How to use a crypto wallet safely: rules that actually work

If you read “my crypto got stolen” stories, almost none of them are about clever hackers. They’re about a seed phrase saved in phone notes, a link from “support” in DMs, or someone hitting “confirm” without reading. The good news: a few simple habits protect you from all of that.

Your seed phrase is your money

The 12 or 24 words your wallet shows you when you create it give full access to everything. Whoever knows the phrase owns the funds.

• Write it down on paper (or better, a metal plate — it won’t burn or get wet) and keep it somewhere safe at home.
• No screenshots, notes, cloud storage or “I’ll send it to my Saved Messages in Telegram”. Anything that syncs can leak sooner or later.
• Don’t share it with anyone. Not support, not an “admin”, not a site asking you to “sync your wallet”.

Remember one thing: a legit service never asks for your seed phrase. If someone does, it’s a scam. Period.

Support never messages first

The most common scheme on Telegram: you ask a question in a project’s group chat, and a minute later “support” DMs you. Same avatar as the project, similar name. Then comes a link to a “recovery form” or a request to “verify your wallet”.

Real support never messages you first. If you need help, go to support yourself, through the official website or bot.

Links and phishing

• Open wallet and exchange sites from your bookmarks, not from search results or chat links. Scammers buy search ads and make copies of sites that differ by one letter.
• Be extra careful with “airdrops” and “giveaways” that ask you to connect your wallet.
• Random tokens or NFTs showed up in your wallet? Don’t touch them and don’t follow links in their names. That’s classic bait.

Look at what you sign

When you connect your wallet to a site, it may ask for permission (an approval) to spend your tokens. Sign that on a scam site and your funds can be drained without you doing anything, even later.

• Read what you’re signing. If it’s unclear, don’t sign.
• Check and revoke old approvals from time to time, for example with revoke.cash.

Address poisoning

There’s a sneaky trick: a scammer sends you a tiny transaction from an address that starts and ends the same way as one you often send to. They’re hoping next time you’ll copy the address from your history.

• Copy addresses from a trusted source, not from your transaction history.
• Check the whole address, not just the first and last characters.
• Before a big transfer, send a test of a couple of dollars.

Basic hygiene

• Use app-based two-factor authentication on exchanges (Google Authenticator, Aegis and so on), not SMS.
• Use a separate email for crypto that you don’t use anywhere else.
• Install wallets only from official app stores or official websites, and keep your phone updated.
• For experiments (memecoins, new sites), set up a separate wallet with a small amount. Don’t move your main funds there.
• Don’t show off your balance on social media or in chats.

If you do get hacked

1. Immediately move whatever is left to a new wallet with a new seed phrase. Stop using the old one.
2. Revoke approvals with revoke.cash.
3. If the funds went to an exchange, contact that exchange’s support with the transaction hash. Sometimes they manage to freeze the funds.
4. Don’t fall for “crypto recovery services” that reach out to you. That’s almost always a second scam.

In short

Seed phrase on paper, and only with you. Support never messages first. Sites from bookmarks. Read what you sign. Large amounts go to a cold wallet.

Sounds obvious, but these rules cover almost every real way people lose money.