The DeFi Wallet Security Checklist: 12 Things to Do Before You Deposit

Here's the uncomfortable statistic behind self-custody: the protocols people use most — Aave, Compound, Lido, the major perp venues — are rarely where money is lost. Losses trace back to the wallet: a fake link clicked from an ad, an unlimited approval granted in 2023 to a contract that got upgraded maliciously, a seed phrase stored in a Notes app that synced to a stolen laptop. The attack isn't exotic. The defense isn't either.

This checklist is built for the way people actually use DeFi in 2026 — one main wallet, a handful of blue-chip dApps, occasional experiments. Work through it once in about an hour, then keep the monthly section recurring on your calendar. Every item is either free or costs a single Layer 2 transaction.

Foundation: four things to set up once

1. Seed phrase exists only on paper, offline, twice

No cloud notes, no email to yourself, no photo, no password manager unless you specifically use its encrypted-notes feature and understand the sync model. Write the 12 or 24 words twice by hand, store both copies somewhere private and water-safe, and verify you can read your own handwriting a week later. Anyone who asks for the phrase — "support," an "exchange migration," a DM from a friend — is running a scam without exception.

2. Split your money across wallet roles

Use at least two wallets: a vault that holds the majority and connects to almost nothing, and a spending wallet for daily dApp interaction, funded with what you'll use in the near term. A third burner for experimental mints and unaudited protocols costs nothing to create and contains the blast radius of a bad signature. Your long-term holdings should never sit in the wallet you click random links with.

3. Type URLs, ignore ads, bookmark the real ones

Search ads for wallet and exchange names are systematically bought by phishers — the top result for "rabby download" or "gmx" is regularly a lookalike. Type the domain manually the first time, verify it against the project's official docs or X account, then bookmark it. Treat every DM unsolicited — including from "friends" whose accounts may be compromised — as hostile until verified out-of-band.

4. Lock the device and the wallet

Biometric or PIN unlock, auto-lock at one to five minutes, OS updates installed, and no browser extensions you can't name and justify. Wallet-drainer extensions were among the earliest and most persistent attack patterns; they only need an unlocked browser session.

Before every signature: the three-second ritual

5. Read what you're signing — and use a wallet that makes it readable

Raw hex data is unreadable by design of the UI, not of the system. Wallets like Rabby decode the contract and method, and simulate the transaction before you sign, showing plain-language warnings like "this transfers your entire USDC balance" or "sets approval for unlimited amount." If the decoded action doesn't match what you intended — a "claim" that requests an approval, a "swap" that calls an unknown contract — reject it.

6. Verify the contract on a block explorer

Before interacting with any protocol for the first time, find the contract address on its official docs and look it up on the explorer (Etherscan, Basescan, Arbiscan). Check the contract is verified, note the deploy date, and compare it against what the site is asking you to approve. A "claim" site pointing at a three-day-old contract with a similar name is the single most common drain pattern.

7. Approve finite amounts for anything new

An approval is not a payment — it's a standing permission for a contract to pull tokens later. For new or long-tail protocols, set the spending cap to exactly the amount you're depositing. Reserve unlimited approvals for audited, battle-tested venues you use repeatedly; even there, understand the permission never expires on its own.

8. Reject anything that arrives uninvited

Random NFTs in your wallet, "free claim" sites, tokens that appeared after bridging, urgent messages about wallet migration or "synchronization" — the asset is the bait, the next signature is the trap. Don't connect to the site, don't approve the token, don't try to "sell" it. Legitimate protocols do not airdrop obligations that require your signature to view.

Maintenance: the ten-minute monthly audit

9. Revoke approvals you no longer use

Open revoke.cash (or the explorer's built-in token-approval checker), connect the spending wallet, and review every contract with an open allowance. Revoke anything you don't recognize or no longer actively use — one transaction each, cents on a Layer 2, a few dollars on mainnet. The goal isn't paranoia; it's shrinking the list of contracts whose future compromise can touch your wallet.

10. Sweep dust and archive the experiment wallet

After an airdrop farm, testnet season or one-off experiment, move anything valuable out of the burner and retire it. Small unknown token balances aren't harmless curiosities — interacting with them later is a common drain vector. Clean wallets make anomalies visible: when your daily wallet suddenly holds a token you never bought, you'll notice.

11. Keep one record of positions, addresses and recovery steps

Maintain a simple offline document listing each wallet address, where funds are deployed (protocol, chain, position type), and the practical exit steps. This isn't just disaster recovery — it's how your household can act if you're unavailable, and it prevents the slow loss of funds to forgotten positions in protocols that sunset or migrate.

The structural upgrade: when hardware signing becomes mandatory

12. Move long-term signing onto a hardware wallet around $1,000

The threshold isn't magical — it's where one avoided incident pays for the device many times over. A hardware wallet such as Ledger keeps the private key on the device, so even a compromised browser can't produce a valid signature without your physical confirmation on its screen. Critically, you verify the real recipient and amount on the device display, defeating lookalike-contract attacks that fool software wallets. It pairs with Rabby or MetaMask as the signer, so daily UX barely changes — only the final confirmation step moves to hardware.

Two setup details matter: buy directly from the manufacturer (never secondhand or "discounted" from a marketplace), and when interacting through it, reject "blind signing" prompts — if the device can't show contract details, use the wallet's clear-signing support or treat that interaction as high-risk.

Security is the other half of yield

Notice how none of the twelve items involves predicting which protocol gets hacked. That's intentional: protocol risk is visible, graded and diversifiable — you can check a venue's audit history, TVL and risk grade before depositing with our yield risk grader. Wallet risk is self-inflicted and binary: a 6% APY you keep beats a 12% APY that exists until one bad signature. Run this checklist once before your next deposit, put item 9 on the calendar, and the odds of ever writing a "my wallet was drained" post become genuinely small.

Sources and further reading

• ethereum.org — Security and scam prevention — official guidance on phishing, approvals and self-custody habits.
• revoke.cash — multi-chain token approval explorer and revocation tool.
• Ledger Support — device setup, clear signing and blind-signing risks.

Frequently asked questions

Do I need a hardware wallet for DeFi?

A reputable software wallet is enough for a few hundred dollars in learning money. Above roughly $1,000 long-term, or if you connect to several protocols monthly, a hardware wallet like Ledger pays for itself: keys never touch an internet-connected device and every approval needs physical confirmation, neutralizing most malicious-signature attacks.

What does revoking token approvals do, and how often?

It cancels a contract's standing permission to pull a token from your wallet. Unlimited approvals remain valid until revoked, so a later contract compromise can drain approved tokens without another signature. Audit monthly at revoke.cash, revoke anything you don't actively use (cents on an L2), and revoke immediately after experimenting with an unaudited protocol.

Is an unlimited token approval dangerous?

It's the default and acceptable with audited, actively used blue-chip contracts — but treat it as a standing permission, not a one-time payment. For new or long-tail protocols, approve only the exact deposit amount via the spending-cap field. Finite approvals make revocation failures non-fatal.

How do most DeFi wallets actually get drained?

Through signed malicious transactions from phishing, not protocol hacks: a fake ad or DM leads to a lookalike site, an "airdrop claim" requests a signature, and that signature grants approvals or moves assets. Typed URLs, block-explorer contract verification, pre-sign simulation and hardware confirmation close off nearly the entire attack chain.

Read next: 10 yield red flags to check before depositing, moving your first $1,000 from an exchange, and our review methodology.