The most common cause of crypto loss for individual traders is not being rugged or making bad trades — it is losing custody of their wallets through phishing, seed phrase compromise, or malicious transactions. This guide covers the practices that prevent the most common security failures.
Seed phrase security
Your seed phrase (12 or 24 words) is the master key to your wallet. Anyone with your seed phrase has full control of all assets in that wallet, forever, across any device. The rules:
- Write it on paper — never store your seed phrase in a text file, email, notes app, or cloud storage. These can be accessed remotely.
- Multiple copies — keep two or more paper copies in different physical locations (home and another trusted location)
- Never enter it online — no legitimate service ever needs your seed phrase. If anything asks for it, it is a scam.
- Never share it — not with friends, family, support agents, or anyone
Phishing protection
Phishing — fake websites or interfaces designed to steal credentials — is the most common attack vector:
- Always navigate to dApps by typing the URL directly or using verified bookmarks. Never click links in DMs or unsolicited messages.
- Verify URLs carefully — phantom.app vs phantom-app.com vs phantom.io are different websites
- Install the official Phantom extension only from the browser's official extension store
- Be skeptical of any unexpected popup asking you to connect your wallet or approve a transaction
Transaction hygiene
Before approving any Solana transaction in Phantom:
- Read what the transaction does — Phantom shows you what tokens are being sent and what you receive
- Reject any transaction that requests unlimited token approvals unless you understand exactly why
- Be suspicious of any transaction that asks you to send SOL to an unfamiliar address
- After interacting with a suspicious site, consider rotating to a new wallet
Hot wallet vs. cold storage
For trading, accept that hot wallets (connected to the internet) have inherent risk. The best practice:
- Keep only active trading funds in hot wallets (Phantom, trading bot wallets)
- Store long-term holdings in a hardware wallet (Ledger, Trezor) — the private key never touches the internet
- Treat each trading session's funds as separate from savings
Bot wallet security
Telegram trading bots (BonkBot, Maestro, Trojan) hold your private key on their servers. This is a custody risk. Best practice: fund bot wallets only with amounts you're actively trading. Move profits from bot wallets to self-custodial wallets regularly.