Wallet security: what each measure protects against, and what it does not

Security advice in crypto tends to arrive as a list of instructions without the reasoning. That is a problem, because a measure applied without understanding what it defends against produces confidence rather than safety.

Where funds are actually lost

Losses cluster into a small number of categories. Remote compromise of an internet-connected device holding keys. Approving a malicious transaction voluntarily. Losing the backup. Sending to a wrong or substituted address. And platform failure, where the funds were never under your control to begin with.

Each defence below addresses some of these and none addresses all.

Custody: the decision that precedes every other

If your assets sit on an exchange, you hold a claim against a company, not the asset. No amount of personal security practice protects you from that company failing, freezing withdrawals, or being compelled to. Conversely, a non-custodial wallet removes that exposure entirely and hands you the whole operational burden, with no reset and no support line.

Neither is correct in general. What matters is knowing which one you have chosen, because most people who believe they hold Bitcoin actually hold an entry in a ledger operated by someone else.

Hardware wallets and cold storage

Cold storage keeps keys on a device that has never been connected to the internet. Transactions are signed on the device, and the key never leaves it.

What it defends against: remote compromise. Malware on your computer cannot extract a key that is not there.

What it does not: a hardware wallet signs whatever you confirm on it. If you approve a malicious contract interaction, the device executes it faithfully. It does not protect a seed phrase you photographed. And a device bought from an unofficial reseller may have been tampered with before it reached you — always buy direct and verify the packaging.

The seed phrase is the whole wallet

A seed phrase regenerates every key in the wallet. Anyone holding it holds the funds, regardless of what hardware you own.

This produces two failure modes that pull in opposite directions. Store it too accessibly — a photo, a cloud note, a password manager entry, an email to yourself — and a single account compromise takes everything. Store it too carefully and you risk losing it entirely, which is just as final. The resolution is physical redundancy: written or stamped, in more than one location, so that a fire or a burglary destroys one copy and not the set.

The one rule with no exceptions: no legitimate wallet, exchange, support agent, airdrop or recovery service will ever ask for your seed phrase. Every request for it is theft. This is worth internalising as an absolute, because the requests arrive at moments designed to make you rush.

Approvals: the modern attack

Interacting with a smart contract usually requires granting it permission to move a token on your behalf, and those permissions are frequently unlimited and permanent unless revoked. A contract you approved months ago can drain that token later.

What defends against it: reviewing what you are signing rather than clicking through, granting limited allowances where the wallet supports it, and periodically revoking approvals you no longer use. A separate wallet for experimental interactions, holding little, contains the damage.

What does not: a hardware wallet, which will sign the approval exactly as asked.

Address substitution

Malware that swaps a copied address for the attacker’s is long-standing and effective, because almost nobody reads a long string carefully. Transfers are irreversible, so this is a total loss.

What defends against it: verifying the address on the hardware device’s own screen rather than the computer’s, and sending a small test amount first for any large or unfamiliar transfer. Checking the first and last few characters is better than nothing, and attackers now generate addresses matching those.

A useful discipline across all of these is to separate holdings by purpose. A spending wallet with a small balance, used for routine interactions, and a long-term wallet that never touches an unfamiliar contract, limits any single mistake to the amount you were willing to expose. Most catastrophic losses involve one wallet doing every job.

Phishing and the moment you are rushed

Most successful attacks are not technical. They are a message that creates urgency — a security alert, a failed transaction, an airdrop expiring, support responding unusually fast to a complaint you posted publicly — followed by a link to a convincing replica of a site you use.

What defends against it: never following links from messages to anything involving your funds, and instead navigating there yourself from a bookmark. Treating unsolicited contact from “support” as hostile by default, since legitimate support does not initiate contact about your wallet. And recognising urgency itself as the signal: the pressure to act immediately is the attack, not a feature of the situation.

What does not: any hardware. A phishing site that persuades you to enter a seed phrase or approve a transaction has bypassed every device you own.

The failure nobody plans for

Self-custody has an unusual property: the security measure that protects your funds from everyone else also protects them from your own family. Keys held solely by one person, with no documented recovery path, become permanently inaccessible if that person is incapacitated or dies.

There is no clean solution, only trade-offs. Splitting a phrase across locations, using a multi-signature arrangement requiring more than one key, or leaving sealed instructions with a solicitor each reduce the single point of failure while introducing a party who could collude or fail. What does not work is assuming it will not come up. Decide deliberately how the funds would be recovered without you, and write it down somewhere that does not itself compromise the keys.

What none of this covers

None of these measures protects against a protocol failure, a stablecoin depegging, or a project turning out to be a rug pull. Those are asset-selection risks, not custody risks, and no wallet configuration addresses them. Nor does any of it help against coercion, which is why publicly discussing holdings is its own category of risk.

The honest summary is that security is a set of specific defences against specific attacks, and the value of knowing which is which is that you stop assuming one covers the others.