Crypto wallet basics and security

Exchange account vs your own wallet

• On an exchange (custodial), the company holds the coins and you log in with a password. It’s simple and you can usually recover a lost login, but you rely on the exchange staying solvent, honest and open to you. Several large exchanges have failed and frozen customer funds.
• In a self-custody wallet, you hold the keys yourself. Nobody can freeze or lose your funds for you, but nobody can recover them for you either. This is the kind of wallet you need to use DeFi.

Many people use both: an exchange to buy and sell with their bank, and their own wallet for everything else.

Your seed phrase is the wallet

When you create a self-custody wallet it shows a seed phrase (also called a recovery phrase), usually 12 or 24 words. Anyone with those words can take everything in the wallet, from anywhere, without your password.

• Never share your seed phrase with anyone. No real support team, app or airdrop will ever ask for it.
• Write it down on paper (or metal) and keep it somewhere safe and private. Avoid screenshots, cloud notes, email and password managers that sync online.
• Never type it into a website. The only time you enter it is to restore a wallet in the wallet app itself.

Hardware wallets

A hardware wallet is a small device that keeps your keys offline and asks you to confirm each transaction on its own screen. That protects you even if your computer has malware. They’re worth considering once you hold more than you’d be comfortable losing. Buy one only from the maker or an authorized seller, and never use one that arrives with a seed phrase already set up.

Phishing and scams

• Fake websites that copy real apps, often reached through search ads, DMs or fake support accounts.
• “Support” or “recovery” agents who contact you first. Real ones won’t.
• Offers that sound too good: guaranteed returns, doubling schemes, surprise airdrops that ask you to connect and sign.
• Signature requests that hand over control of your tokens. If you don’t understand what you’re signing, don’t sign it.

Bookmark the sites you use, keep your wallet and browser updated, and use a separate wallet with small amounts for trying new apps.

Clean up old approvals

Every app you’ve approved to spend a token can keep that permission until you remove it. Check now and then with a tool such as revoke.cash or your block explorer’s token approval checker and revoke anything you no longer use. Revoking costs a small gas fee. More detail in how to swap safely.