Crypto Wallet Security: The Complete Checklist

A crypto wallet security checklist in six parts: recovery phrase, devices, accounts and 2FA, sending, approvals and planning, with a score to find weak spots.

What does wallet security actually protect you from?

Crypto thieves rarely break encryption. A standard recovery phrase has so many possible combinations that guessing one is hopeless, as our seed phrase guide shows with the numbers. What fails is everything around the keys: a phrase typed into the wrong page, an address swapped between copy and paste, a signature that hands over tokens, or an exchange account reset through a hijacked phone number.

That is good news, because each of those failures maps to a habit you control. The table below lists the six main ways people lose crypto and the section of this checklist that addresses each one.

The scale is real. Microsoft’s threat researchers describe six families of attacks on hot wallets alone, from clipboard swapping to fake wallet apps. One academic study counted 270 million address-poisoning attempts against 17 million targets on two networks between July 2022 and June 2024, with at least $83.8 million lost.

How to use this checklist

Each item below carries a weight: 3 for critical items that can cost you everything on their own, 2 for important items and 1 for good practice. Your score is the weight you have checked divided by the total weight. Our interactive wallet security checklist uses the same method and the same bands:

• 0–49%: At risk. At least one path to a total loss is probably open.
• 50–79%: Fair. The basics are in place, with real gaps.
• 80–100%: Strong. Keep it that way with regular reviews.

The decision rule matters more than the score: fix unchecked critical items before anything else. A strong score with one critical gap is still one mistake away from losing everything.

Which sections matter most for you?

1. Recovery phrase

Your recovery phrase is the master key. Anyone who has it can rebuild your wallet on their own device, with no PIN or password in the way. The SEC’s investor bulletin on custody is direct: store your seed phrase in a secure place and do not share it with anyone. It also warns that a private key “cannot be changed or replaced.”

• Critical (3): Stored only offline. Paper or metal, never photographed, emailed or saved in cloud notes. Microsoft’s researchers advise never storing seed phrases digitally.
• Critical (3): Never typed into a website, app or chat. The only place it belongs is the wallet device during a restore.
• Important (2): Two copies in separate secure places, tested. Restore on the device to confirm the words are right.

Warning: No legitimate wallet maker, exchange or support agent will ever ask for your recovery phrase. Anyone who does is trying to steal from you. Our list of crypto scam red flags covers the scripts they use.

A one-question test catches most phrase-stealing tricks: did you just choose “Restore wallet” on your own device, on your own initiative? If not, don’t type the words. For the storage details, including how many copies to keep, see how to store a recovery phrase safely.

2. Devices and wallets

Microsoft’s list of attacks on hot wallets includes clipboard swapping, reading keys from memory, stealing wallet files, keylogging, and phishing sites and fake apps. All of them depend on keys sitting on a device that also browses, downloads and opens email.

• Important (2): Long-term holdings in cold storage. A hot wallet holds spending money only. Our comparison of hot and cold wallets shows how to size each pot.
• Important (2): Official sources and updates. Install wallet apps and browser extensions only from official sources, and keep the operating system updated. See browser extension wallet safety.
• Good practice (1): A separate low-balance wallet for new apps, airdrops and unknown tokens, so experiments never touch your savings.

If a pasted address ever differs from the one you copied, stop and read about clipboard hijacker malware before using that device for crypto again.

3. Accounts and 2FA

Exchange accounts and the email behind them are often the easiest way to reach someone’s crypto. CISA calls FIDO/WebAuthn, the standard behind security keys and passkeys, “the only widely available phishing-resistant authentication,” and lists SMS codes as vulnerable to phishing and SIM swaps.

• Critical (3): Strong 2FA on email and exchanges. A security key or passkey first, an authenticator app second, SMS only if nothing else exists, with SMS removed as a fallback.
• Important (2): Unique passwords on every crypto-related account, ideally from a password manager.
• Important (2): A PIN or password on your phone carrier account.

Secure your email first, because it can usually reset everything else. An exchange login protected by a security key, but recoverable through an email that uses SMS codes, is effectively protected by SMS. Our guides to two-factor authentication that works and SIM-swap attacks cover the setup and the warning signs.

