Security

A hardware wallet is the best defense for your seed phrase.  It keeps your private keys offline and never exposes them to the browser, keyboard, or camera.

Why it matters:

A safe wallet does not make a safe transaction.  The attacks below all live in the ten seconds between “I’m ready to send” and “Confirm” — and every one is defeated by habits, not tools.

• Address poisoning.  Thieves dust your wallet with tiny transactions from lookalike addresses engineered to match the first and last four characters of ones you actually use — betting you will copy from your transaction history.  Rule: never copy an address from history; keep a verified address book, and when checking, compare middle characters too.
• Clipboard hijackers.  A common malware class silently swaps the address on your clipboard as you paste.  Rule: after every paste, re-read the address — and treat the hardware wallet’s screen as the only truth: what it displays is what will happen, whatever the computer shows.
• The test-transaction habit.  First send to any new address is a small one — then confirm receipt at the destination, not on the explorer: the counterparty tells you they got it, or you see it in the receiving wallet you control.  A test that merely “lands” proves only that you sent somewhere — a poisoned address receives test transactions just as smoothly as real ones.  Only after independent confirmation, send the rest — to the address copied fresh from your verified address book, not from the test transaction in your history.
• No blind signing.  If the device asks you to approve data it cannot render meaningfully, it is asking for faith, not confirmation.  Keep blind signing disabled unless a specific, verified interaction requires it — then re-disable it.
• A signature can be a theft.  Modern drainer kits don’t ask you to send — they ask you to sign: a message (a “Permit” or approval) that lets them pull your tokens later, gas paid by them.  If a site you didn’t reach by bookmark asks for any signature — especially one mentioning “Permit”, “approve”, “setApprovalForAll”, or an unlimited amount — stop.  Nothing moving at signing time is not evidence of safety; it is the design of the attack.
• No safety net on PulseChain.  On Ethereum, wallets like MetaMask scan a transaction before you sign it and warn about known drainers.  MetaMask’s security alerts do not cover PulseChain — chain 369 is not on its supported-network list (checked September 27, 2026) — so on PulseChain nothing checks the transaction for you.  The habits on this card are the check.
• Approval hygiene.  Every token approval you have ever granted stays live until revoked — sweep them on a schedule (see the Wallets guide).  On PulseChain that includes approvals you never granted there: the May 2023 launch copied Ethereum’s full state, so every approval you had made on Ethereum before then is live on PulseChain too.  Revoke.cash lists and revokes PulseChain approvals.
• “Upgrade your wallet” on Ethereum.  Ethereum’s 2025 upgrade added EIP-7702: one signature can hand an address’s control to a contract.  PulseChain has not adopted it, but the same seed opens the same address on Ethereum, where eHEX sits.  A “smart account upgrade” request from a site you didn’t reach by bookmark is the same theft as a Permit.

Two wallets do what one cannot.  The spending wallet — a hot wallet — holds what you trade, farm, mint and connect to new sites with.  The vault holds everything else: it lives on the hardware wallet, connects to nothing new, and signs rarely.  A phishing site, a drainer approval or a stolen phone reaches only the wallet it touched.

• Top up, sweep back.  When the spending wallet runs low it is refilled from the vault; when it grows, the surplus goes back.  A spending wallet left to grow becomes a second vault with none of the vault’s protection.
• A throwaway address for the unknown.  A new dApp, a mint, or an airdrop claim can be tried from an address that holds only what that one interaction needs, so its approvals never sit on anything that matters.
• The vault’s approvals stay empty.  A vault that never approves a contract has nothing for a drainer to pull.  Staking from the vault on go.hex.com, reached by bookmark, is a transaction, not an approval.

A multisig wallet is a smart contract that needs signatures from several keys — say 2 of 3, each on its own hardware wallet — before it moves anything.  One stolen key, one phished signature or one lost device moves nothing by itself.  The cost is more devices, more steps on every transaction, and a backup plan for every key.

• The contracts are on PulseChain; the official app is not.  Safe, the most widely used multisig, has its contracts on PulseChain — copied from Ethereum at the May 2023 launch.  Safe’s own app does not support PulseChain: a December 2024 request on Safe’s forum was answered with Safe’s policy of leaving each network to run its own.
• The interface is the weak point.  Any PulseChain Safe website is someone else’s, and a multisig is only as safe as the page it signs through.  Each signer’s hardware-wallet screen is still the only truth.
• Worth it at size.  For most holders the spending-wallet-and-vault split above does the same job with less to go wrong.  A multisig earns its complexity when one key is too much trust for the amount it guards.

