A malicious wallet prompt, a lost key and an infected computer call for different precautions. A useful security routine starts before you send funds: protect your accounts, limit what each wallet can expose and make sure you can recover access.
This guide separates those preparations from the checks to make before a transaction, ongoing monitoring and incident response. It builds on how wallets and DeFi work. The risk and scam guide explains the situations these precautions address.
These measures reduce risk without guaranteeing protection or recovery. DeFi also involves protocol and market risks, even when your keys are well protected. No product, provider or protocol discussed in our articles is endorsed by Token Expert.
1. Secure your accounts and devices
Protect email and exchange accounts
Your email account often lets you reset passwords for other services. Give it a unique password, enable strong multi-factor authentication and check its recovery settings. This requires several proofs of identity, such as a password and a security key. A password manager can help you use different passwords, provided you also protect the manager itself.
Where supported, choose phishing-resistant authentication, such as passkeys or security keys, and arrange backup access. A passkey lets you sign in through your device, often with a PIN or biometric check. SMS codes are vulnerable to interception and phone-number takeover. Even strong authentication cannot prevent every misuse of an already-open session. (2)
On an exchange, enable withdrawal alerts and approved withdrawal addresses where available. These address lists restrict where withdrawals can be sent. An API connection lets software access particular information or functions in your account, such as reading its history for accounting purposes. Give it only the permissions it needs: a tool that reads your transactions does not need permission to trade or withdraw.
Limit what you install
Keep your operating system, browser, wallet app and signing device's internal software up to date using verified sources. Enable the firewall, screen lock, disk encryption and anti-malware protection. Antivirus can miss threats and cannot judge whether an investment or signature is sensible. (1)
Remove unused extensions and apps. Verify a recruiter or client independently before running software they send you. Hosting a project on GitHub does not make it trustworthy: cloning a project copies its code to your computer, while git pull retrieves changes, without checking that the code is safe. Installing dependencies adds the software components the project needs. A command such as npm install can also run scripts, including malicious code, during installation. Development-tool tasks can execute code as well. Do not take those steps on the computer you use to manage your assets. (3, 18, 19)
Use a dedicated computer for cryptoasset transactions
A dedicated computer is reserved for financial accounts, wallets and the tools needed for transactions. With fewer apps and extensions, and no everyday email, attachments, messaging links or software-testing projects, there are fewer opportunities for routine browsing or downloads to expose your accounts. The separation also makes it easier to track installed software and notice an unexpected installation. It complements cyber hygiene rather than replacing it. (1, 3)
Keep the computer updated, encrypted and locked. Do not sync extensions or sessions from your everyday browser. An old device that no longer receives updates is a poor choice, even if it is “dedicated.” Continue to use a hardware wallet, a device that keeps private keys away from the computer, and check its screen before signing. A separate computer cannot make a harmful transaction safe.
If you need to test unfamiliar software, use another device or an environment prepared for that purpose, with no private keys, recovery phrases, financial sessions or sensitive shared folders. A separate browser profile does not isolate system files. A virtual machine runs another operating system in a software environment on the computer. Its isolation depends on its configuration, including shared folders; it does not guarantee that malware will remain contained. (3)
Be careful about what you make public
Balances, wallet screenshots, details of how you store your assets, your home address and travel plans can help someone target you. Share only what is needed with trusted people and advisers. If an approach feels suspicious, talking it through with someone you trust can help you step away from the pressure.
2. Limit what one wallet can expose
Keep reserves away from experiments
Use a wallet with limited funds for new applications and keep your reserves out of those interactions. Different addresses generated from one recovery phrase remain exposed together if that phrase leaks. Separate recovery phrases can help keep that risk from spreading across all your wallets.
Understand what a hardware wallet protects
A hardware wallet keeps private keys away from your connected computer. You must confirm the transactions it signs on the device itself. Check where it came from, initialize it yourself and do not use a recovery phrase supplied in advance. (4, 13)
Warning: if a private key is compromised, an attacker can move the funds it controls without having the device. (14) Keeping the device safe therefore does not replace protecting the recovery phrase.
