Most people think about security after something goes wrong. Drained wallet. Phishing site. Exchange collapse. Seed phrase stored in the notes app that got hacked.
Security in crypto isn't complicated. Just consistently ignored until it's too late.
Phishing. Fake MetaMask website. Fake Uniswap interface. Fake wallet support in Discord. Fake airdrop claiming page.
Looks legitimate. Has a professional design. Sometimes even appears in Google ads above the real site. One wrong click, wallet connection, transaction approval. Funds gone.
Simple defense: never click crypto links from DMs. Never from Twitter replies. Never from Discord messages even from accounts that look official. Type URLs directly or use bookmarks. One habit. Eliminates most phishing exposure immediately.
Legitimate wallet support never asks for a seed phrase. Not once. Not under any circumstances. No exception exists. Anyone asking for it is stealing funds. Doesn't matter how official the account looks or how urgent the problem sounds.
The seed phrase controls everything. Whoever has it owns the wallet completely. No verification needed. No password required. Just the words.
Never digitally. Not in notes app. Not in email. Not in cloud storage. Not in a photo. Not in a password manager. Any digital storage is a potential remote attack surface. Device gets hacked, cloud account gets breached, seed phrase goes with it.
Write it on paper. Store it somewhere physically secure. Multiple copies in separate locations. House fire destroys one copy, second copy elsewhere means nothing is lost.
Metal backup plates exist specifically for seed phrases. Fireproof. Waterproof. Stamped permanently. Worth using for anything significant. Cryptosteel and Bilodeau make popular versions. One-time cost. Permanent protection.
Never photograph the seed phrase to show someone. Never type it into any website or app after initial wallet setup. Never share it with anyone for any reason.
Software wallet on a phone or browser is convenient. Also permanently connected to the internet which means permanently exposed to remote attacks.
Hardware wallet keeps private keys completely offline. Transactions sign on the device itself. Keys never touch an internet-connected environment. Remote hacking effectively impossible.
Ledger is the most widely used. Nano X and Nano S Plus both work well. Widest token support. Available globally. Most people starting with hardware wallets go with Ledger because of the ecosystem and the familiarity.
Trezor is the main alternative. Open source firmware. Fully auditable code. Czech company. Model T and Safe 3 both solid options. Some security researchers prefer Trezor specifically because the open source nature allows independent verification.
Coldcard if holding Bitcoin specifically and want the most security-focused option available. Air-gapped signing. Never needs USB connection. Popular among serious Bitcoin holders who've thought carefully about threat models.
Device gets lost or breaks. Buy a new one. Enter the same seed phrase. Wallet fully restored. The hardware wallet isn't the wallet. The seed phrase is the wallet. Device is just a secure interface for signing transactions.
For active DeFi and memecoin trading a hardware wallet creates too much friction. Confirming every transaction on a physical device while trying to catch a fast-moving Solana launch is impractical.
Separate hot wallet specifically for trading. Small balance. Only what's being actively traded.
Main holdings on hardware wallet. Trading allocation in the hot wallet. If the hot wallet gets drained through a bad approval or a phishing moment, painful but not catastrophic. Main holdings completely untouched.
This separation is how experienced traders manage the tradeoff between security and speed. Not either/or. Both, applied correctly to different purposes.
Every DeFi interaction grants an approval. Token contract permission to spend from the wallet. Usually unlimited. Sits there forever unless manually revoked.
Old approval from a protocol used once in 2022. Still active. If that protocol gets exploited or the approval itself gets targeted, wallet gets drained through a permission that was forgotten about.
Revoke.cash shows every active approval across EVM wallets. Connect the wallet. See every outstanding permission. Revoke anything unrecognized or no longer needed. Takes five minutes. Worth doing monthly on any active wallet.
Solana works differently but same principle. Be careful about what programs get approval to interact with token accounts.
Funds on a centralized exchange are not in personal custody. Company holds them. Company fails, funds at risk.
FTX was the second largest exchange in the world in 2022. Billions in customer funds missing when it collapsed. Customers became unsecured creditors in bankruptcy proceedings.
Keep only what's needed for active trading on exchanges. Significant holdings in personal custody. Not paranoia. Pattern that has repeated enough times to be a clear rule.
Non-custodial trading through Click.trade means the wallet stays in personal control throughout. Spot bot executes swaps on-chain without holding funds between trades. Perps bot uses Hyperliquid which runs as an on-chain exchange. Funds never handed to a company sitting between the trade and the wallet.
Connecting to a crypto wallet on public WiFi is unnecessary risk. Coffee shop, airport, hotel. Networks where traffic can be monitored.
If trading on the go, phone data over public WiFi. Small habit. Meaningfully reduces exposure.
Device security matters too. Crypto-specific malware exists targeting seed phrases and clipboard content. Replacing copied wallet addresses with attacker addresses mid-paste. Keyloggers capturing seed phrase entry. Keeping devices updated and avoiding sketchy software downloads reduces exposure.
Burner wallet for anything risky. New protocols. Airdrop claims. Unknown contracts. Fresh wallet address with minimal funds. Main wallet never connects to anything unverified.
Seed phrase written on paper or metal. Never digital. Hardware wallet for significant holdings. Dedicated trading wallet separate from main holdings. Revoke unused approvals monthly. Bookmark crypto sites, never click links from messages. Significant funds never sitting on an exchange longer than needed.
None of it complicated. All of it consistently ignored until it isn't.
