You are your own security team
Holding crypto in your own wallet instead of on an exchange removes the risk of exchange failure or frozen withdrawals. In return, you take on every security and recovery task a bank or exchange would normally handle. There is no help desk to reset a password and no one to reverse a mistaken transfer.
This guide covers what self-custody actually makes you responsible for, how to back up and distribute a recovery phrase, and how to separate devices and wallets. It walks through hypothetical recovery scenarios, from a lost phone to inheritance, and the checks to make before signing.
What self-custody makes you responsible for
Self-custody involves three broad responsibilities: keeping keys and recovery phrases away from anyone else; making sure you can recover funds if a device is lost or broken; and knowing exactly what you approve each time you sign.
Ethereum.org's security guidance advises never sharing a recovery phrase, using only official wallet sites and apps, and not opening a wallet through links in messages you receive. Most losses start not with sophisticated hacks but with missing one of these basics.
Backing up and splitting the recovery phrase
The basic practice is to write the recovery phrase on something that never touches the internet, such as paper or a metal plate. Bitcoin.org's wallet security guidance recommends keeping offline backups in more than one location, and storing copies in different places guards against fire or flooding.
Some wallets let you add a passphrase on top of the recovery phrase. A leaked phrase is then useless without the passphrase, but forgetting the passphrase locks you out too. If you use one, back it up separately and securely.
Hypothetical recovery scenarios
The table compares what happens in common situations with and without preparation. The scenarios are hypothetical.
| Situation | Without preparation | With preparation | How to prepare |
|---|---|---|---|
| Phone lost or broken | Funds inaccessible | Restore on a new device with the phrase | Offline recovery phrase backup |
| House fire | Backup destroyed too | Restore from a copy stored elsewhere | Copies kept in separate locations |
| Photo of phrase leaked from cloud | Funds stolen | Funds moved to a new wallet first | Never make digital copies |
| Holder dies | Family unaware the assets exist | Family follows written instructions | An inheritance letter describing where and how |
| Address poisoning | Funds sent to a look-alike address | Full address check catches it | Use an address book; check every character |
Most self-custody risk comes down to preparation rather than technology. Planning for inheritance is the step holders most often skip.
Separating devices and wallets
Keep the wallet that holds most of your funds separate from the one you use day to day with apps. An active wallet that connects to dapps and grants approvals should hold only what you need; the bulk should sit in a storage wallet that rarely connects, ideally a hardware wallet.
The phone or computer running your wallet needs care too. Avoid unknown apps and browser extensions, keep the operating system and wallet software up to date, and check two-factor authentication on email and messaging accounts linked to your wallet.
Checks before signing
Address poisoning has become a common scam. An attacker sends a zero-value transaction from an address whose first and last few characters match one you often use, planting it in your history in the hope that you will copy the wrong address next time.
When sending, avoid copying addresses from transaction history; use a saved address book or an address the recipient gave you through an official channel. Compare the full address shown on your hardware wallet's screen, and send a small test amount first for large transfers.
It also helps to slow down whenever a request feels urgent. Messages that pressure you to act quickly, whether a supposed security alert or a limited-time offer, are a hallmark of scams that Ethereum.org's security page warns about.
A security checklist
If you hold assets in self-custody, review these items regularly.
- Confirm the recovery phrase exists only on offline media and not in photos, cloud storage, or messages.
- Check that backups sit in separate locations, and that any passphrase is backed up separately.
- Separate storage and active wallets, and keep only what you need in the active one.
- Use an address book for transfers and compare the full address on the hardware wallet's screen.
- Prepare an inheritance letter that explains where to find assets and how to access them, without writing the phrase itself.
Limits and responses
No amount of preparation removes self-custody risk entirely. Sophisticated phishing, malware, and physical coercion remain, and mistaken transfers cannot be undone. The CFTC warns of fraud and hacking risks in virtual currency trading.
The scenarios here are hypothetical, and wallets differ in features and recovery methods. Check your wallet's current official guidance, and consider starting self-custody with an amount you can afford to get wrong while you learn.