Decide whether several signatures would help
A multisignature wallet, or multisig, requires approval from several signers for transactions. In a two-of-three setup, three separate keys can sign, but two signatures are enough. Stealing one key is therefore not enough on its own to approve a transaction; losing one key does not necessarily prevent the other two from signing. Losing access to two keys, however, can leave funds inaccessible. This protection requires planning for key storage, replacement and recovery. (5)
Distribute signing authority among several people: each keeps their own key and produces their own signature without sharing the private key. In a two-of-three multisig, the two required approvals should rest on independent checks. Each person should independently check the network, recipient, amount, assets and permissions against instructions received through a trusted channel. Distributing signatures only helps if people actually review the transaction; everyone can approve the same mistake by trusting one misleading screen. (5)
You can also use different types and manufacturers of hardware wallets, with separate keys and separate physical copies of their recovery phrases. This reduces dependence on one device or vendor, provided the devices work with the chosen network and coordination software. (20) A Keycard, paired with a Keycard Shell for an independent review screen, can for example act as a signer in a compatible Bitcoin multisig setup. Several cards holding the same key are backup copies, not independent signers. (21) Test signing and recovery with small amounts before relying on the setup; hardware diversity cannot compensate for inadequate checks.
On Ethereum and some compatible networks, a multisig can be a smart contract account, such as a Safe. The contract's code checks signatures and other access rights. Some accounts support modules: additional programs that authorize particular functions. A module may, for example, allow payments without collecting the usual signatures again. These options are not part of every multisig, including the Bitcoin setups described above. (24)
A delegated permission lets another address act within specified limits. Imagine the signers enabling a module that lets an address spend up to 100 USDC per month: that address can use the available allowance without requesting two new signatures for each payment. Check who can spend, which asset is covered, the cap, how often it resets and how to remove access. The “two-of-three” threshold alone no longer describes every way funds can be moved. (25)
A contract upgrade changes the program that enforces the account's rules. It may change functions or how certain signatures are accepted; it is more than an update to the app on your screen. Before approving one, verify the new contract's origin and compatibility with your signers and modules. Review requests to add a signer, lower the signing threshold or enable a module as well: they can change the conditions for accessing funds. If you cannot explain the effects, have the request checked before signing. (24, 26)
3. Protect physical copies and prepare for recovery
Keep a physical copy of your recovery phrase: writing it down by hand on paper creates a backup copy without creating a computer file. Write every word legibly and in the correct order. This phrase can recreate several private keys; it is different from an individual private key. (30)
Protect the copy from theft, prying eyes, fire and water, and store it separately from the device. A suitable metal medium is another option. Do not photograph it or keep private keys or recovery phrases in email, cloud notes, shared documents or AI chats. Copies kept in one place can be lost or exposed together. (30, 31)
Distinguish the recovery phrase, an optional extra passphrase, the device PIN and account recovery codes. The recovery phrase restores access to keys; a passphrase, if your setup uses one, is an additional secret needed to restore the corresponding wallet. The PIN unlocks the device, while recovery codes restore access to an online account. Record what your setup requires and follow its documented recovery procedure. Improvised ways to split words or hide instructions can leave you unable to recover your own funds. (28)
Never share your recovery phrase with another person or service. A supposed support agent asking for it to “verify” your account is trying to scam you. (14) Do not type a hardware wallet's phrase into a website or your everyday computer to check it.
Before keeping substantial assets at an address, verify that you can recover access using the device's documented verification method or a controlled setup. For a multisig, keep keys and physical copies of recovery phrases separate enough that one compromised device or damaged location cannot affect them all, while ensuring that enough signers remain available.
Plan for incapacity or death too. Someone you trust should be able to securely find the instructions needed to recover your funds. Keep those instructions separate from account records that other people can readily access.