Everything above defends machines and accounts.  The most successful crypto attacks defeat neither — they are conversations, and they work on smart people because they are built by teams who do nothing else all day.  Learn the five scripts and the one tell they share.

• The “support agent.”  Appears in your DMs minutes after you post a question anywhere public, helpful and patient, and eventually needs your seed phrase or a “validation” transaction to fix your issue.  The rule that ends it: nobody legitimate DMs first — no protocol, no wallet vendor, no exchange, ever.
• The recruiter.  A generous job offer, a friendly interview process, then a “take-home assignment” or “assessment tool” to install.  The installer is the payload — this is the playbook of state-level groups, aimed precisely at people known to hold crypto.  Career talk never requires installing anything.
• The long con (“pig butchering”).  Months of genuine-feeling friendship or romance, then an investment opportunity on a slick platform where deposits show gorgeous returns — and withdrawals need “taxes,” then “fees,” then silence.  The platform was theater from the first day.  The tell: any relationship that ends up steering where your money goes.
• The giveaway / impersonation.  A famous account promises to double what you send, or a “protocol migration” needs you to move funds “to stay eligible.”  Sending crypto to receive crypto is the whole scam, every time.
• The fake authority.  A badge at your door, or a call from the “FBI,” “IRS,” or “Europol”: your funds are “part of an investigation” and must move to a “secure government wallet” for safekeeping.  No agency, anywhere, takes custody by having you send crypto — that request is the entire scam, and it especially hunts older holders.  Comply physically and never lie, but verify the badge like a URL: call the office yourself, at a number you look up — a real agent expects verification and waits; only an impostor pressures against it.  Real seizures arrive as paperwork through lawyers, not surprises on a sidewalk — and “I want to speak with a lawyer” costs a real case nothing.

The shared tell is urgency.  Every script manufactures a deadline, because pressure is what turns careful people careless.  The universal defense costs nothing: sleep on it.  No legitimate opportunity in an ecosystem of immutable contracts expires overnight.

First, the twist most newcomers miss: 2FA does nothing for your actual wallet.  A self-custody wallet is not an account — there is no login, no server, and nobody to show a second factor to.  The seed phrase is total authority, and no 2FA exists on-chain.  If you catch yourself thinking your crypto is “protected by 2FA,” you are thinking of an exchange account, not your wallet.

Where 2FA is critical is the account perimeter around your crypto life — the four accounts and the one passcode that, if taken over, can reach your money or your machine:

• Your email — the master key: it can password-reset everything else.  Give it the strongest 2FA you own.
• Any exchange or on-ramp account — where fiat meets crypto is where account takeover pays a thief directly.
• Your password manager — it holds the rest of the keys to the perimeter.
• The Apple or Microsoft account controlling your crypto machine — remote takeover of the account can mean remote reach into the device.
• Your phone's passcode — it unlocks the authenticator, the email, and every reset link on this list.  Nobody else's face or fingerprint belongs on it.

The type matters as much as having it:

• Best: a hardware security key or passkey (FIDO2) — phishing-resistant by construction: an authenticator code can be typed into a pixel-perfect fake site, but a security key cryptographically checks the real domain before it answers — a perfect phish gets silence.  One catch: the key only protects logins that use it — remove weaker fallback methods (SMS, authenticator codes) from the account, or the phisher simply asks for those instead.  The canonical device is a YubiKey or Yubico's FIDO-only Security Key (^$29–58 each); your Trezor can also serve as one, but separation of duties argues for a dedicated key — the money device stays in the drawer, the login key rides the keychain.  Buy two and register both everywhere — a lone key’s main guarantee is lockout when it’s lost.  And keep the jobs straight: a security key authenticates you to services; it is not a wallet and never signs a crypto transaction.
• Good: an authenticator app (rotating six-digit codes) — solid, but the code can still be phished by a convincing fake page.
• Last, or never: SMS codes.  SIM-swapping is the signature crypto attack — the thief social-engineers your carrier into porting your number, then resets your exchange and your email in one afternoon.  Remove SMS as a fallback wherever an account allows it, and set a port-freeze PIN with your mobile carrier.

