Skip to main content
Crypto Life Church logoCrypto Life Church

Wallet Safety

Cryptocurrency Wallet Safety for Beginners

What a wallet really is, why the recovery phrase must never be shared, and everyday habits that keep accounts safe.

By Crypto Life ChurchPublished 9 min read

You don't need a cryptocurrency wallet, and this article is not encouraging you to get one. But if you already have one, are thinking about it, or are helping a family member who does, a few basic safety habits make a big difference.

Cryptocurrency works differently from a bank account. There is usually no fraud department that can reverse a mistake, and no one who can reset a lost password for you. That makes understanding the basics especially important.

Key takeaways

  • Never share your recovery phrase or type it into a website, for any reason. No legitimate company, support agent, or leader will ever ask for it.
  • If you lose both a self-custody wallet and its recovery phrase, the funds may be gone for good.
  • Be careful what you “connect” or “approve.” Scammers can take funds through permissions, without your recovery phrase.
  • Send on the right network, and remember that a successful test doesn't make a recipient trustworthy.
  • Use strong passwords and multifactor authentication.
  • Cryptocurrency transactions usually can't be reversed, so double-check before sending.

What a wallet actually is

A cryptocurrency wallet doesn't hold coins the way a leather wallet holds cash. Instead, it holds the keys that prove you have the right to move cryptocurrency recorded on a blockchain, a shared public record of transactions.

A helpful comparison: your public address is like a mailbox number you can share so others can send you cryptocurrency. Your private key is like the only key to that mailbox. Anyone who has the key can take what's inside.

Types of wallets, in plain language

  • Custodial accounts. A company, such as a cryptocurrency exchange, holds the keys for you. You log in with a username and password, much like online banking. The SEC cautions that the platforms where people buy and hold crypto may lack important protections for investors (opens in a new tab), so your safety depends on both the company and your own login habits.
  • Software wallets. An app on your phone or computer that holds your keys. Convenient, but only as safe as the device it's on.
  • Hardware wallets. A small physical device that keeps your keys offline. Buy only from the manufacturer or an authorized seller, never secondhand.

Each type has trade-offs, and none is right for everyone. Crypto Life Church does not recommend specific wallets, apps, or companies.

Getting back in: account recovery vs. recovery phrases

The two kinds of wallets handle a lost login very differently.

  • Custodial account: If you forget your password or lose your phone, the company usually has an account recovery process, often with identity checks. It may be slow, but the company can help you get back in.
  • Self-custody wallet: There is no company to call. Your recovery phrase is your only backup. MetaMask's help center, for example, says that if you lose your recovery phrase and don't have it saved, “no one will be able to help you get them back.” (opens in a new tab)

If you lose access to a self-custody wallet and its recovery phrase, the funds in it may be permanently out of reach. No company, government agency, or recovery service can restore them, so be wary of anyone who says they can.

Your recovery phrase is the master key

When you set up a self-custody wallet, you are usually given a recovery phrase: a list of words, often 12 or 24, that can restore your wallet on any device. Anyone who has this phrase can take everything in the wallet, from anywhere in the world, without your password.

  • Never share it. Not with support representatives, friends, online helpers, “recovery services,” or anyone who says they represent a company or government agency.
  • Never type it into a website or app that asks you to “verify,” “sync,” “validate,” or “unlock” your wallet.
  • Store it offline. Write it on paper and keep it somewhere secure, such as a locked drawer or safe. Avoid storing it as a photo, email, or note on your phone.
  • Plan for your family. Consider how a trusted person could access your wallet if something happened to you, without exposing the phrase today.

Be careful what you connect and approve

Your recovery phrase isn't the only way in. Many crypto websites and apps ask you to “connect” your wallet, and some then ask you to “approve” or “sign” something. An approval can give a website permission to move your cryptocurrency, without ever learning your recovery phrase.

MetaMask's help center explains that a token approval is “permission for a dapp to access and move a specific type of token from your wallet” (opens in a new tab) (a “dapp” is simply an app that runs on a blockchain). It warns that requesting essentially unlimited amounts of tokens “is also how many malicious sites steal from unsuspecting web3 users.” The FBI has described a scam in which victims were persuaded to link their cryptocurrency wallets (opens in a new tab) to a fraudulent app, after which scammers wiped out their funds.

  • Only connect to sites you found on your own, not ones reached through a link, message, or ad.
  • Read every approval or signature request. If you don't understand what it allows, don't approve it.
  • Be especially cautious with unlimited spending requests, or with approvals you are told to sign to claim free tokens or rewards.
  • Clean up old approvals. Many wallets let you review and remove approvals you no longer need.

