Wallet security: a practical checklist for self-custody

The one rule above the rest

Your recovery phrase, often called a seed phrase, is the master key to every account in your wallet. Anyone who has it can move your assets from any device, at any time, without your knowledge. There is no password reset and no fraud department that can reverse the transfer.

That is why the most important rule is also the simplest. No genuine wallet maker, exchange, protocol, support agent, tax preparer or government agency needs your seed phrase to help you.

Seed phrase, private key and address: what each one is

A private key is the secret that signs transactions for a single address. A seed phrase is a list of words from which a wallet generates many private keys, so it protects every address in that wallet at once. An address is public: it is what you share to receive funds.

The Ontario Securities Commission's investor site notes that if you hold crypto directly and lose your private key, the asset simply becomes inaccessible, and that keys stored on paper, a USB drive or in software can be stolen or hacked. Both loss and theft are permanent in the same way.

Check 1: Where your recovery phrase lives

The safest place for a recovery phrase is offline, in a form only you can reach. Copies saved in a photo library, notes app, email draft or cloud drive can be exposed by a single account breach. A phrase typed into a website is, in effect, handed to whoever runs that website.

A hardware wallet keeps private keys on a separate device and signs transactions there, so the keys never touch your computer. The Canadian Anti-Fraud Centre advises buying hardware wallets directly from the manufacturer, since a device bought second-hand or from an unofficial seller may have been tampered with.

• Is your phrase written down offline and kept somewhere secure, with a backup in a separate place?
• Is it absent from your photos, cloud storage, email and password-free notes?
• Did you generate it yourself on a new device, rather than receive it pre-printed?
• Would a trusted person know how to find it if you could not?

Check 2: Which contracts can spend your tokens

To use a DeFi app, you usually grant it an approval, also called an allowance, that lets its contract move a token from your wallet. Many apps request an unlimited approval by default, so you do not have to approve again next time. That approval stays active until you revoke it, even after you stop using the app.

If that contract is later exploited or upgraded maliciously, any unlimited approval you left behind can be used to drain the approved token. Reviewing and revoking old approvals costs a little gas each time; the gas breakeven calculator helps put that cost against the size of the balances involved.

Check 3: What you are actually signing

Wallets show a prompt before every signature, but some prompts are hard to read. An off-chain signature request can authorize a transfer just as a transaction can, without any gas cost to warn you. A request labelled as a login or verification can sometimes be a permission to spend tokens.

Address poisoning is another quiet trick: an attacker sends a tiny transfer from an address that looks like one you use, hoping you copy it from your history next time. Checking the full address, not just the first and last few characters, defeats it.

Smart contract risk explains how a compromised website can ask you to sign something harmful while the underlying protocol is fine.

Check 4: Who is contacting you

Most wallet thefts start with a message. The OSC's investor site lists red flags including fraudulent platforms that look like legitimate sites, unsolicited contact asking for crypto wallet details, requests to install remote-access software, and offers to help recover lost money. The Canadian Anti-Fraud Centre warns that recovery scams target people who have already lost funds and often ask for a fee or remote access.

The common thread is urgency combined with a request for access: to your seed phrase, your screen, a signature or a payment. Pausing to verify a contact through a channel you found yourself, such as a bookmarked official site, removes most of that pressure.

Check 5: How your wallets are separated

Using one wallet for everything means one mistake can expose everything. Many people keep a small hot wallet for everyday DeFi use and a separate wallet, often on a hardware device, for longer-term holdings that rarely interact with new contracts.

Separation limits the damage from an approval or signature that goes wrong. It also makes records cleaner, which helps with the ACB calculator and with understanding custody risk across platforms and contracts.

If something goes wrong

If you believe a wallet is compromised, the priority is to stop further loss: move any remaining funds, using a clean device, to a new wallet with a new recovery phrase, and revoke outstanding approvals. A phrase that has been exposed cannot be made safe again.

Fraud can be reported to the Canadian Anti-Fraud Centre and to local police. Be especially wary of anyone who contacts you afterward offering to recover the funds; that is a known follow-up scam.

Questions to ask before you deposit

• Is your recovery phrase stored offline only, and never typed into a website or app?
• Was your hardware wallet bought directly from the manufacturer?
• When did you last review and revoke token approvals you no longer use?
• Do you read each signature request and check the full receiving address?
• Are everyday DeFi activity and longer-term holdings kept in separate wallets?
• Do you reach apps through saved bookmarks rather than search ads or links in messages?
• Do you know where to report fraud if it happens?