When people think about wallet security, they usually think about the recovery phrase and the private key. Those matter a great deal, and we cover them in our guides on keeping your recovery phrase safe and how your wallet stores your private key. But there is a layer underneath both that gets far less attention: the phone or computer the wallet actually runs on.
The strongest encryption in the world does not help much if the device using it is compromised. Malware can watch what you copy, record what you type, or quietly swap an address at the moment you paste it. The good news is that the realistic threats are ordinary ones: a fake app, a risky browser extension, a scammer on a call, a lost phone. Most depend on something you do, which means habits can prevent them.
Keep the system and the browser updated
Operating systems and browsers ship security patches regularly, and many close holes that attackers were already using. Turning on automatic updates for your phone, computer and browser is one of the cheapest protections available.
The same goes for your wallet app, with one caveat: install and update it only from the official app store listing or the wallet's official website. Our article on fake wallet apps explains how counterfeit apps and lookalike download pages work, and why a search result or an ad is not proof that a link is genuine.
If a device is old enough that it no longer receives security updates, treat it as a poor place to keep meaningful funds, however well it still runs.
Think twice about jailbreaking, rooting and sideloading
Phone operating systems isolate apps from one another, and that isolation helps protect a wallet app's stored data. Jailbreaking an iPhone or rooting an Android phone removes some of those guardrails, and installing apps from outside the official stores removes a layer of screening. Some people have good reasons for doing this. But if the same phone holds a wallet with real funds, you are weakening protections the wallet depends on.
Public Wi-Fi: less scary than it sounds, but not risk free
A common worry is that using a wallet on a coffee shop network will expose your keys. That is not how it works. Transactions are signed on your own device, so your private key never travels over the network, and most modern sites and wallet connections use HTTPS to encrypt traffic.
The real risks on untrusted networks are different:
- Fake hotspots. An attacker sets up a network with a familiar name.
- Fake login or captive pages. The network pushes you to a page imitating something you trust.
- Tampered lookups. A hostile network tries to steer you to a lookalike site that asks you to sign something harmful.
All of these lead back to phishing, so a careful look at the site address and at what you are about to sign matters more than the network itself. Our guide on avoiding wallet phishing and drainer scams covers the checks. For anything significant while away from home, your phone's mobile data removes a whole category of doubt. A VPN can add some privacy, but it does not make a malicious site safe.
Give crypto its own browser profile
If you use a browser extension wallet, the browser becomes part of your security perimeter. Extensions can request broad permissions, such as reading and changing data on the sites you visit, and every extra extension is more code with that potential reach.
A tidy approach is a separate browser profile just for crypto. Modern browsers keep profiles apart, each with its own extensions, cookies and saved data. In that profile, install only the wallet you actually use. Keep your everyday profile, with its coupon tools, video downloaders and assorted add-ons, for everything else. Review your extensions from time to time, and be wary when one you already have suddenly asks for new permissions. For a broader comparison, see browser extension wallets versus mobile wallets.
Never grant remote access to someone who contacts you
Remote access and screen sharing tools are legitimate software, widely used by IT departments. They are also a favorite of scammers who pose as support staff. Once someone can see your screen, they can see your recovery phrase if it appears, watch you unlock your wallet, and guide you step by step into moving funds yourself.
The rule is simple: real wallet teams do not ask you to install remote access software, share your screen, or read out your recovery phrase. If someone who contacted you first asks for any of these, end the conversation. Our article on fake support and impersonation scams walks through how these approaches usually unfold.
Watch out for cracked software and shady downloads
Pirated software, game cheats, cracked creative tools and fake utilities are a well documented way to spread information stealing malware, the kind designed to hunt for saved passwords, browser data and wallet files. If you do crypto activity on the same computer, treat unofficial downloads as a real risk rather than a harmless shortcut. A related threat is clipboard malware, which swaps a copied address for the attacker's, covered in our guide to clipboard hijacking.
Protect the device itself
A wallet app is only as safe as the lock in front of it.
- Use a strong passcode, not a short or predictable one, with biometrics as a convenience on top.
- Set a short auto lock time so the device does not stay open on a table.
- Be aware of shoulder surfing. In some theft cases, the thief first watches the victim enter a passcode in public, then takes the phone. Features such as Apple's Stolen Device Protection, available on newer iPhones, add extra checks for sensitive changes when the phone is away from familiar places.
- Enable the built in find and remote lock features.
- Do not keep screenshots or photos of your recovery phrase on the phone, since photo libraries often sync to the cloud.
Match the device to the amount
Not every wallet needs the same protection. A sensible pattern, discussed in our hot and cold wallets explainer, is to keep a small spending balance in an everyday app and larger amounts in a hardware wallet, whose keys never sit on a general purpose device. For experiments with unfamiliar apps, a separate burner wallet limits what a mistake can cost.
If you think a device is compromised, stop using it for anything sensitive, move funds to a fresh wallet with a newly generated recovery phrase created on a clean device, and follow our guide on what to do if your wallet is compromised.
The takeaway
No single habit makes you invulnerable. But updates, official downloads, a separate browser profile, no remote access for strangers and a properly locked device together remove most of the ordinary ways a wallet gets compromised. Pair them with careful signing habits, and the device underneath your wallet becomes a strength instead of a weak point.
This article is general educational information, not financial or security advice for your specific situation.