Wallet safety

How to check a crypto wallet is safe

Most wallet losses do not come from broken cryptography. They come from what the owner signed, where the seed was typed, and which approvals were left open. This is the checklist that actually reduces risk — in the order that matters.

Updated 10 November 2026.

1. Treat the seed phrase as the wallet

Anyone who has the seed phrase owns the funds. No support agent, airdrop page or “wallet validation” site ever needs it. Write it on paper or metal, keep it offline, and never type it into a browser page. If a page asks for it, the page is the attack.

For savings you would miss, use a hardware wallet: the key stays on the device and the computer only sees signatures. A software wallet is reasonable for small, active amounts.

2. Check what you have already approved

Every swap or deposit can leave a token approval behind. An unlimited approval lets a contract move that token later without asking again. Open your wallet’s approval manager (or a well-known approval revoker), read the list, and revoke anything you do not recognise or no longer use. Revoking costs gas; leaving an unlimited approval open can cost the balance.

Do this after every new protocol you try, and on a regular schedule for a wallet you use often.

3. Separate the wallets by job

One wallet for savings that rarely connects to anything. One hot wallet for experiments, new protocols and small balances. One watch-only address for checking a public wallet without exposing a key. If one hot wallet is compromised, the savings wallet was never in the same place.

4. Read the request before you sign

A signature can be a login, an approval, a permit or a transfer. They are not interchangeable. Before signing, check the site domain, the network, the spender and the amount. An unlimited approval or a permit for an unknown contract is a red flag. If the wallet shows a message you do not understand, reject it and ask what it does.

5. Watch for address poisoning and clipboard malware

Attackers send tiny transfers from an address that looks like one you use, hoping you copy it from your history. Always copy the recipient from a saved contact or verify several characters in the middle and at the end, not only the first four. Clipboard malware can swap an address after you copy it; paste, then check again before sending.

6. Test with a small amount first

For a new chain, bridge or contract, send the smallest amount that proves the path works. Check the received amount and the transaction on the explorer. A small test is cheaper than a large mistake.

7. If something goes wrong

Move what is left to a new wallet first, then revoke the approvals on the old one. Do not pay a “recovery service” that asks for the seed or an upfront fee. Report the address and the contract to the platform you used, and keep the transaction hashes.

What the assistant can and cannot do

GTXAgent can read a public Base address — balances, nonce and whether it is a contract — explain what an approval or a permit does, and walk you through the revoke steps in plain language. It cannot sign or move funds, and it does not have a wallet-risk oracle. If a check is not available, it says so instead of giving you a fake “safe” verdict.

Questions