Self-custody: a practical wallet safety checklist

Treat wallet setup as a small operational project. Before funding it, you should be able to explain how you will receive funds, authorize a transfer, recover after losing a device, and recognize a request you should refuse. A wallet that opens successfully has passed only the first check.

1. Separate everyday access from long-term storage

Bitcoin.org recommends keeping only a limited balance available for everyday spending and considering offline storage for savings. A hardware wallet keeps signing keys on a separate device, but you still need to check what you authorize. Choose a setup you can operate and recover confidently; additional complexity is not automatically additional protection.

• Install from the provider’s verified website or official app listing. Save the address you verified for future visits.
• Keep the wallet and operating system updated. Record the wallet type and network separately from its secret backup.
• Decide which wallet you will use for unfamiliar applications and which balance you want to keep away from routine signing requests.

2. Make recovery a process you understand

Protect the recovery phrase or other backup required by your wallet. Never send it to support or enter it into a website claiming to verify your account. Ethereum.org advises against photographing or cloud-storing a recovery phrase. Follow your wallet’s documented backup-check process; do not improvise a recovery test on an unfamiliar website.

Bitcoin.org also highlights physical loss and inheritance planning. Think through access if your phone breaks, your home is inaccessible, or someone must handle your affairs. Keep instructions understandable without casually exposing the secret itself. A second copy can improve resilience only if its storage does not create an easier route to theft.

3. Check the transfer before confirming

• Match the asset and network at both ends. A familiar ticker alone is not an identity check.
• Verify the recipient address on the signing device when available. Read the amount and network fee before approving.
• Use a small test amount that the destination will accept, allowing for fees or minimum deposits. Verify receipt at the destination before sending the remaining amount.
• For an application interaction, read the requested permissions. Token approvals can give a contract ongoing spending access; review and revoke approvals you no longer need.

4. Practice the pause

Imagine an email says your wallet provider was breached and you must migrate within an hour. Your first task is to establish what happened, not to obey the deadline. Open a previously verified channel independently. An email-system incident and exposed signing keys are different events; the headline alone does not establish which applies to you.

Write down three questions: What component was affected? Did I disclose a secret or authorize a transaction? What recovery steps does the verified provider recommend for that specific incident? This keeps a vague alarm from turning into an unrelated and irreversible action. Reject anyone promising recovery in exchange for your phrase.

Your final readiness check

Before increasing the balance, explain the recovery process in your own words, locate your verified support channel, and repeat the transfer checks without help. If a step is unclear, resolve it while the amount at risk is still small. Revisit the checklist whenever you change devices, wallet software, or the applications you use.