Learn how to actually protect what you own.
// known threats
Understanding the attack surface is the first step toward closing it.
Fake websites, emails, and DMs trick you into entering your seed phrase or connecting to a malicious contract. The #1 cause of crypto loss.
CriticalMalware silently replaces copied wallet addresses with attacker-controlled ones. You send funds to yourself — but they go nowhere.
High RiskWriting your 12–24 word recovery phrase on paper and leaving it visible, or storing it digitally in an unencrypted file, gives anyone access.
CommonSigning a "free mint" or "approve" transaction can grant a contract unlimited access to your tokens. One click, total drain.
CriticalSoftware wallets on internet-connected devices are vulnerable to malware, keyloggers, and browser extensions that harvest private keys.
High RiskScammers impersonate support staff on Telegram, Discord, or Twitter. They ask for your seed phrase "to help" — then drain everything.
Common// wallet types
Not all wallets are equal. Pick the right one for how much you hold and how often you transact.
Always connected to the internet. Convenient for daily use, but your private keys live on a device that can be compromised.
A physical device that keeps your private keys offline. Transactions are signed on-device and only the signature is broadcast. The gold standard for security.
Requires multiple independent approvals before any transaction goes through. No single point of failure — ideal for teams or high-value holdings.
// self-assessment
Answer 8 questions to find out where your vulnerabilities are.
// anti-phishing guide
Most attacks look real. Here's how to tell them apart.
Phishers register domains that look almost identical to the real thing. "uniswap-org.com" vs "uniswap.org" — the hyphen is easy to miss at a glance.
Attackers buy domains with slight misspellings: "metamask-wallet.com" instead of the real extension. Always check each letter.
Bookmark the real site and always navigate from your bookmark — never click links in emails or DMs.
Click the padlock. Phishing sites often have invalid or suspicious certificates. But note: having HTTPS doesn't guarantee safety.
Tools like urlscan.io let you paste a link and see its reputation before visiting. When in doubt, scan first.
Always review transaction details on your device screen — phishing sites can't spoof your hardware wallet's display.
// how it works
Your seed phrase is the human-readable backup of your private key. It is the only way to recover your wallet if your device is lost or destroyed.
⚠ This is an EXAMPLE using the BIP39 standard word list. Your real seed phrase will be different. Never share it.
The BIP39 standard defines a list of 2,048 words. 12 words = 128 bits of entropy. 24 words = 256 bits. More words = exponentially harder to guess (2^256 combinations).
Your wallet creates a random number using a cryptographically secure random number generator (CSPRNG), then maps that number to words from the standardized list. No one can predict your seed.
Photos, Notes apps, cloud storage — all can be accessed by malware, synced to compromised devices, or recovered by forensic tools. Paper in a safe is the only truly air-gapped backup.
A BIP39 passphrase adds a second layer of protection. Even with your 12 words, an attacker cannot access your funds without the extra passphrase you choose. Think of it as a password for your seed phrase.
// if something goes wrong
Time matters. Move fast, but stay calm. Every second counts.
Turn off Wi-Fi and cellular data on the affected device. Revoke all token approvals using a tool like revoke.cash or app.elk.tools before the attacker can act.
Create a fresh wallet on a clean device. Transfer any remaining funds immediately. Do not reuse the compromised wallet — assume it is fully compromised.
If you still have your original seed phrase, write it down on paper and store it somewhere safe. If it was exposed digitally, generate a completely new one.
The attack vector may still be active. Run antivirus scans, check for suspicious browser extensions, and review login activity on all accounts linked to your crypto.
Report phishing domains, scam contracts, and social engineering attempts. This helps protect others and may aid investigations.
// recommended tools
These are free, open-source, or industry-standard. No affiliation — just what works.
View and revoke token spending approvals. Run this monthly and before any new dApp interaction. The #1 tool most users don't know about.
revoke.cash →Chrome/Firefox extension that blocks known phishing sites and warns you about suspicious contracts in real time. Install it once, forget about it.
scamsniffer.com →Check current gas prices before transacting. Timing matters — transactions during low-traffic periods cost significantly less.
ethgaswatch.info →Before interacting with any contract, verify its source code on Etherscan. Look for functions like "approve", "transferFrom", and ownership renouncement.
etherscan.io →The two most established hardware wallet brands. Both support 100+ coins, offer open-source firmware, and have been operating safely since 2014–2015.
ledger.com → trezor.io →The most widely used multi-signature wallet on Ethereum. Requires multiple approvals for transactions. Free to deploy, battle-tested since 2018.
safe.global →// lessons from history
History repeats. Learn from these failures so you don't become the next statistic.
A smart contract vulnerability in Poly Network's bridge allowed an attacker to drain funds. The hacker returned most funds after a bounty negotiation, but the incident exposed critical bridge security gaps.
