Storing NFTs so you cannot be phished out of them

Almost nobody loses NFTs to hacking in the way the word implies. There is no brute-forcing a private key, and the blockchain itself is not the weak point.

People lose NFTs because they signed something they did not read, or because they put their recovery phrase somewhere it could be found. Both are process failures, which means both are preventable by habit rather than expertise.

What you are actually protecting

Your NFTs are not in your wallet. They are records on a blockchain that name an address as the controller. Your wallet holds the private key that can produce signatures for that address.

So the thing you are securing is a key. Two consequences follow, and they are the whole of this subject:

• Whoever has the key controls the assets. There is no account recovery, no identity check, no appeal.
• Transfers are irreversible. A stolen NFT is not recoverable. There is no institution with the power to undo it.

This is a genuinely different security model from anything most people have dealt with, and it is why the precautions below are more absolute than they would be elsewhere.

The seed phrase, which is everything

When you create a wallet you are given twelve or twenty-four words. That phrase is the wallet. Every address, every key, everything — derived from those words. Anyone who reads them owns everything in it, permanently.

Do:

• Write it on paper, or stamp it into steel if the value warrants it
• Store it where you would store a passport or a deed
• Consider a second copy in a different physical location
• Restore it once into a fresh wallet to confirm you copied it correctly

Never:

• Photograph it, or store it in cloud storage, notes, email or a messaging app
• Type it into any website, for any reason, ever
• Share it with support staff — no legitimate support ever asks
• Store it in a password manager’s note field, which defeats the point of keeping it offline

That last “never” carries most of the weight. No legitimate service will ever ask for your recovery phrase. Not to validate it, not to sync a wallet, not to claim an airdrop, not to resolve an issue. Every request is theft. If you internalise one sentence from this site, make it that one.

Separate your wallets

A single wallet holding everything, connected to everything, is the arrangement that produces most losses. Split it.

Hot wallet — the one you browse with. Connects to marketplaces, mints, tries new things. Holds only what you can afford to lose. If it is compromised, you lose that and nothing else.

Cold wallet — holds anything valuable. Connects to nothing. Ideally backed by a hardware device. You move things into it and rarely out.

Moving an NFT between your own wallets costs gas, which is a real if small friction. It is substantially cheaper than the alternative. The entire value of this arrangement is that a compromise of the wallet you actually use does not reach the things you actually care about.

Hardware wallets

A hardware wallet stores the private key on a dedicated device and never exposes it to your computer. Transactions are signed on the device, requiring a physical button press.

This matters because it changes the shape of the attack. Malware on your computer can read anything a software wallet holds. It cannot press a button on a device on your desk, and it cannot extract a key that never leaves that device.

Practical notes:

• Buy direct from the manufacturer. Supply-chain tampering of resold devices is a documented risk.
• The device generates the seed phrase itself. If a device arrives with a phrase already written down, it is compromised — return it.
• The phrase still governs everything. A hardware wallet protects the key from your computer; it does not protect you from writing the phrase somewhere careless.
• Read the screen. The point of the device is that it shows you what you are signing, independently of a potentially compromised computer. Skipping that discards most of the benefit.

Token approvals, which almost nobody audits

This is the part that is under-covered relative to how often it matters.

When you list an NFT for sale, you do not hand it to the marketplace. You grant its contract permission to move it on your behalf — often permission over the entire collection, via a call named setApprovalForAll. The token stays with you; the permission persists.

Those approvals do not expire. A permission granted to a marketplace contract in 2021 is still live in 2026. If that contract is ever compromised, or was malicious from the start, the approval is an open route to your tokens with no further action needed from you.

Audit them periodically. Tools such as Revoke.cash list every approval a wallet has granted and let you revoke them. Revoking costs gas, so do it in one session a couple of times a year, and revoke anything you no longer use.

Two habits that reduce how much this matters:

• Prefer approving a single token over an entire collection where the interface allows it
• Do marketplace interaction from the hot wallet, so cold-wallet assets never have approvals against them at all

Read what you sign

Every wallet shows you the transaction before you approve it. This is the last line of defence and it takes seconds.

Stop if you see:

• setApprovalForAll you did not initiate
• A blanket approval when you are doing something specific
• A signature request on a page you did not expect one — off-chain signatures can authorise transfers without an obvious transaction
• Anything at all from a site that opened itself, or that you reached from a message

The pattern worth learning: a legitimate action asks for the narrowest permission that accomplishes it. A request for broad permissions during a narrow action is the signal.

If something goes wrong

Speed matters more than being methodical.

1. Move everything of value to a fresh wallet immediately, starting with the most valuable.
2. Revoke approvals — but only after assets are moved, and only if the seed phrase itself is not compromised.
3. If the seed phrase was exposed, abandon the wallet entirely. Every address derived from it is permanently compromised. Revoking approvals does nothing; the attacker has the key itself.
4. Do not engage with anyone who offers to recover stolen assets. Recovery services in this space are, without meaningful exception, a second theft aimed at people who have just experienced a first one.

The short version

• The recovery phrase goes on paper, offline, and into no website ever
• Separate hot and cold wallets, and do not blur the line
• Hardware wallet for anything you would be upset to lose
• Read every signature request before approving it
• Audit and revoke approvals a couple of times a year

None of this requires technical skill. It requires doing five things consistently. Nearly every loss in this space traces back to one of the five not being done once.

Next: scams and red flags covers the specific attacks these habits defend against, and how each one actually works.