Wallet Security & Self-Custody
If your crypto is sitting on an exchange, you don't actually own it. The exchange does, and that's fine for a first buy, but it isn't a plan. This page is how I walk people toward real control, and how we avoid the mistakes I keep seeing in sessions: a seed typed into a fake site, a hardware wallet that never got a restore test, a family that wouldn't know where to look.
The Seed Phrase Rules
Your seed phrase is the master key to everything you own, which is why I sound like a broken record about it. Write it on paper, not in a notes app, not in a cloud password manager, and not in a screenshot. Store that paper somewhere offline you'd trust with a passport. Never type it into a website, and never read it to someone claiming to be support. Paper burns, so once the amount would hurt to lose, graduate to a steel backup and then actually test a restore. If you must keep a digital copy, encrypt it and keep it on a machine that's never been on the internet, and even then I'd rather you didn't.
Software Wallets vs. Hardware Wallets
A software wallet is an app on your phone or computer, convenient and free, fine for pocket money you need this week. MetaMask, Phantom, Rabby, the usual names. A hardware wallet keeps the keys on a device that doesn't live in your browser, which is what I want for anything you'd hate to lose. Ledger and Trezor are the first conversation for most people; Sparrow and Coldcard show up once someone is ready to be more careful. Software for spending, hardware for savings. That's the split I keep repeating because people invert it.
Common Failure Modes
Phishing sites: Fake websites that look identical to real wallet services. You enter your seed phrase and the funds are gone within seconds. Always verify the URL. Bookmark the real one.
Malicious browser extensions: Fake MetaMask extensions that steal your keys. Only install from the official store and verify the developer.
Social engineering: Someone messages you offering to "help" with a staking issue or a stuck transaction. They ask for your seed phrase or ask you to connect your wallet to a malicious site. Legitimate support will never ask for your seed phrase.
Lost seed phrases: The most common failure mode. Device breaks, gets lost, or is destroyed. No seed phrase means funds are gone forever. There is no recovery.
Address poisoning: An attacker sends you a tiny transaction from an address that looks almost identical to one you've used before. When you copy that address later to send funds, you accidentally send to the attacker. Always verify the full address character by character.
Self-Custody Checklist
- I have written down my seed phrase on paper, not digitally.
- I have stored it in a secure, offline location.
- I have tested recovering my wallet from the seed phrase on a separate device.
- I use a hardware wallet for amounts I'm not actively spending.
- I verify the full destination address before sending any transaction.
- I have never entered my seed phrase on any website.
- I keep only what I need for trading on exchanges. Everything else is in self-custody.
- I have a plan for how my family would access my crypto if something happened to me.
When to Use a Hardware Wallet
If the answer to "would losing this amount cause me real financial pain" is yes, use a hardware wallet. There is no minimum threshold. Some people hardware-wallet $500. Others are comfortable keeping $5,000 on a software wallet. It's personal. But the default should be: when in doubt, move it to cold storage.