Web3 Hardware Wallet Safety Guide: 10 Must-Know Security Tips For Crypto Owners

Written by Werner Vermaak

Introduction

There’s no denying that Web3 self-custody in cold storage, where you keep access to your crypto assets offline at all times by storing its private key or recovery seed, is the best way to protect yourself against scammers, hackers, and unscrupulous exchanges like FTX. It’s Not Your Keys, Not Your Crypto after all, as we were once again reminded in 2022 and 2023’s end of Q2 hacks recently. 

If you’re a beginner in Web3 or a seasoned investor or trader, make sure you live the following rules every day in your crypto life.

Tip 1: Understand What a Hardware Wallet Is (And Isn’t)

Your phone or computer is only as strong as its weakest link (often you) and can be a huge vulnerability depending on how strong its security and your browsing habits are. If you have a sizeable portfolio or are looking to HODL for a long time, then it’s a no-brainer to invest in a dedicated physical wallet device that provides additional layers of defense against hackers and scammers 24/7, such as a secure element (EAL6+ preferably) and biometric verification on the phone. 

A hardware wallet is a powerful physical storage device you can hold, designed to keep your private keys safe offline. This keeps them away from online threats. These keys are super important for approving crypto transactions. They’re different from software wallets (or ‘hot wallets’) which are online and can be more at risk. All transactions on a hardware wallet must be physically approved by the owner with a button push. 

With hardware wallets (sometimes called ‘cold wallets’), your private keys are kept safe and only used for transactions. When you want to make a transaction, you just connect this device to an app with the internet, like your phone or computer, and you’re good to go. 

What a hardware wallet CAN’t protect you against is careless or irresponsible behavior. You are your own bank when you self-custody your crypto, and when you give unauthorized access to your device and phone or expose your recovery seed or click on malicious links that trick you into sending funds to a scammer,  you risk losing everything. Charity starts at home, so don’t give charitable donations to hackers or scammers. They make enough each year already. 

Tip 2: Always Buy from Trusted Brands 

A good way to test if your hardware wallet brand is playing open cards with you and not trading off your privacy and safety is to check whether their code is open-source. CoolWallet shines in this regard and you can read our transparency report here. 

Don’t be a statistic: Research your potential wallet maker thoroughly and be certain that they have a provable track record. 

CoolWallet was founded in 2014 and created the world’s first Bluetooth hardware wallet model in 2016. We’re celebrating our 10-year anniversary in 2024 and that’s equal to 100 years in TradFi! 

Tip 3: Always Buy from Trusted Sources 

This way, you avoid getting fake or compromised devices, which is where bad actors give you a device loaded with malicious software or hardware, which can trick you into either revealing your private key or seed or rerouting a transaction to send funds to a different public address. 

Where possible, always try to buy directly from the manufacturer where possible, or an official and reputable reseller. Make sure to check your package for any signs of tampering, which has been an issue in the past for USB form wallets like Ledger and Trezor. CoolWallet was designed with this in mind, and therefore our patented cold compression technology helps to ensure that any attempt at tampering will be immediately visible. Furthermore, there’s no space on our smart card-shaped Web3 hardware wallet for the bad guys to fit in any malicious components. 

Tip 4: Protect Your Seed Backup Phrase

The best hardware wallets contain a secure element to keep your private key safely locked inside where no one can extract it. However, your recovery seed is still vulnerable – it’s a 12 to 24-word backup phrase derived from your private keys that’s like a copy of it. It’s super important for getting your assets back or making a backup because if anyone has it they can simply restore your wallet on a different device. That’s why you never take a photo or even print out your recovery seed as a digital footprint is very hard to erase. 

Therefore: 

 Don’t take pictures of it or save it online. Never create a digital footprint but rather write down your seed and keep it safe and private where not even Grandma or a cleaner can stumble across it. CoolWallet uses 2 ways to make your recovery seed more secure:

1. We don’t use seed words, but rather seed number sets (derived from the words) which is useful for non-native English speakers who might miswrite a word
2. Users have the option to only display the seed sets on the device itself and not on the app itself. This keeps it offline at all times, even during the creation of the seed.

Tip 5:   Trust Your Hardware Wallet’s Screen

Always check and confirm details on your hardware wallet’s screen. It’s safer than your computer or phone screen. There could be sneaky stuff happening on those other screens like a compromised app that could have been modified to display wrong receiving addresses. 

CoolWallet Pro and S, our popular cold wallet models for sophisticated DeFi and entry-level users, both boast groundbreaking e-ink screens built into their smart card form factors, which means all transaction details can be reviewed offline before approval. 

