NFT Wallet Safety Basics: A Beginner's Guide

Your crypto wallet is where your NFTs and tokens live. Unlike a bank account, there is usually no helpline that can reverse a mistake, so if someone gets hold of your wallet, what they take is very hard to get back. Most losses come from a few common mistakes, and simple habits go a long way.

This guide covers the basics in plain English. You don't need to be technical to follow it.

How a wallet actually works

A wallet such as MetaMask or Rabby doesn't really "hold" your NFTs. They're recorded on the blockchain against your wallet address. What the wallet holds is the private key, the secret that proves you own that address and lets you approve transactions.

Most wallets let you back up that key as a seed phrase (also called a recovery phrase): a list of 12 or 24 ordinary words. Anyone who has those words can rebuild your wallet on their own device and move everything in it. That's why nearly every rule below comes back to one idea: protect the seed phrase and be careful what you sign.

Rule 1: Never share your seed phrase

No genuine support team, marketplace, game or project will ever ask for your seed phrase. If anyone asks, it's a scam, however official it looks.

Good habits:

• Write your seed phrase on paper (or stamp it into metal) and keep it somewhere safe and private.
• Don't store it in a screenshot, photo, email, notes app or cloud drive, where it could be found if another account is compromised.
• Never type it into a website. You should only ever enter it when restoring a wallet inside the wallet app itself.

Rule 2: Check links before you click

Fake websites are one of the most common ways people lose NFTs. Scammers copy a real mint page or marketplace, change one letter in the address, and share the link in replies, adverts or direct messages.

Before you connect your wallet anywhere:

• Get links from the project's official website or verified profile, not from replies or messages.
• Read the web address carefully, letter by letter.
• Bookmark the sites you use often and open them from your bookmarks.
• Be wary of anything that rushes you, such as "free mint ends in 5 minutes" or "claim your airdrop now".

Rule 3: Read what you're signing

Every time your wallet pops up, it's asking you to approve something. Slow down and read it. The most important ones to understand are:

• Transactions that send tokens or NFTs, or pay for a mint. Check the amount and the address.
• Approvals (sometimes shown as "setApprovalForAll" or "Allow access to all your NFTs"). These give another address permission to move your items. Marketplaces need this to list your NFTs, but a fake site can use the same request to empty your wallet.
• Signatures that look like a block of text or code. Some are harmless log-ins, but others can authorise listings or transfers. If you don't understand what a signature does, don't sign it.

If a site you've never heard of asks for permission over all your NFTs, close the tab.

Rule 4: Review and remove old approvals

Approvals don't expire on their own. A permission you gave a site months ago could still be active today. Most block explorers have a token approval checker, and there are well-known approval tools that let you see what you've approved and revoke anything you no longer use. Revoking costs a small network fee.

Rule 5: Use more than one wallet

Many experienced collectors keep two or more wallets:

• A vault wallet that holds the items you care about most. It rarely connects to any website.
• A daily wallet with only small amounts, used for minting, games and trying new sites.

If the daily wallet is ever caught out by a bad link, the vault is untouched. For extra protection, a hardware wallet keeps the private key on a separate physical device, so every transaction has to be confirmed by pressing a button on it.

Rule 6: Watch out for surprise NFTs and tokens

Sometimes unknown NFTs or tokens appear in your wallet. Many are harmless spam, but some are bait. They might carry a link telling you to "claim" or "redeem" something on an outside website. Don't interact with them. Simply hide them in your wallet app if you can.

Rule 7: Keep your devices and accounts tidy

Wallet safety isn't only about the wallet:

• Keep your browser, operating system and wallet app up to date.
• Only install the wallet from its official source.
• Turn on two-factor authentication for your email and social accounts, as these are often used to impersonate you or reset other logins.

Quick safety checklist

Before you connect or sign, ask yourself:

1. Did I get this link from an official source?
2. Do I understand exactly what this pop-up is asking me to approve?
3. Is this the right wallet to be using here, or should I use my daily wallet?
4. Is anyone rushing me or asking for my seed phrase?

If any answer makes you hesitate, stop and check first. Nothing on-chain is so urgent that it can't wait a few minutes.

Check it yourself

Good wallet habits go hand in hand with checking things for yourself. If you hold or are thinking about an ANON NFT, you can look up its backing directly on the blockchain rather than taking anyone's word for it. Our step-by-step guide shows how: check the backing on-chain.

This guide is general information for beginners, not financial or security advice. Always double-check before you sign anything.