For completeness: paid SIM-swap-protection carriers exist (Efani is the best-known name) — a boutique phone company whose product is that your number cannot be casually ported: verified account changes, port cooldowns, insurance, at a premium monthly price.  Our honest read: it solves the problem from the wrong end for most people.  The free discipline above — port-freeze PIN, and making SMS worthless by removing it from every account that touches money — protects you even if a carrier fails.  A middle path can cost nothing: give financial accounts a VoIP number (Google Voice–style — U.S.-only; other countries have equivalents) instead of your real cell.  No SIM exists to swap — though the number is only as strong as the email account behind it (the hardware key goes there too), and some banks and exchanges refuse VoIP numbers outright.  The paid service earns its keep for one profile only: the known target — publicly associated with large holdings, doxxed, or previously attacked (the full physical-world playbook is in Physical Security & OPSEC).  As always here: documented, not endorsed.

One habit ties it together: keep 2FA out of the same basket as the password — codes in a separate app or key, never stored beside the password they protect, or the “second” factor quietly becomes the first.

A private email provider (Proton Mail is the best-known; Tuta is another) helps crypto security in a way most people misname: the win is not mainly encryption — it is breaking the links that let attackers find, profile, and recover-attack you.

• Sever identity from crypto activity.  A fresh address with no ties to your name means exchanges and wallet vendors know a persona, not a person — and breach dumps from those services cannot be correlated back to you.  Correlation is exactly how SIM-swap targets get selected.
• Aliases as tripwires.  One unique address per service: a "Ledger" email arriving at your exchange-only alias is instantly exposed as phishing, a breach announces exactly who leaked, and a burned alias gets deleted without moving your real account.
• Break the SIM-swap chain at the first link.  Signup without a phone number, recovery by phrase instead of SMS — the steal-number → reset-email → reset-everything chain from Two-Factor Authentication never starts.
• Zero-access storage.  Your mailbox holds the keys to the whole account perimeter — KYC documents, statements, reset links.  Zero-access encryption means a provider breach leaks ciphertext.  Honest caveats: mail in transit to ordinary recipients is not end-to-end, and Swiss (Proton) or German (Tuta) privacy law shields you from thieves and profilers, not from lawful orders — which is fine, because thieves are the threat model.

The working structure: keep your identity email for real life; create one private address that exists only for crypto-adjacent accounts; never cross the streams.  And the same twist as 2FA applies: none of this protects the wallet itself (no login to protect), and the private mailbox is only as strong as its own second factor — the hardware key goes on it too.  As always: documented, not endorsed.

Before any site loads, your device asks a DNS resolver — the internet's phonebook — to turn the name you typed into a numeric address.  Every site, every wallet, every RPC gateway starts with one of these lookups, and whoever answers it decides where your traffic actually goes.

Plain, out-of-the-box DNS has two weaknesses that matter for crypto:

• Lookups travel unencrypted — on public WiFi or through your ISP, anyone on the path can read which crypto sites you visit, building a profile of what you hold and where
• A wrong answer sends you to the attacker's server — a poisoned router or hostile network can answer a real name with a different address (DNS spoofing).  HTTPS usually objects loudly when this happens — which is why a sudden certificate warning is a stop sign, not something to click through

The Two Protections:

• Encrypted DNS (DoH / DoT) — the lookup rides inside encryption, so nobody on the path can read it or rewrite the answer.  Built into modern systems: "DNS over HTTPS" in Firefox and Chrome, "Private DNS" on Android, encrypted-DNS profiles on Apple devices
• Filtering resolvers — Quad9 (9.9.9.9), Cloudflare's 1.1.1.2, and NextDNS refuse to resolve names on known malware and phishing blocklists.  A phishing link that never resolves never loads — one settings change protects every app on the machine, and set at the router it covers every device in the house

A VPN (section 5) moves this problem rather than solving it: a good one carries your lookups inside the tunnel to its own resolver.  The failure mode to know is the DNS leak — lookups slipping outside the tunnel to your ISP while the VPN is on — and free leak-test sites exist to check for exactly that.

Start with the threat model this protocol already gives you: with a hardware wallet, the computer never holds keys that can move funds.  So the operating system’s job shrinks to three things — don’t get phished, don’t run malware that swaps addresses on your screen, and don’t leak your seed during setup.  That contest is won by a well-patched, locked-down appliance, not an exotic fortress — and the honest answer differs by machine.

On a MacBook: current macOS on Apple Silicon, hardened.