Tip 6: Keep Your Wallet Updated

Make sure your hardware wallet’s software is always up-to-date for the best protection. It’s very important that your hardware wallet maker frequently updates the software and firmware for your phone app and the wallet itself. CoolWallet devs are some of the most active in the crypto space and they frequently roll out sophisticated updates to keep your coins and NFTs as safe as houses. And of course to roll out amazing new features like our SmartScan, our real-time Web3 Dapp transaction analyzing tool!

Tip 7: Store Your Seed Phrase Safely

Think about keeping your hardware wallet’s recovery seed in a super safe place, like a bank vault or a personal vault at home. Be careful about who knows you have one and always keep your identity hidden. 

An additional measure can be to crypto-fy your seed phrase by replacing letters or words with clues that only you will know when you write it down. E.g. for a phrase word like “beach” you can just write “where I met my friend X” or something to that effect, or for a word like “pass” you can write it “paXY ( so it can be anything from past, path, palm, pack, pace, pale, pail, etc)  and leave yourself a tip that X= your sister’s name’s 5th letter and Y= your first pet’s name’s first letter. However, make sure you leave a decoder with loved ones in case something happens to know and know that if you forget the meaning of these words, it can be very costly. 

The beauty of CoolWallet’s numerical seed phrase is that you can easily make it look like an invoice or account statement to hide in plain sight (don’t!), as no one will be expecting a numbers-based seed phrase. 

Tip 8: Be Careful What You Share

Flexing your crypto bags or boasting about your NFT collections has cost many investors and traders a lot of money in the past. Don’t become a target by bragging about your crypto assets and always be on the lookout for scams, which often target social media users (Twitter, Discord and Telegram) through phishing and social engineering campaigns. 

Tip 9: Always Double-Check

Check twice, do once. 

There’s no undo button on the blockchain and when funds are moved, they’re moved permanently and immutably, as per the rules of Mr. Nakamoto themselves. Being cautious and extra vigilant when doing anything with crypto is a prerequisite for HODLing successfully, or you might be another crypto private key horror story for future generations to wince at.

This means:

• Always make sure your backup words or numbers are correct, by carefully triple-checking them (here’s how to verify your seed phrase is correctly written down. 
• Is seed word number 13 “slip”, “clip” “flip” “flap”, “slap”, ship, or “snap”? Avoid the guesswork by writing slowly and meticulously. 
• Another way to future-proof your recovery seed is to make an extra handwritten copy so that you have an additional reference in case you can’t decipher your handwriting later. 
• Always double-check a receiving address’s details before sending funds. Never type it out to avoid mistyping it. Be extra vigilant when sending funds to unknown people on social media. 
• Use a QR where possible to avoid any mistakesDouble-check the addresses on safe screens and look for security signs to protect against bad guys. 

Tip 10: Know DeFi and NFTs’ Big Security Risks 

While hardware wallets give you the ultimate control over your crypto and true Proof of Keys power, remember there are risks involved, especially when operating in DeFi. Understand the risks around blind signing, rugpulls, and the most popular phishing tricks to ensure you don’t accidentally authorize the wrong transaction or Dapp. 

When in doubt, double-check the results on CoolWallet’s Smart Scan analysis. Be careful of meeting people in person if you have a sizable portfolio in order to mitigate risks like the “$5 wrench attack”. Don’t connect your main wallet to qualify for potential airdrops from shady anon protocols. 

If you’re nervous about putting all your eggs in one hardware wallet, why not get 2 or more? One for your main portfolio and one for a smaller trading one. This way you can ensure that if you are ever compromised, the bad guys don’t get all your funds. Check out our CoolWallet Duo Plus offers!

CoolWallet App also offers a convenient hot wallet module (separated from the cold wallet module) that allows you to keep funds in hot storage for faster trading and other features. Just be aware that it comes with additional risk. When in doubt, ship it over to your cold wallet. 

Final Thoughts

We hope this guide was useful to you. Remember, crypto wallet security shouldn’t have to be super complicated. Just know the biggest Web3 and DeFi security essentials, keep a low profile about what you have and where you have it, and spread your risk by mixing up how many wallets you use and where you keep your recovery seed. 

Use common sense and intuition, and don’t act on FOMO or fear if you can avoid it. Scammers in particular will try to engineer a crisis situation that will make you panic and do something stupid. 

You got this. Stay safe, and above all, stay cool, calm, and collect with CoolWallet 🤜🤛 😎!