THE IDEA
Cold storage reduces online exposure
A hardware wallet is one common approach: it stores private keys in a dedicated device and signs transactions there. You still need to verify what you are approving on the device screen.
A must-read before using a crypto wallet
Before you
send, swap or
sign—pause.
A clear, independent checklist for anyone about to send crypto, swap tokens or connect a wallet. Know what to check before you approve a transaction.
✓ No wallet connection✓ No seed phrase needed✓ Independent education
SECURE ELEMENT
◈
OFFLINE SIGNING
COLD STORAGE
PRIVATE KEYS
Stay under your control
SAFER HABITS
Verify before you sign
◈Learn before you choose⌑Protect your recovery phrase✓Pause before every signature
Only have 30 seconds? Start here.Do these high-impact checks first, then explore the full guide
60-SECOND FIELD CHECK
Would you spot the red flags?
Three short, realistic situations. Choose what you would do and get a practical explanation. This is a learning exercise, not a score or a guarantee.
Scenario 1 of 3No answers are saved or sent
Message 01 · “Urgent security check”
A message claims your wallet will be frozen unless you act in ten minutes.
Message 02 · “Approve to continue”
A DApp asks for unlimited token approval, but you expected a small swap.
Message 03 · “Guaranteed recovery”
After a loss, an “on-chain expert” guarantees recovery for an $80 advance fee and remote access to your device.
You’ve completed the field check.
When something feels urgent or unclear, pause. Verify through a separate official route, read the exact transaction, and never share recovery words. This exercise does not inspect your wallet or determine whether a real message is safe.
Never share recovery wordsVerify before signingNever pay to “unlock” recovery
Built from public consumer guidance: FBI Operation Level Up · FTC consumer advice · FBI IC3 cryptocurrency guidance.
01 — Start here
Know what your wallet is asking you to approve
Before confirming a transaction, understand where it goes, which network it uses and what permission you are granting. Your wallet is the signing tool; the transaction details still need your attention.
THE RESPONSIBILITY
Self-custody means you own the backup risk
If a recovery phrase is lost, exposed or entered on a fake website, a device alone may not protect your funds. Anyone with the phrase can usually restore the wallet.
!A wallet never needs your recovery phrase to “verify,” “unlock” or “validate” it online. Never enter it into a website, chat, support form or screen-sharing session.
02 — Compare the options
Choose based on how you use it
Every setup involves trade-offs between convenience, security and recovery. No wallet type removes risk.
Wallet typeEveryday convenienceKey isolationRecovery responsibility
Hardware / cold walletMediumHigher, when used correctlyYou manage the backup
Mobile / software walletHighConnected deviceYou manage the backup
Exchange accountHighProvider holds keysAccount access depends on provider
01 / LEARN
Start with your threat model
Think about what you need to protect, how often you transact, and what you could safely recover if a device is lost.
02 / VERIFY
Check the maker and the source
Buy from the manufacturer or an explicitly authorized seller. Confirm setup instructions using the maker’s official website.
03 / PRACTICE
Test recovery before relying on it
Follow the manufacturer’s guidance and confirm you understand the recovery process before storing meaningful value.
03 — Before you transact
Before you sign: 5 checks to run
Small pauses can help prevent costly mistakes. Use this as a reminder, not a guarantee of safety.
Never share your seed phrase, private key, PIN or wallet password. Legitimate support staff should not ask you to reveal them.
How to use this checklistTick an item after completing that check. A completed list does not guarantee a transaction is safe. Recheck every transaction, and pause if anything is unclear.
04 — Scam watch
Common pressure tactics to recognize
Scammers impersonate real wallet brands and support teams. These examples are general warnings and do not imply wrongdoing by the named brands.
“We can recover your funds”
A stranger promises to trace or restore lost crypto, then asks for an upfront fee, remote access or your recovery phrase. Recovery-fee demands are a serious red flag.
A familiar logo, an unfamiliar link
Fake support accounts, sponsored search results and copycat apps can imitate MetaMask, Trust Wallet, Coinbase/Base, Bitget, OneKey and others.
“Connect to claim your reward”
An unsolicited airdrop or token may lure you to a malicious site or a transaction you do not understand. A token’s name or logo does not prove it is legitimate.
Wallet-specific impersonation examples
Choose a wallet to see common impersonation patterns and practical checks.
Important: These cards describe scams that impersonate wallet brands. They are not allegations that the named providers are involved in fraud. Verify current instructions through the provider’s official app or website.
TokenPocketFAKE SUPPORT · FAKE AIRDROP
A group “admin” messages you privately
An impersonator may offer to “fix” a wallet issue, ask for an unlock fee, or send an airdrop link or form that requests your recovery phrase. They may also direct you to a phishing site.
