First: an exchange account is not your wallet
Coins sitting on an exchange are controlled by the platform; what you hold is a claim against it. If the platform gets hacked, freezes withdrawals or collapses, your coins are caught in it. Moving coins to a wallet whose seed phrase you control makes them genuinely yours — and makes security entirely your job. The sensible split: keep small, actively traded amounts on exchanges; self-custody the large, long-term holdings.
The two kinds of wallet
- Hot wallets: phone apps or browser extensions, connected to the internet. Convenient for everyday transfers, airdrop farming and DeFi. The risk surface is your device: malware and phishing links are the usual attack routes.
- Cold wallets (hardware wallets): dedicated devices that keep keys offline and only connect to sign. The safest option for large long-term holdings; the costs are the device price and a clunkier workflow.
Choose by amount: under a few thousand dollars, a hot wallet is fine. Once the number reaches "I'd lose sleep over this," a hardware wallet earns its keep — bought only from the manufacturer or authorized sellers. Never buy a second-hand hardware wallet.
What a seed phrase actually is
When you create a wallet, it generates 12 or 24 English words: your seed phrase, a human-readable form of the private key that can regenerate every address in the wallet. The app is just an interface; the phrase is the asset. New phone, reinstalled app — type the phrase in and everything is back. Lose the phrase, and nothing on Earth recovers the wallet.
5 iron rules for storing your seed phrase
- Pen and paper, offline. Write it by hand (or stamp it into a metal backup plate) and store it somewhere only you know about.
- Never screenshot it, photograph it, or put it in cloud storage or chats. Photo libraries and cloud accounts are the most common leak source — malware and account takeovers sweep them automatically.
- Never share it with anyone. No support agent, official, or airdrop project will ever ask for it. Anyone who asks is a thief, full stop.
- Keep at least two copies in separate places to survive fire, water and simple misplacement.
- Don't reveal where it's stored — and when posting wallet screenshots or flexing online, make sure the backup notebook isn't in frame. This exact accident happens every year.
The single deadliest rule, repeated: any website, app or "support agent" asking you to type in your seed phrase is stealing your coins. "Claim your airdrop," "verify your wallet," "account upgrade" — all scripts. The only legitimate use of the phrase is you, restoring your own wallet, inside the official app.
Everyday safety habits
- Reach wallets and exchanges only through your own bookmarks, and check domains letter by letter — phishing sites routinely differ by one character.
- Before connecting to an unfamiliar site (signing an approval), ask what the approval lets it move. Unsure? Test with a throwaway wallet first.
- Send a small test transfer before any large one, and confirm address and network. Wrong-chain sends are usually gone for good.
- Use a separate wallet for airdrops and testnets — don't let your main wallet sign approvals all over the internet. Why: see What Is a Crypto Airdrop?
Lost it, or think it leaked?
- Phrase lost, wallet app still opens: act now — create a brand-new wallet, back up its phrase properly, and move everything over.
- Phrase lost, app gone too: unrecoverable. That's the hard rule of self-custody. Back up on day one, not "later."
- Possible leak (shared it, or typed it into a strange site): don't wait to "see what happens." Create a new wallet and move the assets immediately — you're racing the thief.
Exchange-side security (2FA, anti-phishing code, password hygiene) has a full checklist in Step 3 of the Beginner Path. Do both sides properly.
FAQ
What's the difference between a seed phrase and a password?
A password is a lock on one app — resettable. The seed phrase is the asset itself: whoever holds it can open your wallet on any device. Losing a password is an annoyance; losing the phrase is the event.
Is it safe to keep everything on an exchange?
Top exchanges have decent security records, but platform failures wiping out users are a recurring historical pattern. Rule of thumb: trading float stays on the exchange; long-term and large holdings move to your own wallet.
If someone knows my wallet address, can they steal my coins?
No. An address is public, like a bank account number — knowing it only lets people send you money. Protect the private key and seed phrase, and watch what you approve.
Is a hardware wallet worth it?
When your self-custodied balance becomes an amount you'd genuinely grieve, yes. A modestly priced device for offline key storage is the best value-for-money security purchase in crypto.
Keep reading