Sky Mavis admitted that 5 of 9 multi-sig key holders were compromised by a sophisticated nation-state actor. The attacker used social engineering to obtain the keys — not a code bug.
Private keys for cold storage wallets were compromised through a third-party vendor. Bybit covered all losses, but the incident showed how supply-chain attacks bypass even the best security.
The Hammurabi botnet used AI-generated phishing sites mimicking popular DeFi protocols. Over 70,000 wallets drained in a single coordinated campaign. Most victims clicked links from fake Discord servers.
// security checklist
Run through these before every transaction. Make them muscle memory.
// protection guide
Follow this sequence. Each step builds on the last — don't skip ahead.
Step 01
Never store your 12–24 word recovery phrase digitally. Write it on paper, store it in a fireproof safe, and never photograph it or save it in any cloud service.
Step 02
For any amount over $1,000, use a Ledger, Trezor, or similar cold wallet. Your private keys never touch an internet-connected device — making remote theft virtually impossible.
Step 03
Check URLs character-by-character, verify contract sources on block explorers, and never approve unlimited token spend. Slow down — one second of caution prevents total loss.
// rules of the road
These aren't suggestions. They're the difference between keeping your assets and losing them.
// terminology
Terms you need to know to stay safe.
A 12 or 24-word list that back up your wallet. Anyone with these words can restore and control your funds. Never share it.
A cryptographic secret that proves ownership of funds. Your seed phrase generates your private keys. Keep it offline.
Your wallet address — the identifier others use to send you funds. Safe to share publicly.
A physical device (like Ledger or Trezor) that stores private keys offline. Transactions are signed on-device.
A wallet connected to the internet — browser extensions (MetaMask), mobile apps. Convenient but less secure.
A wallet requiring multiple independent approvals before a transaction executes. Eliminates single points of failure.
Fraudulent attempts to obtain sensitive data by disguising as a trustworthy entity — fake websites, emails, or DMs.
The industry standard for generating seed phrases. Defines the 2,048-word list and the deterministic wallet generation process.
A decentralized application. Interacting with dApps requires signing transactions — always verify what you're approving.
Granting a smart contract permission to spend your tokens on your behalf. Always set the minimum necessary amount and expiry.
A secondary wallet with minimal funds used only for interacting with unfamiliar dApps. Isolates risk from your main holdings.
An extra security layer beyond your password. Use an authenticator app (Google Authenticator, Authy) — never SMS-based 2FA.
// self-assessment
Check what you already do — and find out where you're still exposed.
// practice ground
Learn to spot dangerous transactions before you sign them. Try these real-world scenarios.
// take it offline
Download and print this card. Write your 12 or 24 recovery words by hand. Never store digitally.
Write your recovery words below in order. Keep this card in a safe, offline location.
// your progress
Track your security learning journey. Complete sections to unlock badges.
// test your password
Test how strong your crypto passwords are. We never store or send your password.
// spot the fake
Can you spot which URLs are fake? Test your eye for detail.
Is this URL legitimate or phishing?
// find your wallet
Tell us about your usage and we'll recommend the best wallet type for you.
// chain-specific
Different chains have different risks. Learn how to stay safe on each one.
Focus on token approvals and contract verification. Use revoke.cash monthly. Watch for phishing sites mimicking Lido, Uniswap, and Aave.
High phishing risk due to airdrop scams. Verify SPL token contracts. Never connect wallet to unofficial "airdrop" sites.
Simpler attack surface but watch for fake exchanges and wallet apps. Use multisig for large holdings. Store seed phrase offline.
Bridge security is critical. Only use official bridges. Cross-chain attacks have drained billions. Verify bridge URLs manually.
// advanced risks
Advanced threats for DeFi users and NFT collectors.
Only provide liquidity to audited protocols. Start with small amounts.
Always verify project Twitter/Discord. Never sign unknown approvals.
// mobile safety
Your phone is a target. Protect it.
Review what each app can access. Wallet apps should not need camera or contacts access.
Never connect to wallet apps on public WiFi. Use VPN or cellular data for transactions.
Keep your phone updated. Security patches fix known vulnerabilities that could expose your keys.
Avoid casting your wallet screen to TVs or projecting. Screenshots may be stored in gallery.
// plan ahead
What happens to your crypto if something happens to you?
💡 If your family cannot access your seed phrase, your crypto is lost forever. Plan ahead today.
// utilities
Local tools to help you track and manage your security.
Log your token approvals locally. Get reminders to review them monthly.
New device setup guide. Ensure your phone/computer is secure before using wallets.
Printable template for logging your transactions for tax and security review.
No one can recover your wallet if you lose your seed phrase. Protect it like the only copy of everything you own — because it is.