This site takes part in the Binance referral program; the referral code and link are only on the account-opening guide · Disclosure
Self-audit checklist

30-Point Crypto Wallet Security Checklist

30 items in six groups. Tick what you have done; whatever is left unticked is what to fix next. Four notes at the end explain why seed phrases, approvals, wrong-network transfers and leaks matter most.

Frost Kim Your ticks are saved only in your own browser; Reset clears them
Ticked
0/30
Progress
Not started
Ⅰ

Keys and seed phrase

5 items
I clearly understand the difference between a private key and a seed phrase.If unsure, read Private Key vs Seed Phrase: How They Relate first
My seed phrase has never been typed into an "online generator" page on a connected device.That includes the online version of iancoleman, which must only be used offline
My seed phrase has not been photographed, stored on a cloud drive, or saved to iCloud / Google Photos.
I have at least one non-paper backup of my seed phrase (steel plate, metal capsule, or Shamir shares).Paper is the bare minimum
My seed phrase backups are kept in at least 2 different physical locations, in case of fire or flood.
Ⅱ

Wallet architecture

5 items
I separate cold and hot storage: day-to-day trading on a hot wallet, long-term holdings in cold storage.
My holdings have reached an amount I could not afford to lose, and I have moved the part I do not touch into a hardware wallet.If the amount is still small enough that you could absorb the loss, leave this one unticked for now
My hardware wallet was bought directly from the maker's official store, not second-hand or from a marketplace reseller.
When it arrived I did a full reset and generated a new seed phrase myself. I did not use a ready-made seed phrase that came in the box.
I have checked my backup at least once, with the device's own backup-check feature or by resetting this device and restoring from the seed phrase.A hardware wallet's seed phrase is never typed into a phone or computer
Ⅲ

Exchange accounts

5 items
I know whether my main exchange publishes Proof of Reserves (PoR) on a regular basis.
I do not leave coins I am not going to touch sitting on a centralized exchange; only what I expect to use soon stays there.
My exchange accounts use an authenticator app, a passkey or a hardware security key, not SMS codes alone.
My exchange accounts have the withdrawal allowlist turned on.
Before a transfer I check the full recipient address character by character and confirm the network is right. For a large amount I send a small one first and send the rest once it has arrived.
Ⅳ

Phishing and scam defense

5 items
I never click "support" or "airdrop" links sent by strangers via Telegram / X / Discord DMs.
For every approval (approve / setApprovalForAll), I check the spender address before confirming.
I check my approvals with Revoke.cash regularly (for example, once a month) and revoke the ones I no longer need.
I am wary of every off-chain signature request (EIP-712 / Permit) and read it carefully before signing.
I know SMS codes can be bypassed by a SIM swap, so I turn SMS verification off wherever I can and use an authenticator app or a passkey instead.Where an exchange requires SMS to stay on, follow its official instructions
Ⅴ

Incident response

5 items
I know the first thing to do when a wallet looks wrong: work out whether the seed phrase or private key has leaked, or whether I only signed a malicious approval.
I know that after a seed phrase leak I need to create a new wallet on a clean device and move the assets to new addresses, rather than keep using the old wallet.
I know the order to move assets in after a leak: whatever can go in a single transfer first, whatever takes several steps after that.
I know where to report a scam, and I have saved the official support page of each exchange I use so I do not have to search for it in a hurry.
If someone contacts me after a scam offering to get the money back, and asks for an upfront fee or my seed phrase, I ignore them.This is a second scam aimed at people who have already been hit
Ⅵ

Legacy and long-term

5 items
At least one trusted family member or close friend knows I hold crypto and has instructions for "how to access if something happens to me."
I have considered Shamir backup or multisig so that the backup does not depend entirely on one person or one location.
I go through a full inventory of my assets at least once a year, so I know what I hold and where.
I know how the law where I live treats the inheritance of crypto assets.
My wallet setup is simple enough that I would still remember how to use it five years from now.

Why these four matter

Why a seed phrase must never touch an online device. A seed phrase derives every private key in the wallet, so whoever gets hold of it can move the coins. Screenshots, cloud photo sync and chat histories all leave copies in places you do not control. Keep the backup on an offline medium. What paper and metal plates each protect against and miss is covered in How to Store Your Seed Phrase Safely.

Why approvals need checking regularly. Token approvals do not expire on their own. If a contract you approved runs into trouble, the tokens it was approved for can be moved, so revoke the approvals you no longer use. How to check and revoke them is in How to Check and Revoke Token Approvals.

Whether a wrong-network transfer can be recovered. USDT is a different contract on each chain. What happens after a wrong transfer depends on whether the recipient is an exchange or your own wallet, and on whether the network or the address was wrong. Each case is covered in Sent USDT to the Wrong Network? What to Do.

If you suspect the seed phrase or private key has leaked. First work out whether the seed phrase or private key has actually leaked, or whether you only signed a malicious approval. A leak means creating a new wallet on a clean device and moving the assets; revoking approvals does not help. A malicious approval is stopped by revoking it. How to tell the two apart, and the order to move assets in, are in Seed Phrase or Private Key Leaked? What to Do.

This checklist does not cover everything. Ticking every item does not mean nothing can go wrong.

Further reading