Hodler's Handbook: crypto wallet security
This site covers one subject, looking after your own crypto: how to store a seed phrase, how to choose and use a hardware wallet, how to check and revoke token approvals, and what to do when something goes wrong. The full contents are below. Articles come first, in five groups, followed by the hardware wallet comparison table, the self-audit checklist, the FAQ, the glossary and the write-ups of public security incidents.
Seed phrases and private keys
What the two are, and where to keep the backup- 01
Private Key vs Seed Phrase: How They Relate
What a private key, public key, address, seed phrase and derivation path each are, and which is derived from which, following the BIP-39, BIP-32 and BIP-44 specifications. Also covers why addresses can differ after you switch wallets and how to check a seed phrase offline.
- 02
How to Store Your Seed Phrase Safely
Paper, metal plates, SLIP-39 shares, a passphrase (the 25th word), and photos kept in a camera roll or cloud drive: what each way of storing a seed phrase protects against and what it misses, and how to confirm a finished backup is correct.
Wallets and hardware
How wallets are classified, and what to do when a hardware wallet is discontinued, needs an update, or you change phones- 03
8 Types of Crypto Wallets and Where Keys Live
Exchange accounts, browser extensions, mobile apps, desktop wallets, hardware wallets, multisig, smart contract wallets and paper wallets, set out in one table by where each keeps the private key.
- 04
Cold Wallet vs Hot Wallet: Key Differences
The only test is whether the device holding the private key is online when it signs. Covers whether a hardware wallet plugged into a computer still counts as cold, how to split funds between cold and hot, and how to move coins between the two.
- 05
What If Your Hardware Wallet Company Fails?
The coins are on the chain and the device only holds the keys. With the seed phrase you can restore on another brand's device. Covers the 3 steps, the SLIP-39 exception, and the cases where you need a new seed phrase.
- 06
Your Hardware Wallet Wants a Firmware Update: Check the Backup, the Cable and the Source First
What to confirm before you press update: that the backup is at hand and the cable is secure, what a dropped connection does to a Trezor, what to do when a Ledger is stuck in Update Mode, and how to recognize a fake update that asks for your seed phrase.
- 07
You've Switched Phones: Getting the Wallet Onto the New One
Whether a new phone can restore the wallet depends on what you still have: the old phone, the seed phrase, or a backup the wallet made. Four situations, each with where to start and the steps to follow.
Approvals, 2FA and daily security
Wallet settings, token approvals, login verification and spotting phishing- 08
MetaMask Security Settings: What to Change
Based on the current MetaMask Help Center pages: transaction simulations, security alerts and phishing detection are on by default, while auto lock, spending caps, disconnecting dapps and revoking approvals are left to you. Each item links to the official page.
- 09
How to Check and Revoke Token Approvals
Token approvals do not expire on their own. How to find and revoke them with Revoke.cash or Etherscan, how to check Permit signatures and Permit2 allowances, and how to confirm afterwards that everything is revoked.
- 10
Is SMS 2FA Safe? Authenticator vs Passkey
What SMS codes, authenticator apps, hardware security keys and passkeys each stop and fail to stop, what a passkey is and how to set one up, and how to combine the methods on an exchange account.
- 11
13 Crypto Phishing Scams and How to Spot Them
Fake support, unfamiliar tokens, fake approval pop-ups, fake wallet apps, fake official sites in search ads, fake official emails and more, 13 types in all. Each comes with checks you can follow, and the page ends with what to do, in order, if you have already been hit.
When something goes wrong
A leaked seed phrase, a malicious approval, a wrong-network transfer- 12
Seed Phrase or Private Key Leaked? What to Do
If the seed phrase or private key has leaked, create a new wallet on a clean device and move the assets out in order. If you only signed a malicious approval, revoking it stops the loss. Includes how to tell the two apart, the order to move assets in, and where to report.
- 13
Sent USDT to the Wrong Network? What to Do
Check three things first: whether the recipient is an exchange or your own wallet, whether the network or the address was wrong, and whether a bridge was involved. The steps for each case are set out separately.
Exchange accounts
Opening an account and securing it- 14
Binance Registration Guide: Sign-Up, KYC and the First Four Security Settings
Each step of signing up for Binance, how to fix a rejected KYC submission, the four settings to make straight after opening the account, and when to move coins back to your own wallet after buying.
- 15
Binance Account Security: Seven Layers Every Beginner Should Set
Password, two-factor authentication, anti-phishing code, withdrawal allowlist, and cleaning up devices and API keys: what each layer stops and how to set it.
Comparison table, checklist and reference pages
Not articles; pages for looking things up- ⊙
Hardware Wallet Comparison: 9 Models by Spec
Nine current models from Ledger, Trezor, OneKey, Keystone and Coldcard in one table: chip, screen, connectivity, open-source status, backup method and price. Each column links to the maker's spec page, and a cell shows a dash where the official page does not say.
- ⊙
30-Point Crypto Wallet Security Checklist
30 items in six groups: seed phrase, wallets, exchange accounts, phishing, emergencies and inheritance. Tick what you have done; whatever is left unticked is what to fix. Your ticks are saved only in your own browser.
- ⊙
Wallet Security FAQ: Seed Phrases, Backups, Hardware Wallets
What to do if a seed phrase is missing words, whether a backup can go in cloud storage, whether a stolen hardware wallet means lost coins, whether token approvals expire. Each question gets a direct answer, with a link to the full article where more detail helps.
- ⊙
Crypto Wallet Security Glossary
The terms you run into when holding your own crypto, each defined in a few sentences and linked to the longer article.
- ⊙
Security Incident Write-Ups
Incidents documented in primary sources by an official party or an investigator. One so far: the February 2025 Bybit cold wallet theft.