• Why stock macOS wins here — Apple Silicon gives you a secure enclave, verified boot, and a cryptographically sealed system volume, so malware can’t quietly patch the OS underneath you; notarization plus rapid automatic updates beat any realistically-maintained alternative.
• Turn on Lockdown Mode (Settings → Privacy & Security) — a one-switch hardening built for exactly the "targeted individual holding assets" profile; it disables the attack surfaces real exploits use.
• FileVault on, automatic updates on, non-admin daily account — three switches, most of the win.
• Why not Linux or the privacy OSes on a Mac — Qubes OS (the genuine gold standard for compartmentalization) does not run on Apple Silicon at all; Tails is x86-only; Linux via Asahi is impressive but incomplete.  An unsupported OS on unsupported hardware means unpatched gaps — less secure, wearing a security costume.
• Intel MacBook?  Check your support window — macOS 26 Tahoe is the last release that runs on Intel; macOS 27 (September 2026) is Apple silicon only, and Apple's pattern is about three more years of security patches for the final version.  A machine that stops receiving security patches matters more than any OS choice.  Plan the replacement.

On a Windows PC: current Windows 11, hardened — or a dedicated Linux appliance if you’ll maintain it.

• Windows 10 reached end of support on 2025-10-14 — unless the machine is enrolled in Microsoft's Extended Security Updates program (extended in June 2026 to October 2027), it has been unpatched for months — and even ESU is a countdown, not a fix.  Upgrade or retire it before it touches anything crypto.  This one line outranks everything else in this list.
• Windows 11 done right — TPM 2.0 + Secure Boot (required by 11 anyway), BitLocker on, automatic updates on, Microsoft Defender left on (it is genuinely good now), Smart App Control on (Windows allows it only while S mode is off and optional diagnostic data is on), and a standard non-admin account for daily use.
• Respect the ecosystem risk — the malware economy overwhelmingly targets Windows, and modern infostealers specifically hunt browser profiles and wallet extensions.  The dedicated-machine rule matters more on Windows, and pirated software is a leading way these infections arrive: a cracked installer runs with the owner's permission, and so does the infostealer it carries.
• The Linux option is real on a PC (unlike a Mac) — a minimal, auto-updating distribution used only for crypto sidesteps the Windows malware ecosystem entirely; Qubes OS runs properly on many PCs and is the expert-tier answer.  The honest caveat: a poorly-maintained Linux box is weaker than a well-patched Windows 11 — choose it only if you’ll keep it current.

Either way, the checklist is the same: dedicated machine or at minimum a dedicated non-admin account; full-disk encryption on; automatic updates on; nothing installed beyond the browser, the wallet software, and the password manager; bookmarks-only navigation; verify every contract address against Appendix A.  That stack, plus the hardware wallet, beats any exotic OS with a distracted operator.  Step-by-step walkthroughs: set up your Mac · set up your Windows PC.

Read this section before you ever need it.  In the bad hour, order is everything — the thief is racing you, and most people run the steps backwards.  Signs you are in that hour: a transaction you did not make, an approval you do not recognize, a seed phrase that was ever photographed, typed, or seen — or a machine behaving strangely after you installed anything.

1. Stop touching the suspect machine.  Do not log in anywhere “to check” — every keystroke on it may be watched.
2. From a clean device, create a new wallet with a new seed on your hardware wallet, and move liquid funds to it — most valuable first.  Tokenized stakes move too: a tokenized HSI is an NFT — transfer it with the same urgency, because the thief can move it exactly as easily (an untokenized HSI must be tokenized first, from the same compromised address — two transactions, same race).  A native HEX stake cannot be transferred, but it can be ended — by you or by the thief, early with penalty or at maturity — and the HEX lands on the same compromised address, which the thief's bot is watching.  That is not "safe, note it"; it is a race: end and sweep in the same instant, or accept that at maturity the thief can.  Positions held inside a protocol (a delegated stake comes free only by retiring its HTTs first) are the same race, one step longer.
3. Revoke every approval on the old addresses, still from the clean device — a live approval can drain a token later without another signature.
4. Rotate the account perimeter — email first, then password manager, then exchanges — new passwords, hardware-key 2FA, all sessions signed out everywhere.
5. Only now deal with the machine: full wipe and clean install (the Mac / Windows setup guides are the rebuild recipe).

One rule with no exceptions: a seed that was ever exposed — photographed, typed into a computer, stored in a cloud note, seen by anyone — is burned forever, even if nothing has been stolen yet.  Thieves warehouse seeds and wait.  Migrate at the next calm opportunity; never bet on “it’s been fine so far.”