4. Check the offer and the transaction
Step back from promises of easy money
Be wary of offers that seem too good to be true, especially social media posts or messages promoting ways to make money quickly. A convincing video, a popular account or enthusiastic comments do not validate a strategy. Check who is behind it, how they benefit financially and what risks you would take. Pressure to act quickly is a reason to step back. (15)
Be wary of requests to pay through a Bitcoin ATM
A Bitcoin ATM converts cash into cryptoassets sent to an address. Imagine a supposed bank employee calling to say your savings are at risk: withdraw $5,000, find a kiosk and scan their QR code. That code may contain the scammer's address. The machine can work normally while the reason for paying is entirely invented. (22)
The pretext might be protecting an account, paying a fine, helping a relative or funding an investment. Staying on the phone, coaching you to conceal the reason for withdrawing cash and demanding urgency are warning signs. Do not scan the code or insert cash. End the call and contact your bank, relative or the organization using a number you already know. (23)
If you already paid, stop depositing. Keep the receipt, kiosk location, receiving address, transaction reference and messages. Contact the kiosk operator, your financial institution and police promptly, and follow the Canadian Anti-Fraud Centre's reporting process. Acting quickly may help, but does not guarantee a refund. (9, 23)
Review the request before signing
A hardware wallet or multisig does not make a request safe. You can still approve a harmful transaction, and an existing spending approval may allow later transfers without another confirmation. (8) If the request is unexpected or you cannot understand its important effects, pause.
For example, if you intend to swap 50 USDC, permission to spend every USDC in your wallet exceeds what is needed. A message presented as a login may also authorize future spending even when no network fee is due now. A permit is an approval given through a signed message that someone else can submit to the blockchain. Under ERC-2612, its deadline limits when the signature can be submitted; it does not expire the allowance once created. Check the asset, authorized spender and limit; reject the request if you cannot explain what your signature permits. (7, 8)
Before sending funds or signing, check these six points:
- The website. Use a verified bookmark or type the address carefully. Read the full domain. A high search ranking, ad, badge or HTTPS padlock does not prove that the operator is legitimate. (6)
- The recipient. Obtain the address independently and compare it in full, along with the network and any required memo or destination tag. This extra information lets some services credit the deposit to the right customer. Check pasted text and QR-code contents rather than trusting recent transaction history.
- The action. Do the asset, amount and contract match what you intended? Compare the details on your signing device with the request shown on the website.
- The permission. Limit spending approvals to the amount needed. An NFT permission may cover a whole collection. Some accounts also let an application act during a session or make recurring payments without another confirmation. Check the assets, permitted actions, limits and how to remove access. Choose a short duration where the mechanism allows it, without confusing a signature's submission deadline with the duration of the approval it creates. (7, 27)
- The terms. Review fees and price impact: a trade that is large relative to the funds available for trading can move the price against you. Slippage tolerance sets the maximum difference you accept between the expected and executed price. Check borrowing conditions and withdrawal delays where relevant. A simulation shows a possible result using the network's known state, which can change before execution. (16, 29)
- A small test, where useful. A test transfer can help check that the recipient receives funds on the intended network while limiting the amount exposed during that test. Success does not guarantee the next transfer's outcome or establish that the platform is trustworthy.
5. Review access and monitor positions
Remove permissions you no longer need
Review spending approvals on each network you use. Disconnecting a website does not revoke them. You can inspect and revoke permissions through a service such as Revoke.cash, or directly in some browser wallets, such as Rabby Wallet. Revocation incurs network fees and does not recover assets already transferred. (8, 11, 12)
A spending-approval list may not show unused signed messages or other account permissions. A signature may be submitted later to create an allowance, while a module may provide another way to access funds. Check these mechanisms separately and use the cancellation procedure that applies to each. (7, 24, 27)
Review connected apps, API permissions and active sessions as well. Remove old access when changing devices or providers. Watch for unfamiliar logins, withdrawals, approvals and recovery-setting changes.
Keep track of the accounts and funds involved
Keep a list of your public addresses so you can identify the accounts to monitor. Private keys and recovery phrases do not belong in your accounting records.