Protect yourself Don’t open links from unsolicited DMs. Verify the full receiving address character by character; don’t copy it blindly from transaction history.
Warning signs: unsolicited private messages, pressure to pay an unlock fee, or requests to scan a QR code or send funds to a specified address.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
imTokenFAKE APP · FAKE SUPPORT
A look-alike wallet in search results
Copycat apps may reuse a wallet’s name and icon to trick people into importing a wallet. Fake support may contact you by text, phone, or social media and claim you need an upgrade, verification, or recovery.
Protect yourself Reach the app store from the provider’s official website and check the developer name. Start support requests yourself through the official app or site.
Warning signs: mismatched developer details, extra characters in a domain, or anyone asking for your recovery phrase or private key.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
TronLinkFAKE TOKEN · FAKE QR CODE
“Arbitrage,” swaps, or airdrops that ask you to send funds
Imitation apps or tokens can use names similar to popular assets. A fake promotion may ask you to send USDT, connect to a DApp, or scan a QR code. Matching token names do not mean matching contract addresses.
Protect yourself Verify app sources, token contract addresses, and networks through official channels. Ignore unsolicited “support” QR codes.
Warning signs: guaranteed arbitrage, a transfer required to unlock a reward, or a token page asking you to connect to an unfamiliar DApp.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
OneKeyTAMPERED DEVICE · PRESET PHRASE
A hardware wallet that arrives “already initialized”
A replaced or tampered device, or a card with a pre-written recovery phrase, could expose the wallet to someone else. Fake firmware pages may also imitate update instructions.
Protect yourself Initialize the device yourself using its official instructions. A recovery card should be blank; get firmware only through the official app.
Warning signs: a preset PIN, words already written on the recovery card, or setup instructions telling you to use a phrase supplied by someone else.
Conclusion: Treat these signs as a scam attempt. Stop setup and contact the manufacturer through its official site.
Bitget WalletPHISHING LINK · FAKE SUPPORT
“Prize,” airdrop, or “account problem” alerts
Fake sites, texts, QR codes, and support accounts use urgency to push you to log in, connect a wallet, or reveal sensitive information. Fake ads may lead to copycat download pages.
Protect yourself Check the address manually. Contact support from the official app or website. Avoid unknown QR codes and installation files.
Warning signs: prize countdowns, account-freeze threats, unknown QR codes, or login pages on unofficial domains.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
MetaMaskFAKE SUPPORT · MALICIOUS APPROVAL
A “support engineer” asks for your recovery phrase
Scammers may pose as support on social platforms or direct you to fake extensions and websites. They may also ask you to sign an unfamiliar message or approve a broad token allowance.
Protect yourself Start support requests from the official support site. Verify extension sources and read the approval target and scope before signing.
Warning signs: requests for recovery words, remote-control software, or a signature that doesn’t match the action you intended.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
Base AppFAKE TOKEN · FAKE REWARD
A “Base official token” or limited-time claim
Scammers may misuse Base or Coinbase branding to promote fake tokens, early access, or reward campaigns and then ask you to connect a wallet, sign, or reveal recovery information. An unsolicited token doesn’t require visiting its linked site.
Protect yourself Confirm campaigns through official Base or Coinbase announcements. Never submit a recovery phrase for an airdrop or sign a transaction from an unknown source.
Warning signs: claims of an “official Base token” that require an approval or recovery phrase to claim a reward.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
Trust WalletFAKE APP · MALICIOUS DAPP
A fake “wallet verification” page asks for your phrase
Impersonators may claim your wallet needs syncing, verification, or recovery. A phishing DApp may ask you to connect and sign a transaction that moves assets.
Protect yourself Install only from official sources. Reach support from the official site. Check a DApp’s domain and read the transaction details before signing.
Warning signs: a verification page requesting recovery words, or unexpected transfer and approval requests after connecting.
Conclusion: Treat these signs as a scam attempt. Stop contact; don’t click, sign, or transfer.
FBI video: Operation Level Up
The video is hosted with this site. Click play to watch the FBI media kit; it may take a moment to start.
Source: FBI, Operation Level Up · English and translated captions based on the video transcript; timing is approximate. The audio is in English.
05 — Quick answers
Questions people often ask
Does a cold wallet physically store my coins?
No. Crypto assets are recorded on their respective blockchains. A wallet stores or protects the keys that let you authorize transactions.
Can a hardware wallet be hacked?
No device is risk-free. Fake apps, unsafe backups, malicious approvals, compromised computers and physical attacks can all create risk. Keep firmware and setup steps tied to the manufacturer’s verified instructions.
What should I do if my recovery phrase was exposed?
Assume the wallet may be compromised. From a trusted device and a verified wallet, seek reputable official guidance to move remaining assets to a newly created wallet with a new recovery phrase. Never send the exposed phrase to anyone for help.