# Storing NFTs so you can’t be phished out of them > Almost nobody loses NFTs to hacking. They lose them by signing something, or by putting their recovery phrase somewhere it could be read. This covers what you’re actually protecting, the wallet setup that makes theft hard, and the approval audit almost nobody performs. Source: https://thenftacademy.com/learn/how-to-store-nfts-safely Last updated: 2026-09-11 Site: The NFT Academy (https://thenftacademy.com) --- Almost nobody loses NFTs to hacking in the way the word implies. There’s no brute-forcing a private key, and the blockchain itself isn’t the weak point. People lose NFTs because they signed something they didn’t read, or because they put their recovery phrase somewhere it could be found. Both are process failures, which means both are preventable by habit rather than expertise. ### What are you actually protecting? Your NFTs aren’t in your wallet. They’re records on a blockchain that name an address as the controller. Your wallet holds the **private key** that can produce signatures for that address. So the thing you’re securing is a key. Two consequences follow, and they’re the whole of this subject: - **Whoever has the key controls the assets.** There’s no account recovery, no identity check, no appeal. - **Transfers are irreversible.** A stolen NFT isn’t recoverable. There’s no institution with the power to undo it. This is a different security model from anything most people have dealt with, and it’s why the precautions below are more absolute than they would be elsewhere. ### How should you store a seed phrase? When you create a wallet you’re given twelve or twenty-four words. That phrase **is** the wallet. Every address, every key, everything — derived from those words. Anyone who reads them owns everything in it, permanently. **Do:** - Write it on paper, or stamp it into steel if the value warrants it - Store it where you would store a passport or a deed - Consider a second copy in a different physical location - Restore it once into a fresh wallet to confirm you copied it correctly **Never:** - Photograph it, or store it in cloud storage, notes, email or a messaging app - Type it into any website, for any reason, ever - Share it with support staff — no legitimate support ever asks - Store it in a password manager’s note field, which defeats the point of keeping it offline That last "never" carries most of the weight. **No legitimate service will ever ask for your recovery phrase.** Not to validate it, not to sync a wallet, not to claim an airdrop, not to resolve an issue. Every request is theft. If you internalise one sentence from this site, make it that one. ### Why should you separate your wallets? A single wallet holding everything, connected to everything, is the arrangement that produces most losses. Split it. **Hot wallet** — the one you browse with. Connects to marketplaces, mints, tries new things. Holds only what you can afford to lose. If it’s compromised, you lose that and nothing else. **Cold wallet** — holds anything valuable. Connects to nothing. Ideally backed by a hardware device. You move things *into* it and rarely out. Moving an NFT between your own wallets costs gas, which is a real if small friction. It’s substantially cheaper than the alternative. The entire value of this arrangement is that a compromise of the wallet you use daily doesn’t reach the things you care about. ### Do you need a hardware wallet? A hardware wallet stores the private key on a dedicated device and never exposes it to your computer. Transactions are signed on the device, requiring a physical button press. This matters because it changes the shape of the attack. Malware on your computer can read anything a software wallet holds. It can’t press a button on a device on your desk, and it can’t extract a key that never leaves that device. Practical notes: - **Buy direct from the manufacturer.** Supply-chain tampering of resold devices is a documented risk. - **The device generates the seed phrase itself.** If a device arrives with a phrase already written down, it’s compromised — return it. - **The phrase still governs everything.** A hardware wallet protects the key from your computer; it doesn’t protect you from writing the phrase somewhere careless. - **Read the screen.** The point of the device is that it shows you what you’re signing, independently of a potentially compromised computer. Skipping that discards most of the benefit. ### What are token approvals, and why do they matter? This is the part that’s under-covered relative to how often it matters. When you list an NFT for sale, you don’t hand it to the marketplace. You grant its contract **permission to move it on your behalf** — often permission over the entire collection, via a call named `setApprovalForAll`. The token stays with you; the permission persists. Those approvals don’t expire. A permission granted to a marketplace contract in 2021 is still live in 2026. If that contract is ever compromised, or was malicious from the start, the approval is an open route to your tokens with no further action needed from you. **Audit them periodically.** Tools such as Revoke.cash list every approval a wallet has granted and let you revoke them. Revoking costs gas, so do it in one session a couple of times a year, and revoke anything you no longer use. Two habits that reduce how much this matters: - Prefer approving a **single token** over an entire collection where the interface allows it - Do marketplace interaction from the hot wallet, so cold-wallet assets never have approvals against them at all ### How do you read a transaction before signing it? Every wallet shows you the transaction before you approve it. This is the last line of defence and it takes seconds. Stop if you see: - **`setApprovalForAll`** you didn’t initiate - A **blanket approval** when you’re doing something specific - A **signature request** on a page you didn’t expect one — off-chain signatures can authorise transfers without an obvious transaction - Anything at all from a site that **opened itself**, or that you reached from a message The pattern worth learning: a legitimate action asks for the narrowest permission that accomplishes it. A request for broad permissions during a narrow action is the signal. ### What can you do if your wallet is compromised? **Speed matters more than being methodical.** 1. Move everything of value to a fresh wallet immediately, starting with the most valuable. 2. Revoke approvals, but only after assets are moved, and only if the seed phrase itself isn’t compromised. 3. If the **seed phrase** was exposed, abandon the wallet entirely. Every address derived from it is permanently compromised. Revoking approvals does nothing; the attacker has the key itself. 4. Don’t engage with anyone who offers to recover stolen assets. Recovery services in this space are, without meaningful exception, a second theft aimed at people who have just experienced a first one. ### The short version - The recovery phrase goes on paper, offline, and into no website ever - Separate hot and cold wallets, and don’t blur the line - Hardware wallet for anything you would be upset to lose - Read every signature request before approving it - Audit and revoke approvals a couple of times a year None of this requires technical skill. It requires doing five things consistently. Nearly every loss in this space traces back to one of the five not being done once. Next: [scams and red flags](/learn/nft-scams-and-red-flags) covers the specific attacks these habits defend against, and how each one actually works. ## Frequently asked questions ### Where are my NFTs actually stored? On the blockchain, not in your wallet. Your wallet holds the private key that lets you move them. This is why 'my wallet was hacked' is usually inaccurate — what happened is that someone obtained the key, or was granted permission to move the token by a signature the owner provided. ### Do I need a hardware wallet? If you hold anything you would be upset to lose, yes. A hardware wallet keeps the private key on a device that never exposes it to your computer, so signing requires physical confirmation. It converts a remote attack into one requiring physical access. At around $60–150 it’s cheap relative to what it protects. ### What is a token approval and why does it matter? When you list an NFT for sale, you grant the marketplace contract permission to move it on your behalf. That permission persists until revoked. If that contract is later compromised, the approval is a live route to your tokens, which is why periodically reviewing and revoking old approvals is worth the ten minutes. ### Is it safe to keep NFTs on an exchange? You’re trading one risk for another. An exchange protects you from your own mistakes and exposes you to the exchange failing, freezing withdrawals or being compromised. History offers examples of all three. For anything of real value, self-custody with a hardware wallet is the better trade. ### What should I do if I think my wallet is compromised? Move assets to a fresh wallet immediately — speed matters more than tidiness. Then stop using the compromised wallet entirely; don’t attempt to 'clean' it. If the seed phrase was exposed, every address derived from it is compromised permanently, and no amount of revoking approvals changes that.