4. Before you send

A confirmed transfer can’t be reversed, and a scammer’s address passes every format check your wallet runs.

• Critical (3): Addresses from the source or a verified address book, never copied from transaction history.
• Important (2): The full address checked, in chunks, and confirmed on the hardware wallet screen when you use one.
• Good practice (1): A small test transfer first for large or first-time sends.

Look-alike addresses match only the first and last few characters; in the example in our guide to address poisoning, all 32 middle characters differed, 80% of the address. Transaction history is exactly where those look-alikes get planted, and how to verify a crypto address walks through a full routine.

5. Approvals and signing

Signing is where cold storage can’t save you: a hardware wallet signs whatever you approve. As ethereum.org’s guide to revoking access warns, a platform with unlimited access to a token “can spend all those tokens even if you have withdrawn your funds from their platform into your wallet.”

• Important (2): Read every signature request, and refuse anything you can’t understand.
• Important (2): Review token approvals every few months, and revoke stale, unlimited or unrecognized ones.

A useful way to size the risk: each approval can move the smaller of its allowance and your balance, so an unlimited approval on a token you hold exposes the whole balance. Our guides to reviewing and revoking token approvals and blind signing explain what to look for.

6. Planning

Security also means your crypto survives your own mistakes and absences.

• Important (2): A written incident plan. Know the first steps you’d take if a wallet or account were compromised; what to do if your wallet is compromised is a good template.
• Good practice (1): A trusted person knows your plan exists and where your instructions are kept, without ever holding your recovery phrase. Crypto inheritance planning covers the details.
• Good practice (1): A withdrawal address allowlist switched on at each exchange that offers one.

A one-page incident plan needs only four lines: where your backup copies are kept (never the words themselves), how to reach each exchange through its official app or website and freeze withdrawals, which clean device you would use to set up a new wallet, and where to report theft in your country.

Worked example: scoring a typical setup

The 17 items above add up to 34 weight points: four critical items (12 points), nine important items (18 points) and four good-practice items (4 points).

Example: Suppose you check every item except six: addresses from the source (3), strong 2FA (3), approval reviews (2), an incident plan (2), test transfers (1) and a trusted person (1). That leaves 12 points unchecked.

Two changes, both cheap or free, did most of the work: switching email and exchanges to a security key or authenticator app, and sending only from verified addresses. That is the pattern to expect. The critical items are few, cheap to fix and responsible for the worst outcomes.

A 30-minute start if you do nothing else

If the full list feels like too much today, this order covers the critical items first. The times are rough guides.

1. Minutes 0–5: check your recovery phrase. Confirm it exists only offline. If you find a photo or digital copy, assume the phrase is exposed and plan a move to a new wallet with a new phrase.
2. Minutes 5–15: upgrade your email. Switch to a security key, passkey or authenticator app, and remove SMS as a fallback.
3. Minutes 15–25: upgrade each exchange. Same change, plus a withdrawal allowlist if one is offered.
4. Minutes 25–30: review approvals on your main wallet. Revoke anything you don’t recognize or no longer use.

How often should you run the checklist?

• Every quarter: review token approvals, the balance in hot wallets and on exchanges, and each account’s 2FA method.
• Every year: confirm your backup copies are readable, test a restore on the device, and update your incident plan and instructions for family.
• Right away: after a new phone or computer, a lost device, a phishing scare, a SIM or carrier change, or a big change in what you hold.

Common mistakes that undo good security

• Treating a hardware wallet as a force field. It protects keys, not judgment.
• Securing the exchange but not the email. The weakest recovery path sets the real level of protection.
• Keeping everything in one hot wallet because moving funds feels like a hassle.
• Acting under pressure. Urgency is a classic scam tactic; a real deadline can wait five minutes.
• Replacing a compromised wallet but keeping the old phrase. A new wallet needs a new recovery phrase.

The bottom line

Wallet security comes down to a short list of habits: keep the recovery phrase offline and unshared, protect email and exchanges with phishing-resistant 2FA, verify every address against its source, and read what you sign. Score yourself, fix critical items first, and repeat the review every quarter. The fixes that matter most usually cost nothing but attention.

This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.