DeFi Security Best Practices: How to Keep Your Wallet Safe

Security is the one part of DeFi where mistakes are permanent. There is no fraud department, no chargeback, and no "forgot password" link. If someone obtains your seed phrase, or you approve the wrong contract, the funds are gone and nobody can reverse it.

That should sound alarming, because it is. The reassuring part is that the overwhelming majority of losses come from a small number of repeated mistakes, and every one of them is avoidable with habits that take minutes to learn.

This guide covers those habits, roughly in order of how much damage they prevent.

1. Your seed phrase is the wallet

When you set up a wallet you are given a list of words, usually twelve or twenty-four. This is the seed phrase, sometimes called a recovery phrase or mnemonic.

Those words are not a backup of your wallet. In a meaningful sense they are your wallet. Anyone who types them into any wallet application, anywhere in the world, gets full and immediate control of everything they hold. No further confirmation is needed.

That single fact drives the rules:

Write it on paper, not on a device. A phrase stored in a screenshot, a notes app, a password manager, an email draft, or a cloud backup is one breach away from being taken. Paper cannot be read remotely.
Never type it into a website. No legitimate service, support agent, airdrop claim, wallet migration or "validation" page ever needs it. Every request for it is theft, without exception.
Never photograph it. Phone photos sync to the cloud by default.
Store a second copy somewhere physically separate. Fire and flood destroy funds just as effectively as thieves do.
Nobody legitimate will ask. Not support, not a moderator who messages you first, not a developer, not us.

If you are still setting up, our guide to setting up your first wallet covers the process in order.

2. Use a hardware wallet once the balance matters

A software wallet keeps its keys on a device that browses the internet. A hardware wallet keeps them on a small dedicated device that never exposes them, and signs transactions internally. Malware on your computer can read a software wallet's keys. It cannot extract keys from a hardware wallet.

The common devices are made by Ledger and Trezor, among others. The choice of brand matters far less than the decision to use one at all.

Practical guidance:

Buy direct from the manufacturer. Never buy a used device, and never buy from a third-party marketplace seller. Tampered devices with pre-set seed phrases are a known attack.
Generate the seed on the device itself. If a device arrives with a phrase already printed on a card, it is compromised. Discard it.
A hardware wallet does not make you immune. It protects your keys, not your judgement. If you approve a malicious contract on a hardware wallet, you have still approved it.

There is no universal threshold at which a hardware wallet becomes necessary. A reasonable test is whether losing the balance would genuinely hurt. If it would, the cost of a device is small by comparison. Our wallet comparison covers the options.

3. Token approvals, the most underrated risk

This is the one that catches people who otherwise do everything right, because it does not feel like a security decision at the time.

To let a protocol move a token on your behalf, you grant it an approval. Many applications request an unlimited approval by default, so you are not authorising one transaction, you are giving that contract standing permission to move that token from your wallet indefinitely.

If that contract is malicious, or is later exploited, the permission is still live and can be used at any point in the future. People have lost funds to approvals they granted months earlier to a protocol they had long since stopped using.

What to do:

Set a spending limit where the interface allows it, rather than accepting unlimited by default.
Review your approvals periodically using a revocation tool, and revoke anything you no longer use. Reach these tools by typing the address yourself, not by following a link.
Revoke immediately if a protocol you have used is reported as exploited. The permission outlives your involvement with the project.
Remember revoking costs a network fee. It is worth it.

4. Assume every link is hostile

Most theft does not involve breaking cryptography. It involves persuading you to sign something on a convincing copy of a site you trust.

Bookmark the sites you use and reach them only through those bookmarks.
Distrust search adverts. Paid results impersonating major protocols are a recurring problem. Scroll to the organic result, or use your bookmark.
Treat unsolicited contact as hostile by default. Anyone messaging you first offering support, a refund, an airdrop or an urgent security check is running an attack. Real support does not initiate contact.
Be sceptical of urgency. "Your wallet is at risk, migrate now" is a pressure tactic designed to stop you thinking.
Ignore unexpected tokens that appear in your wallet. Interacting with them is sometimes the trap itself.

Our guide to common DeFi scams covers the specific patterns.

5. Read what you are actually signing

A wallet prompt is a contract, not a dialogue box to click through. Slow down at this exact moment, because it is the last point at which anything is reversible.

Check the site address in the prompt matches the site you believe you are on.
Be wary of signature requests that are not transactions. Some off-chain signatures grant permissions or authorise transfers without an obvious fee, which makes them feel harmless. They are not.
Use a wallet that previews the outcome where possible. Several wallets now simulate a transaction and show what will leave your wallet before you confirm. If the preview shows an asset leaving that you did not intend to move, reject it.
If anything is unclear, reject. You can always retry. You cannot un-sign.

6. Separate your wallets

Do not hold everything in the address you use for day-to-day experimentation.

A workable split is a "hot" wallet holding only what you are actively using and can afford to lose, and a separate long-term wallet, ideally on hardware, that never interacts with new or unfamiliar protocols. Compromise of the first then costs you a small balance rather than everything.

Some people go further and use a fresh address for anything genuinely untested. That is sensible, not paranoid.

7. Check the protocol before you interact

Before committing funds to something unfamiliar:

Has it been audited, and by whom? An audit is evidence of review, not a guarantee of safety. Audited protocols have still been exploited.
How long has it operated, and with how much value? Time and scale are imperfect but real signals.
Is the team identifiable? Anonymity is not automatically disqualifying, but it removes accountability if things go wrong.
Does the return make sense? Yields far above everything comparable are pricing in a risk you have not identified yet, or are not real.

8. If you think you have been compromised

Act in this order, quickly:

Move remaining assets to a new wallet with a brand-new seed phrase generated on a clean device.
Revoke outstanding approvals from the affected address if you can still transact.
Treat the old address as permanently unsafe. Never reuse it, even after it appears quiet.
Do not engage with "recovery" services. Anyone contacting you offering to retrieve stolen crypto for a fee is running a second scam on the same victim. Recovery is essentially never possible.

Building the habit

None of this requires technical expertise. It requires slowing down at three moments: when you store your seed phrase, when you grant an approval, and when you sign a transaction. Almost everything that goes wrong goes wrong at one of those three points.

Security is also the reason to be sceptical of anything urging speed. Pressure to act immediately is a feature of scams and rarely a feature of good decisions.

For the wider risks of using DeFi at all, beyond the security question, see disclaimers and risks. If you are still getting oriented, key DeFi concepts explains the underlying terms.