Loans and other complex DeFi positions need continued attention. For a loan secured by cryptoassets, the deposited assets must remain valuable enough to cover the debt under the protocol's rules. A price decline can trigger their forced sale, known as liquidation. Monitor the collateral's value, withdrawal options and protocol changes. A secure device cannot prevent liquidation caused by a market move.
6. Respond according to what was exposed
Take the first steps
- Stop interacting with the suspected source. Do not send more funds or sign requests presented as a way to “secure” your wallet.
- If you suspect malware, isolate the device. Disconnect it from the network, stop using it for financial activity and coordinate the response from another trusted device. Contact IT support for a business device. (3)
- Preserve evidence before wiping or resetting it. Save messages, URLs, transaction hashes, addresses and timestamps. Get qualified help if the scope of the incident is unclear. (3)
Identify the access the attacker obtained
The response depends on what was exposed:
| What may have been exposed | What to assess |
|---|---|
| A password or active session | Secure email and recovery settings, replace credentials, revoke sessions and contact the platform through an independently verified channel |
| An active spending approval | Identify the network, contract and asset, then assess revocation as described in section 5 |
| A signature given to someone else | Find out what it permits and whether it has been used. Someone may retain it and submit it later to create an allowance. Check how to invalidate it, where possible; revoking an approval already visible on the blockchain may not be enough. (7, 8) |
| A private key or recovery phrase | Treat it as compromised and identify affected accounts. Assess moving remaining assets to a wallet with new keys; for a multisig, assess replacing the exposed signer and whether enough safe signers remain. Changing the PIN does not replace the keys |
| Malware on the computer or browser | Protect accounts and wallets from a trusted device, then arrange remediation of the affected device before using it again |
Avoid sending more funds to a compromised address, even to pay network fees, without assessing the risk: an automated theft script may take those deposits too. (10)
Restore a trusted device and report the incident
A clean antivirus scan alone does not establish that a compromised device is safe again. After preserving evidence, favour a complete operating-system reinstall and restore only file backups known to be clean. For a business device, coordinate this with the team handling the incident. (17)
Contact the relevant platforms and financial institutions promptly. In Canada, follow the Canadian Anti-Fraud Centre's reporting guidance and report the incident to local police. Reporting does not guarantee recovery. Be wary of anyone promising to recover funds in exchange for an advance payment. (9)
Sources
Sources consulted October 29, 2026. These recommendations are a practical synthesis, not a certification of any setup. The AMF reference is in French.
-
Canadian Centre for Cyber Security — Phishing-resistant MFA.
-
FBI/IC3 — Social engineering targeting the cryptocurrency industry, September 3, 2024.
-
Ethereum.org — Smart contract access controls and multisignature wallets.
-
FBI/IC3 — Brand impersonation through search advertisements, December 21, 2022.
-
Canadian Anti-Fraud Centre — What to do if you are a victim of fraud.
-
Phantom help documentation — Sweeper bots. Technical explanation, not a product recommendation.
-
Rabby Wallet — Approval management in the browser extension — official source code.
-
Trezor documentation — Transaction confirmation on the device.
-
Autorité des marchés financiers (Québec) — Financial influencers (in French).
-
Uniswap Labs documentation — Slippage and slippage tolerance. Technical explanation only; no recommendation to use this service.
-
Canadian Centre for Cyber Security — Responding to malware and restoring an affected device.
-
Visual Studio Code documentation — Workspace Trust and Restricted Mode.
-
Blockstream — Multisig with hardware from different manufacturers.
-
Keycard — Architecture, Shell display and Bitcoin multisig support.
-
CFTC — Recognizing suspicious Bitcoin ATM transfer instructions.
-
FBI/IC3 — Cryptocurrency kiosks: fraud indicators and records to preserve.
-
MetaMask — Advanced permissions and actions without repeated confirmation.
-
Ethereum.org — Recovery-phrase protection and digital copies.
