A Beginner's Guide to Safe Crypto Storage

What you are actually holding

A wallet does not contain coins. The coins are entries on a public ledger. What the wallet holds is a private key, and the private key is the only thing that can authorise moving those entries.

A seed phrase — usually twelve or twenty-four ordinary words — is a human-readable form of that key. Anyone who has the words has the funds. That is not a figure of speech and there is no recovery process, no support line, and no reversal.

This is the whole of the security model, and everything below follows from it.

Custodial or self-custody: pick deliberately

Leaving assets on an exchange means the exchange holds the key. You get password resets, support, and two-factor authentication. You also carry the exchange's own risk — and several large, apparently reputable exchanges have failed with customer assets inside them.

Self-custody means you hold the key. Nobody can freeze it and nobody can lose it on your behalf. You also carry the entire operational burden, permanently.

Neither is correct in general. A common and reasonable split is to keep an amount you are actively trading on a reputable exchange and move anything you intend to hold for a long time into self-custody.

Hot wallets, cold wallets, and what each is for

A hot wallet is software on an internet-connected device — a browser extension or a phone app. Convenient, and exposed to anything that compromises the device.

A cold wallet is a dedicated hardware device that signs transactions internally and never reveals the key to the computer it is plugged into. Even a fully compromised computer cannot extract it.

• Use a hot wallet as a spending wallet. Keep in it only what you would accept losing.
• Use a cold wallet for anything you would be genuinely upset to lose.
• Buy hardware wallets directly from the manufacturer. Never second-hand, never from a marketplace listing. A pre-configured device with a seed phrase already in the box is a known and recurring attack.
• Initialise the device yourself and generate a new seed on it. If a device arrives with a printed seed phrase, it is compromised. Return it.

Storing the seed phrase

The goal is a copy that a burglar cannot read, a fire cannot destroy, and you cannot lose. Those three pull against each other, which is why this needs thinking about once rather than improvising.

• Never photograph it, never type it, never store it in a password manager, a notes app, an email draft, or cloud storage. The moment it exists as a file it is exposed to everything that reaches that file.
• Write it on paper as a starting point, and stamp it into steel if the amount justifies the cost. Paper survives neither fire nor a burst pipe.
• Keep at least two copies in separate physical locations. A single copy means one house fire ends it.
• Do not store a copy in the same place as the hardware device. Together they are the funds.
• Consider a passphrase — an extra word only you know, held separately from the written seed. It means a found seed phrase alone is not enough. It also means forgetting it loses everything, so this is a deliberate trade.
• Write down where the copies are, for the people who would need to find them. Inheritance is the most-ignored failure mode in this entire subject.

How people actually get robbed

The attacks that succeed are overwhelmingly social rather than technical. They are worth knowing by name because they are highly repetitive.

• Fake support. Nobody legitimate will ever ask for your seed phrase. Not an exchange, not a wallet developer, not a moderator who messaged you first. There is no situation in which the request is genuine.
• Lookalike sites. A sponsored search result, a domain one character different, a perfect copy of the real interface. Bookmark the real address and use only the bookmark.
• Malicious approvals. Connecting a wallet to a site can grant that site standing permission to move specific tokens. Review approvals periodically and revoke ones you no longer use.
• Clipboard hijacking. Malware that swaps a copied address for the attacker's. Always check the first and last several characters of a pasted address before confirming.
• Airdrops of unknown tokens. Interacting with a token that appeared in your wallet uninvited is a common route into an approval you did not intend to give.

A sane routine

Send a small test amount first, every time you use a new address. The fee is trivial compared to the alternative.

Check the receiving address on the hardware device's own screen, not on the computer. That screen is the part an attacker cannot change.

Review your token approvals every few months and revoke anything unfamiliar.

Keep the total on any internet-connected wallet at an amount you would shrug at.