Protect account access
Use a unique password, enable available multi-factor controls and review active sessions. Secure the associated email account because password resets often depend on it.
Keep secrets offline and private
Never send a recovery phrase, private key, password or one-time code to support, an investigator or someone contacting you unexpectedly. Treat remote-access requests as high risk.
Verify every transaction
Check the complete destination, network, asset and amount before approving. For a new route, use the service’s official documentation and consider an appropriately small test that still meets deposit minimums.
Review unusual activity calmly
Preserve hashes, timestamps and session notices before changing account state. Revoke unfamiliar sessions or approvals through trusted interfaces and contact the relevant provider using independently verified details.
Separate everyday access from recovery
A password or device unlock protects routine access, while a recovery phrase or private key can recreate control elsewhere. Store recovery material offline and do not photograph, email or paste it into support forms. Anyone requesting it should be treated as a security risk regardless of the logo, job title or urgency they present.
Review the surrounding accounts
Wallet security often depends on email, mobile service, cloud backups and browser extensions. Use unique credentials, review forwarding rules and recovery methods, remove extensions you do not need and keep devices updated. An apparently secure wallet interface cannot compensate for a compromised email account or remote-access session.
Adopt a repeatable transfer check
Before each transfer, independently verify the destination, network, asset contract, amount and any memo or tag. Read the full address rather than only the first and last characters when the risk is meaningful. Pause if the destination changed unexpectedly or if another person is directing the transaction under pressure.