How to protect your crypto wallet: 9 steps that actually matter

Most crypto losses are not clever attacks on the blockchain. They are ordinary mistakes at the edges: a seed phrase photographed, a fake website, a signature given too quickly. The good news is that a few habits close most of the gaps. Here are nine that matter, in rough order of impact.

1. Separate your savings from your spending

Keep a small balance in the wallet you connect to apps, and keep long-term holdings somewhere else. If your everyday wallet is compromised you lose the spending balance, not the savings. This one habit does more than any other. A crypto savings vault is built for exactly this.

2. Use a hardware wallet for anything that matters

A hardware wallet keeps your private key on a dedicated device that never exposes it to your computer, which protects you from malware and remote theft. It signs what you approve, though, so it works best alongside the habits below. Compare hardware wallets, multisig and time locks.

3. Never share or digitize your seed phrase

Your seed phrase is the wallet. Nobody legitimate, including wallet makers, exchanges and support staff, will ever ask for it. Never type it into a website, send it in a chat or store it in photos, notes apps or cloud storage. Write it on paper or metal and keep copies in separate, secure places.

4. Read what you sign

Phishing relies on speed. Before you sign, check which site you are on, what your wallet says you are approving and who the recipient or spender is. Be especially wary of requests to approve all of your tokens or NFTs, and of signatures you can't read. If something is unclear, stop. The opportunity can wait.

5. Limit and revoke token approvals

When you approve a token you let a contract spend it until you revoke that permission. Review your approvals from time to time with a tool such as Revoke.cash or the token approval checker in a block explorer, and revoke the ones you don't need.

6. Open sites from bookmarks, not search or links

Scammers pay for search ads, hijack social accounts and send convincing messages. Bookmark the official sites you use and open them from the bookmark. Treat unsolicited links, airdrops and direct messages as hostile by default.

7. Keep your devices clean

• Install system and browser updates promptly.
• Use a separate browser profile for crypto, with as few extensions as possible.
• Avoid pirated software and unknown extensions.
• Use a password manager and two-factor authentication on your email and exchange accounts.

8. Add time and a second approval to your savings

Even careful people get tricked. A withdrawal delay combined with multi-key approval turns a catastrophic mistake into a recoverable one: a theft attempt has to wait, you are alerted and your other keys can cancel it. That is what a FORTCORE vault adds on top of the habits above.

9. Set up alerts and practice recovery

Know what you would do if a key was lost or stolen before it happens. Add more than one alert channel, test a recovery with a small amount and keep your recovery instructions somewhere you can find them. A plan you have rehearsed is one you can follow under stress.

What to do if you think your wallet is compromised

1. 1Stop signing anything and disconnect the wallet from every site.
2. 2From a clean device, move what you can to a new wallet with a new seed phrase. Treat the old one as permanently unsafe.
3. 3Revoke token approvals from the old address.
4. 4Change passwords and turn on two-factor authentication for the email and exchange accounts connected to it.
5. 5Contact any exchange or service involved and report the incident. Recovery is rare, but reports help others.

If your savings are in a FORTCORE vault when your everyday wallet is compromised, a thief can only queue a withdrawal. You are alerted, and two of your other keys can cancel it.