Crypto Wallet Security Checklist

Before installing a wallet

1. Start from a known domain. Type the official address or use a previously verified bookmark. Search ads and look-alike domains can imitate a wallet brand.
2. Confirm the publisher. Check the app-store developer or operating-system signature, not only the icon and product name.
3. Update the device. Install operating-system, browser and security updates before creating or importing a wallet.
4. Remove unnecessary access. Uninstall remote-control tools and browser extensions you do not need. Each privileged component expands the attack surface.

NIST recommends timely software updates because known vulnerabilities remain exploitable on unpatched systems. If a device no longer receives security updates, do not make it the long-term home of a valuable hot wallet.

When creating or restoring

5. Work in private. Stop screen sharing, cover cameras and prevent people or recording systems from seeing the backup.
6. Keep the phrase offline. Do not photograph, email, print through a shared printer or upload recovery words.
7. Use a unique local password. A long password protects the wallet file or application from casual device access, although it cannot neutralize a stolen phrase.
8. Check the backup method. Understand whether the wallet uses a mnemonic, an encrypted backup file, individual keys or more than one method.

Read the dedicated recovery phrase guide before funding a new wallet. A backup is part of the security system, not paperwork to postpone.

Protect connected accounts and devices

9. Secure email and app-store accounts. Use unique passwords and phishing-resistant multifactor authentication where available.
10. Lock and encrypt devices. Enable automatic screen lock, full-disk encryption and a protected device backup.
11. Separate risky activity. Use a dedicated browser profile for Web3 and avoid pirated software, unknown attachments and unofficial wallet add-ons.
12. Match balance to exposure. Keep only a working amount in a frequently connected wallet; consider offline signing for longer-term holdings.

NIST identifies FIDO/WebAuthn authenticators as a widely available phishing-resistant option. Multifactor authentication protects related service accounts; it does not protect a recovery phrase entered into a phishing page.

Before every transaction

13. Verify the asset and network. The same ticker can exist on several networks, and a destination may support only one.
14. Check the address independently. Compare the first and last characters after pasting. For a large transfer, confirm through a second trusted channel.
15. Read the wallet confirmation. Inspect the amount, destination, network fee and any smart-contract permissions rather than approving by habit.
16. Use a test transfer. Send a small amount before a new route or a material balance, then verify it on the correct block explorer.

For decentralized applications, avoid unlimited token allowances when a limited amount will work. Disconnecting a site from the wallet interface does not necessarily revoke an on-chain approval.

During support and security alerts

17. Open support yourself. Navigate through the verified application or official domain. Ignore unsolicited direct messages and urgent calls.
18. Keep secrets secret. No legitimate support agent needs a recovery phrase or private key. Do not install remote-access software at an agent’s request.

The FTC warns that urgent messages claiming a wallet is blocked are a common phishing pattern. Slow down, avoid the embedded link and contact the company through a channel you already know.

If something looks wrong

• Exposed phrase: create a new wallet on a separate trusted device and move assets to new addresses.
• Suspicious approval: stop interacting, review permissions through a trusted tool and revoke unnecessary allowances when doing so is safe.
• Compromised device: disconnect it from networks, do not use it to create replacement keys and preserve details needed for a report.
• Provider purchase fraud: contact the payment provider or exchange immediately and report the incident to the appropriate authority.
• Stolen funds: beware of anyone promising guaranteed recovery for a fee or asking for more crypto.

Repeat the review

Every three to six months, inventory wallet applications, browser extensions, connected sites, token approvals, backup locations and emergency contacts. Remove what you no longer use and update written instructions after any migration.

Security should match the value and activity. Use the hot-versus-cold guide to separate daily access from longer-term storage, and use the wallet selection framework before adopting new software.

Know what the checklist cannot guarantee

No checklist proves that software, a device or a blockchain is free of vulnerabilities. Controls reduce specific risks and make suspicious events easier to notice. Reassess the setup when balances, transaction habits, household access or software dependencies change; yesterday’s reasonable controls may not fit a materially larger exposure.