Your seed phrase is the wallet
A seed phrase (also called a recovery phrase) is a list of 12 or 24 words that generates every private key in your wallet. The app on your phone or browser is just an interface: anyone who types those words into any wallet controls the same funds, from anywhere, and the transfers cannot be reversed.
Do
- Write it on paper or stamp it on metal
- Keep two copies in separate, secure places
- Test recovery on a second device before funding the wallet
- Consider a passphrase (the optional 25th word) for large holdings
Do not
- Take a photo or screenshot of it
- Store it in email, notes, cloud drives or chat
- Keep it in a file on your computer, even encrypted
- Enter it on any website or share it with anyone
Choosing the right wallet
Every wallet trades convenience for exposure. The right choice depends on how much it holds and how often you use it.
| Type | Strength | Weakness | Best for |
|---|---|---|---|
| Browser extension MetaMask, Rabby, Rainbow | Fast to use with any dApp | Keys live on an internet-connected computer | Daily swaps with moderate amounts |
| Mobile wallet Rainbow, Trust Wallet, Coinbase Wallet | Biometric lock, phone sandboxing | Lost or compromised phone, fake app stores | Small balances on the go |
| Hardware wallet Ledger, Trezor | Keys never leave the device; every signature confirmed by hand | Slower; you can still approve a malicious request | Savings and large holdings |
| Smart contract wallet Safe and other multisigs | Several signers or rules required to move funds | More setup; some signature-based routes are unavailable | Teams, treasuries, high-value personal funds |
A hardware wallet works with ChainBridge through the wallet you already use: connect the device to MetaMask, Rabby or another supported wallet, then connect that wallet. Each swap must be confirmed on the device. If you swap from a Safe or another contract wallet, read smart contract wallets first: gasless and Permit2 routes are not available to them.
Split your funds across wallets
One wallet for everything means one mistake can cost everything. Keeping separate addresses limits the damage of a bad signature to what that address holds.
| Wallet | Holds | Setup |
|---|---|---|
| Vault | Long-term savings | Hardware wallet or multisig, rarely connected to dApps |
| Daily wallet | What you plan to trade this month | Extension or mobile wallet, ideally backed by a hardware device |
| Burner | Small amounts only | Fresh address for new protocols, mints and anything you are unsure about |
How wallets get drained
Hackers rarely break the cryptography. They get you to sign something, or to reveal the seed phrase. These are the patterns behind most losses. For a wider list of warning signs, read DeFi scam red flags.
Phishing sites
A pixel-perfect copy of a real app on a look-alike domain, usually reached from an ad, a search result or a DM. Connecting is harmless; signing what it asks is not.
Defense: Open apps from your own bookmarks. Read the domain before you sign anything.
Malicious approvals and signatures
A drainer asks you to approve a token, or to sign an off-chain permit, that hands an attacker the right to move your tokens. Off-chain signatures cost no gas, which makes them easy to sign without thinking.
Defense: Read every wallet prompt. A swap should not ask for an approval to an address you do not recognize.
Fake support
Someone answers your public question on Discord, Telegram or X and offers to help, then sends you to a "validation" site that asks for your seed phrase.
Defense: Real support never DMs first and never needs your seed phrase.
Address poisoning
An attacker sends you a zero-value transfer from an address that starts and ends like one you use, hoping you copy it from your history next time.
Defense: Copy addresses from a saved contact, not from transaction history, and check the whole address.
Unknown tokens and airdrops
Tokens you never bought appear in your wallet, often with a website in their name. Trying to sell or claim them leads to a phishing site.
Defense: Ignore them. Do not visit the link or try to swap them.
Clipboard malware and fake extensions
Malware swaps a copied address for the attacker’s, or a counterfeit wallet extension steals your keys on setup.
Defense: Install wallets only from the official site, and re-read the pasted address before you send.
Read before you sign
Your wallet shows what a transaction or signature will do. Take five seconds to read it, every time.
Check the site
Confirm the domain in the address bar matches your bookmark, not just the page design.
Check the type of request
A swap is a contract call. An approval or a permit signature grants spending rights. If you expected a swap and got an unexpected approval, reject it.
Check the amount and the spender
ChainBridge asks for an approval of the exact swap amount, and checks every spender against its contract allowlist before you sign. An app asking for unlimited access to a token you hold a lot of deserves a second look.
Check the outcome
On ChainBridge, the review screen simulates the exact transaction and shows what you send and receive. If the simulation fails, the swap is blocked.
Clean up old approvals
An approval lets a contract move a token from your wallet and stays valid until you revoke it. Approvals you gave years ago to apps you no longer use are a standing risk if those contracts are ever compromised.
The approvals page scans the allowances your wallet has granted to the swap and bridge contracts ChainBridge works with, on every supported network, lists unlimited ones first and lets you revoke them one by one or in a batch. The token approvals guide explains what to revoke and when.
Wallet security checklist
Go through this list once now, then again every few months.
- Seed phrase written on paper or metal, stored offline in two separate places
- No photo, screenshot, cloud note or password manager copy of the seed phrase
- Recovery tested on a second device before funding the wallet
- Hardware wallet or multisig for savings
- A separate burner wallet for new or unknown protocols
- dApps opened only from bookmarks
- Every signature request read before signing, especially approvals and permits
- Approvals reviewed monthly and unused ones revoked
- Wallet app, browser and operating system kept up to date
- No one, ever, given the seed phrase or private key