Device Security
Wallets run on real devices and networks. System updates, screen locks, app sources, public Wi-Fi, browser extensions and remote access all affect the practical security boundary.
On this page
Keep systems and browsers updated
Updates help fix known vulnerabilities, but they should come from official operating-system channels. Do not install “security patches” or remote-maintenance tools sent by strangers.
A repeatable order of checks is more reliable than memory. Review source, network, account, target and expected outcome each time so the same safety logic carries across wallets and DApps.
Use local access controls
Use a reliable device lock and avoid browser storage of sensitive recovery information. Shared or public computers are poor places to import a wallet and should not receive a seed phrase.
When a task involves a third-party contract, bridge, validator or web service, separate that external risk from the wallet itself. A wallet can display and sign a request, but it cannot guarantee the safety of outside code or services.
Raise verification on public networks
Public Wi-Fi is not automatically malicious, but it calls for stricter checks of HTTPS, domains and connection anomalies. Avoid high-risk signing or larger transfers on a suspicious network.
Put this concept back into the current network, account and request type before acting. Identify what the interface is asking for, then decide whether a signature, gas payment or ongoing permission is actually required.
Extensions, clipboard and remote tools
Browser extensions and local software can hold broad permissions. Unknown tools may read pages or alter clipboard contents. Remove unneeded software and reject remote-control requests from supposed support.
Do not rely on a button label or a familiar-looking page as the reason to continue. Compare the request with the on-chain target, network state and expected result, and stop when those pieces do not line up.
Practical checklist
- Confirm that “Keep systems and browsers updated” matches the task you intend to perform
- Confirm that “Use local access controls” matches the task you intend to perform
- Confirm that “Raise verification on public networks” matches the task you intend to perform
- Confirm that “Extensions, clipboard and remote tools” matches the task you intend to perform
Risk reminder
Seed phrases and private keys remain under the user’s control. Legitimate support should not ask for a seed phrase, private key or verification code. Review address, network and amount before transferring; blockchain transactions generally cannot be unilaterally reversed by a wallet. Third-party DApps and smart contracts carry risk, so review spender and permission scope and consider revoking unused approvals.