Crypto Wallet Safety: Seed Phrases, Approvals and Phishing

A crypto wallet is the tool you use to hold, send and receive digital assets and to interact with applications such as decentralized exchanges. Unlike a bank account, many crypto wallets have no customer service that can reverse a mistake or restore stolen funds. That makes good security habits essential. This guide covers the main types of wallets, the golden rules for protecting your seed phrase, how token approvals work, and how to avoid the phishing tricks that cause many losses.

Custodial vs non-custodial wallets

A custodial wallet is one where a company, such as a centralized exchange, holds the private keys for you. You log in with a username and password, and the company manages security and recovery. The convenience is real, but you depend on the company staying secure, solvent and willing to let you withdraw.

A non-custodial wallet, such as MetaMask or Phantom, or a hardware wallet such as Ledger, gives you the private keys. Nobody else can move your funds, but nobody else can help if you lose access either. The saying “not your keys, not your coins” describes this trade-off: full control comes with full responsibility.

Seed phrase rules

When you create a non-custodial wallet, you receive a seed phrase, also called a recovery phrase, usually 12 or 24 words. Anyone who has these words can recreate your wallet and take everything in it, from anywhere in the world. Treat it as the most sensitive information you own.

• Never share your seed phrase with anyone, including people who claim to be support staff, developers or friends offering help.
• Never type your seed phrase into a website, form, chat or browser extension other than the official wallet app when you are intentionally restoring a wallet.
• Do not store it as a screenshot, photo, cloud note, email or message, because online accounts and devices can be compromised.
• Write it down on paper or a durable metal backup and store it offline in a secure place. Consider keeping a second copy in a separate safe location.
• Check that you wrote every word correctly and in the right order before you deposit funds.

💡 No legitimate wallet, exchange, project or support agent will ever ask for your seed phrase. A request for it is always a scam.

Token approvals and how to revoke them

On EVM chains such as Ethereum, BNB Chain and Base, before a DEX or other application can move a token from your wallet, you must approve it. An approval gives a specific smart contract permission to spend a certain amount of a token on your behalf. Many apps request unlimited approvals for convenience, so you do not need to approve again for every trade.

The risk is that approvals remain active until you remove them. If the approved contract is malicious or later gets exploited, it can move the approved tokens without asking you again. Many wallet-draining scams work by tricking people into signing an approval on a fake site.

1. Read the approval request in your wallet carefully: check which token, which contract and what amount it covers.
2. Where possible, approve only the amount you need instead of an unlimited amount.
3. Periodically review your active approvals using your block explorer’s token approval tool or a reputable approval-checking tool.
4. Revoke approvals you no longer use. Revoking is itself a transaction and costs a small gas fee.

Solana works differently, but signing a malicious transaction can still give an attacker control over your tokens, so the same principle applies: understand what you sign.

Hardware wallets

A hardware wallet is a small physical device that keeps your private keys offline. Transactions are confirmed on the device itself, so even if your computer has malware, an attacker cannot sign transactions without physical access and your PIN. Hardware wallets are a common choice for people holding significant amounts over the long term.

Buy hardware wallets only from the manufacturer or authorized resellers, never second-hand, and set them up yourself so that the device generates a new seed phrase. A device that arrives with a pre-filled seed phrase is a sign of tampering. Remember that a hardware wallet does not protect you from approving a malicious transaction; you still need to read what the device asks you to confirm.

Phishing, fake support and careful signing

Most wallet losses come from deception rather than technical hacks. Common tactics include:

• Lookalike websites for popular wallets, exchanges and DEXs, often promoted through search ads or links in messages.
• Fake support accounts that reply to your public questions on social media and invite you to a private chat or form.
• Unknown tokens or NFTs appearing in your wallet with a link to a claim site.
• Urgent messages saying your wallet will be locked or compromised unless you act immediately.

Before you sign anything, slow down. Confirm that you are on the correct website, read what the wallet says the transaction will do and reject anything you do not understand. Be very cautious with signature requests that are not clearly linked to an action you started. For extra safety, many people use a separate wallet with small balances for experimenting with new apps and keep their main holdings in a wallet that never connects to unfamiliar sites. CoinBoard’s risk information can help you notice red flags in a token before you interact with it.

Do your own research

Wallet security is ultimately your responsibility, and new scam techniques appear all the time. Keep your software updated, learn how your wallet displays transactions and verify information from official sources. If something feels urgent, too good to be true or confusing, stop and investigate before signing. This article is for educational purposes only and does not endorse any specific wallet or product.