The Self-Custody Security Checklist

Self-custody is not a single decision. It is a set of small habits that, together, mean no single mistake can wipe you out. Tick these off honestly. Anything you cannot check yet is your next move, not a failure.

Your keys

My seed phrase exists only on paper or metal, never in a photo, a screenshot, a notes app, an email, or cloud storage.
My seed phrase is written in at least two physical places, stored separately, so one fire or flood cannot erase it.
Nobody has ever seen my full seed phrase typed into a website, app, or message, and I know that no real support ever needs it.
I have tested my recovery: I can restore my wallet from the seed phrase alone, on a clean device.

Your devices

Serious funds live behind a hardware wallet, so the private key never touches an internet-connected device.
I verify transaction details on the hardware wallet's own screen before approving, not just on my computer.
My phone and computer auto-lock, run current updates, and are not shared with anyone who could install software on them.
I keep a small, separate hot wallet for day-to-day activity, holding only what I can afford to lose.

Your habits

I reach apps and exchanges by a bookmark or by typing the address myself, never by clicking a link someone sent.
I treat any urgent message as a warning sign, and I verify it through a channel I open myself before acting.
I check the middle characters of an address, not just the first and last few, to defeat address poisoning.
I assume that anyone who contacts me first, especially 'support', must earn trust rather than be given it.

Before you move funds

I have sent a tiny test amount first and confirmed it arrived before sending the full amount.
I have double-checked the destination address against a source I trust, character by character.
I understand exactly what I am approving, and I have rejected anything I do not understand.
I am not rushing. No legitimate transaction requires me to act before I am ready.

If something feels wrong

If I suspect a key or device is compromised, I move funds to a freshly created wallet before anything else.
I know how to revoke token approvals I no longer use or recognize.
I have a written note for a trusted person explaining where to find help, without revealing any secret.