Crypto Wallet Security Checklist
Score a self-custody setup across key storage, transaction verification, wallet separation and operational habits, with the practices that cannot be traded against a good score elsewhere.
Last reviewed by the Radiatus Cloud team
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
The device screen is the only display you can trust
The entire value of a hardware wallet is that the private key never leaves it and that it shows you what you are about to sign on a screen an attacker cannot alter. A user who approves on the device without reading it has kept the first property and discarded the second, which is the half that stops a compromised computer from redirecting a transfer. Malware that swaps a destination address in the clipboard and in the browser display is ordinary and cheap, and the device screen is what catches it.
An untested backup is a hypothesis
Writing down twelve or twenty-four words feels like completing the task, and it is only half of it. A transposed pair, a misread character, a word from the wrong list: none of these is detectable by looking at the paper, and all of them are discovered at the moment the backup is needed, which is the moment nothing can be done about it. Restoring onto a spare device, confirming the first address matches, and wiping it takes twenty minutes once.
Separation bounds the loss that a mistake causes
Most losses do not come from broken cryptography but from a person approving something. Keeping long-term holdings in a wallet that has never signed a contract interaction means a mistake made while using a new protocol cannot reach them, however bad the mistake was. This is the single highest-value structural change available, it costs one extra device or one extra account, and it works even when everything else on this list has failed.
Related tools
- Ethereum Unit Converter — Convert between Wei, Gwei, and Ether units.
- Gas Fee Calculator — Calculate transaction costs based on gas price and limit.
- IPFS CID Generator — Generate IPFS Content Identifiers (CID) from text or files.
- Wallet Address Validator — Validate Ethereum and Bitcoin wallet addresses.
Frequently Asked Questions
Why check the transaction on the device screen?
Because the computer screen can be lying. Malware that swaps a destination address in the clipboard and in the browser is ordinary, and the device screen is the only display an attacker who owns the host does not control.
Is a browser extension wallet safe enough?
For small amounts in active use, with a separate wallet holding everything else. A key in software is reachable by every process on the machine, and extensions are the most attacked surface in the space.
Should I test my seed backup?
Yes, on a spare device. A transposed pair or a misread character is not detectable by looking at the paper, and the failure is discovered when nothing can be done about it.
Why revoke token allowances?
Because an unlimited approval to a contract that is compromised later drains the balance at that later date without any further action from you. The approval outlives the interaction that created it.
What is the highest-value single change?
Separating long-term holdings into a wallet that never interacts with contracts. It costs one extra account and it works even when everything else has failed.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Tick what you actually do to score your setup.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.