How to set up a crypto wallet safely

Quick steps

1. Choose the wallet. Pick a wallet that supports your coins and device. If you are unsure, use our wallet finder or the beginners guide.
2. Get the genuine app. Type the official domain yourself or use a bookmark, and follow its link to the app store or extension store. Check the developer name, download count and reviews before installing.
3. Create a new wallet. Choose create a new wallet, not import, unless you are restoring your own existing phrase. Never use a seed phrase someone else gave you.
4. Back up the seed phrase offline. Write the words in order on paper or stamp them on metal. Do not screenshot, photograph, email or store them in cloud notes or a password manager you also use online.
5. Confirm the backup. Complete the wallet's word-check step and re-read your copy for spelling. Store it somewhere private, safe from fire and water.
6. Lock the app. Set a strong PIN or password and turn on biometrics. On a hardware wallet, choose a PIN and consider a passphrase.
7. Send a small test. Copy your receive address from the wallet, check the network, and send a small amount first. Confirm it arrives before sending more.
8. Practise recovery. With a small balance, restore the wallet from your seed phrase on a second device or a hardware wallet to prove your backup works.

Before you start

Set aside 20 quiet minutes somewhere private. You need the device you will use, a pen and paper (or a metal backup plate) and nobody looking over your shoulder or a camera pointed at your screen. Decide which wallet you want first: how to choose a crypto wallet or the wallet finder can help.

Step 1: get the genuine app

Fake wallet apps and look-alike websites are among the most common ways people lose crypto, and they often appear as paid search ads. In April 2026 a fake Ledger app on Apple's Mac App Store collected recovery phrases for a week and about $9.5M was stolen (iThinkDiff, Apr 2026). In March 2026 Kaspersky found 26 phishing apps imitating wallets on Apple's App Store (Malaysian Wireless, Apr 2026).

• Type the official domain yourself or use a saved bookmark. Each of our reviews names the domain as plain text, for example metamask.io, trustwallet.com, ledger.com or trezor.io.
• Use the app-store link on the official site rather than searching the store.
• Check the developer name, install count and age of the listing. Impersonators often have few reviews or recent dates.
• For desktop wallets, verify the download's signature where the project publishes one (Electrum and Trezor Suite do). See how to spot fake wallet apps.

Step 2: create and back up the seed phrase

When you create a wallet, it shows a recovery phrase of 12, 20 or 24 words. This phrase is your wallet: anyone who has it can take your funds from anywhere in the world.

• Write it down by hand, in order, with the word numbers. Check each word's spelling against the screen.
• Do not take a screenshot or photo. Kaspersky found the SparkCat malware in App Store and Google Play apps in February 2025 that scanned photo galleries for pictures of recovery phrases (The Hacker News, Feb 2025).
• Do not save it in cloud notes, email or messaging apps. Seed phrases kept in LastPass vaults stolen in 2022 have been linked to more than $35M in thefts, though researchers called the link likely rather than proven (Krebs on Security, Sep 2023).
• Store the paper or metal copy somewhere private. Consider a second copy in another secure place.

More detail in our seed phrase safety guide.

Step 3: lock it down

• Use a strong device passcode and a separate wallet password or PIN.
• Keep your phone's operating system and the wallet app updated.
• Think twice about automatic cloud backup of the wallet. In April 2022 a scammer took over a user's Apple ID and drained his MetaMask wallet through its iCloud backup; MetaMask then published steps to turn that backup off (Decrypt, Apr 2022).
• If you use a hardware wallet, buy it from the manufacturer or an authorised reseller. In October 2026 Ledger confirmed that devices sold cheaply through a Malaysian reseller carried a hidden implant that leaked seed phrases; Galaxy Research estimated losses above $90M, which Ledger had not confirmed (Crypto Briefing, Oct 2026).

Step 4: receive and test

Open the wallet's Receive screen, choose the network, and copy the address from there, never from your transaction history (see address poisoning). Send a small amount first and confirm it arrives. If you are moving funds from an exchange, choose exactly the same network on the exchange as the wallet shows. Our address checker can confirm which network an address belongs to.

Your first weeks

• Expect scam DMs: nobody from a wallet company will contact you first, and none will ask for your phrase.
• Ignore tokens and NFTs that appear unexpectedly; they often link to drainer sites.
• Connect only to apps you sought out yourself, and read every signature. See wallet drainers.
• Review your token approvals every few months.

Frequently asked questions