Everyday habits that keep accounts safe

The Cybersecurity and Infrastructure Security Agency's Secure Our World (opens in a new tab) program recommends four basic steps that also protect cryptocurrency accounts:

  • Use strong passwords and a password manager, with a different password for each account.
  • Turn on multifactor authentication (MFA), which requires more than a password to log in.
  • Keep software updated on your phone, computer, and apps.
  • Recognize and report phishing: fake messages designed to trick you into clicking a link or sharing information.

The FTC's guide to recognizing phishing (opens in a new tab) recommends contacting a company using a phone number or website you know is real, rather than a link in a message. You can forward phishing texts to SPAM (7726) and phishing emails to reportphishing@apwg.org.

Before you send cryptocurrency

  • Check the whole address. Cryptocurrency addresses are long strings of letters and numbers. Compare the whole address carefully every time, especially after copying and pasting.
  • Use the right network. Some cryptocurrencies can travel on more than one blockchain “network,” a bit like a package that can be shipped by different carriers. The sender and the receiver must use the same, supported network. Kraken's help center, for example, notes that some assets are offered on multiple networks and that “deposits sent on unsupported networks are likely non-recoverable.” (opens in a new tab) Before sending, confirm which network the recipient supports and choose that one.
  • Consider a small test first, and know its limits. Sending a small amount first can confirm that the address and network are right before you send more. But a test only shows that the address works. It says nothing about whether the person or platform receiving it is honest. Scammers are often happy to accept a test, or even return a small amount, to win your trust.
  • Be wary of QR codes. The FBI warns that criminals tamper with QR codes (opens in a new tab) to send people to malicious sites or redirect payments, and advises: “Do not download an app from a QR code. Use your phone's app store.” The FTC suggests you check the link (opens in a new tab) a QR code opens before you go there.
  • Remember that sending is usually final. Unlike a credit card payment, a cryptocurrency transfer usually can't be reversed. The FTC notes that cryptocurrency payments don't have the same legal protections (opens in a new tab) as credit and debit cards.
  • Ask why. If anyone is pressuring you to send cryptocurrency, stop. The FTC warns: “Only scammers demand payment in cryptocurrency.” (opens in a new tab) Some legitimate businesses do accept crypto, but none will demand it unexpectedly, with threats, urgency, or secrecy.

Warning signs

  • Anyone asks for your recovery phrase or private key.
  • A “support agent” or “recovery service” contacts you first, especially through social media.
  • A website or app asks you to enter your phrase to “verify” or “sync” your wallet.
  • A site asks you to connect your wallet or approve something you don't understand.
  • An app or browser extension comes from a link or QR code rather than an official app store or website. The FBI warns against using suspicious looking apps (opens in a new tab) unless you can verify that they are legitimate.
  • Someone offers to “help” set up your wallet remotely.

If your recovery phrase or wallet may be compromised

If anyone else may have seen your recovery phrase, because you typed it into a website, shared it with a “support agent,” or stored it somewhere that was hacked, treat that wallet as compromised. Act quickly.

  1. 1Create a brand-new wallet with a completely new recovery phrase. Never restore the old phrase into the new wallet; it would carry the same risk. If your phone or computer may be infected, or someone had remote access to it, set up the new wallet on a different device you trust.
  2. 2Move any remaining funds from the compromised wallet to the new wallet's address. Check the whole address and the network before sending.
  3. 3Stop using the old wallet and anything connected to the old phrase. If you approved anything on a suspicious site, remove those approvals too.
  4. 4Report what happened to the FBI at ic3.gov (opens in a new tab) and the FTC at ReportFraud.ftc.gov (opens in a new tab), including the transaction details (opens in a new tab) of any unauthorized transfers.

MetaMask's guidance for hacked wallets (opens in a new tab) follows the same pattern: create a new wallet, send any remaining funds to it, and stop using the old wallet and any accounts associated with the compromised phrase. It also notes that “transactions cannot be reversed, nor missing funds restored.” Moving quickly may protect what is left, but it can't undo what has already been taken.

Be wary of anyone who contacts you offering to recover stolen crypto. Never share your new recovery phrase with them, or with anyone, and never pay an upfront “recovery” fee. See What to Do If You've Been Scammed for more.

Official sources

The facts in this article come from these official resources.

Wallet and exchange documentation

Company help pages, cited only for technical details. Crypto Life Church does not recommend these or any other companies.

Learn together

Bring Crypto Safety Education to Your Community

Crypto Life Church helps churches, mosques, synagogues, temples, gurdwaras, and other faith communities educate their members about cryptocurrency, financial fraud, and online scams. Wallet safety basics are part of our introductory program, available now. Two dedicated Wallets classes, Understanding Digital Wallets and Protecting Your Recovery Phrase, are in development and will cover custodial and self-custody options, safe ways to store a recovery phrase, and planning for family and estates, without recommending any product.

Explore our educational programsPrograms for faith communities

This article is general education, not legal, financial, or tax advice. Stories marked “Illustrative example” are composite scenarios written to show how scams work; they are not real cases.

More resources

All resources