Crypto Wallet Security Checklist: How to Protect Seed Phrases, Hardware Wallets, and Exchange Accounts

Overview

There are three separate security problems to manage: protecting the credentials that control funds, protecting the devices used to access them, and confirming that every transaction is going to the intended destination. A strong password cannot compensate for a leaked seed phrase, and a hardware wallet cannot prevent a user from approving a malicious transaction.

A seed phrase, sometimes called a recovery phrase, is the master backup for a self-custody wallet. Anyone who obtains it may be able to recreate the wallet on another device. It should therefore be treated as a secret key, not as a password that can be reset. Never enter it into a website, form, chat, customer-support conversation, cloud document, screenshot, or unverified wallet application.

Exchange accounts work differently. The exchange generally holds the private keys, while the user protects the login, email account, withdrawal settings, and authentication methods. This can be convenient, but it introduces account, platform, and withdrawal risks. The right setup depends on the purpose of the funds, the user’s technical confidence, and the consequences of losing access.

Use this checklist as a decision aid rather than a guarantee. No wallet type removes every risk, and storing funds across several platforms can make oversight harder if records and recovery plans are incomplete.

Checklist by scenario

Setting up a new self-custody wallet

• Download the wallet only from the developer’s official website or a recognized app store listing. Check the publisher, spelling, and links carefully.
• Create the wallet in a private environment. Do not allow another person to watch, photograph, or record the recovery phrase.
• Write the phrase on a durable physical medium and store it in a secure location. Keep it offline and separate from the device used to access the wallet.
• Confirm that the backup works according to the wallet’s documented recovery process before transferring a significant balance.
• Record the wallet’s supported networks and address formats. Sending an asset on the wrong network can make recovery difficult or impossible.
• Make a small test transaction before sending a larger amount. Compare the first and last characters of the destination address, then verify the complete address where practical.

Using a hardware wallet

• Purchase from the manufacturer or an authorized channel, and inspect packaging and setup guidance without relying on unsolicited instructions.
• Initialize the device yourself. Treat a prewritten recovery phrase or a request to type a phrase into a computer as a serious warning sign.
• Set a device PIN that is not reused elsewhere. Keep the device and recovery backup in separate secure locations.
• Install firmware and companion software only through official channels. Verify that the wallet displays the recipient and amount on its own screen before approving.
• Review connected applications and revoke permissions that are no longer needed. A wallet connection can remain a risk even after a transaction is complete.

Hardening an exchange account

• Use a unique, long password stored in a reputable password manager. Do not reuse the exchange password for email or other financial services.
• Secure the associated email account first. Enable strong authentication there and review forwarding rules, recovery addresses, and logged-in sessions.
• Prefer a phishing-resistant method or an authenticator-based method when supported. Avoid relying on text messages alone for high-value accounts where stronger options are available.
• Enable withdrawal confirmations, address allowlists, account locks, and transaction notifications if the platform provides them.
• Access the service through a saved, verified address rather than links in messages. Treat urgent requests, giveaways, investment offers, and supposed support contacts as untrusted until independently verified.
• Keep only the amount needed for trading or payments on an exchange, subject to your own liquidity and risk requirements.

Moving funds or interacting with DeFi

• Confirm the network, token contract, recipient address, amount, and transaction fee before signing.
• Read the permission request. An approval may allow a contract to move a token later, so avoid unlimited approvals when a smaller allowance is practical.
• Use a separate wallet for experimental applications, collectibles, or unfamiliar token launches. Do not expose the wallet holding long-term savings to every website.
• For bridges and complex transactions, use a small test amount first and keep a record of the source and destination transaction IDs. For additional context, see the bridge risk guide.

What to double-check

Recovery phrase handling: A legitimate support representative should not need your phrase. If it has been exposed, assume the wallet is compromised and move remaining assets to a newly created wallet using a clean device. Do not simply create a new account under the exposed phrase.

Addresses and network selection: Malware and social-engineering scams can replace copied addresses or pressure users to skip verification. Compare the destination carefully and confirm the network in both the wallet and the receiving service.

Authentication recovery: Strong two-factor authentication is useful only if its recovery process is understood. Store backup codes offline, identify which devices can approve logins, and remove old devices after replacing a phone.

Physical access: A device PIN protects against some forms of access but does not replace a protected recovery phrase. Review who can access your phone, computer, hardware wallet, backup locations, and email recovery methods.

Permissions and sessions: Review wallet connections, token approvals, exchange sessions, API keys, and browser extensions periodically. Delete unused API keys and disable trading or withdrawal permissions unless they are necessary.

Records and taxes: Keep transaction records without storing sensitive secrets alongside them. A separate record of wallet addresses, platforms, and acquisition information can help with account recovery and tax reporting. For general jurisdictional context, consult CoinPost’s guide to how countries may treat crypto for tax purposes: crypto tax treatment by country.

Common mistakes

• Saving a seed phrase in the cloud: Notes, email, password-manager attachments, and photographs may be exposed through account takeover or synchronization.
• Trusting search ads or social media support: Impersonators often use familiar branding. Start from the official domain or application and never share secrets to “verify” ownership.
• Approving a transaction without reading it: A familiar website name does not prove that the requested contract or amount is safe.
• Using one wallet for everything: Separating long-term holdings from everyday activity limits the damage from a malicious connection or mistaken approval.
• Ignoring small test transfers: A test can reveal an incorrect network or address before a larger amount is at risk.
• Assuming a hardware wallet makes every action safe: It protects key material, but the user can still sign a harmful transaction or connect to a fraudulent application.
• Failing to plan for incapacity: A secure setup should include a lawful, carefully designed recovery plan for trusted beneficiaries without exposing the seed phrase unnecessarily.

When to revisit

Review this checklist at least twice a year and immediately after a major change. Useful triggers include buying a new phone or computer, replacing an authenticator, changing an email address, moving funds to a new chain, installing a new wallet, connecting to an unfamiliar application, or hearing of a vulnerability affecting a wallet or exchange you use.

After any suspected compromise, stop signing transactions and disconnect the affected device or application. From a clean device, change exposed account credentials, revoke sessions and permissions, contact the platform through its official support channel, and move assets only after confirming the destination wallet is secure. Keep evidence such as transaction IDs, domains, messages, and timestamps; it may help with an investigation or account-support request.

For a practical review, print or copy this final list: verify the recovery backup; test account recovery without revealing secrets; update devices and wallet software; inspect exchange sessions and API keys; review wallet permissions; confirm emergency contacts and records; and make a small test transfer before any major move. Security is strongest when these checks become a routine performed before action, not a response after funds are lost.