We use necessary cookies for site function. For analytics and marketing, we need your consent. You can change your mind anytime. Privacy Policy
Crypto Wallet Security: Seed Phrases, Passkeys, and How Not to Lose Your Funds
Olvis Gil · September 27, 2026 · 8 min readIn crypto, a wallet isn't an app — it's a set of keys, and whoever holds the keys holds the money. There is no "forgot password" flow and no fraud department to reverse a bad transaction. That makes wallet security the single most important skill for anyone in Web3. If you're just getting set up, start with our Freighter wallet guide for Stellar, then come back here for the security fundamentals. (También disponible en español: herramientas de seguridad.)
Custodial vs non-custodial
A custodial wallet — typically an exchange account — means a company holds your keys for you. You get password resets and customer support, but you're trusting their security and solvency. A non-custodial wallet puts the keys on your device: full control, full responsibility. The crypto maxim "not your keys, not your coins" exists because exchange failures have wiped out billions in user funds. Both models are defined in our glossary.
The attacks that actually drain wallets
Lookalike domains and malicious browser extensions impersonate real wallets to harvest recovery phrases. Always verify the URL character-by-character and install only from official sources — see our Freighter setup guide for the safe install path.
"Support agents," fake airdrops, and "wallet verification" forms that ask for your 12 or 24 words are always scams. No legitimate service ever needs your phrase — it is only ever typed into your own wallet during recovery.
Attackers send a dust transaction from an address that looks like one you use, hoping you copy their address from your history. Always confirm the first and last characters of the recipient address — or better, use saved contacts.
Attackers port your phone number to intercept SMS 2FA and email resets, then drain exchange accounts. Use authenticator apps or hardware keys instead of SMS, and ask your carrier for a port-out PIN.
A compromised dApp can ask you to sign a transaction that empties your account — and one click is all it takes. Read every signing request; on Stellar, check which operations and trustlines it contains before approving.
Your security checklist
Write it down, store it offline in two separate secure locations. Never in photos, notes apps, email, or cloud storage — anything connected to the internet can be breached.
Keep daily-use amounts in a hot wallet like Freighter, and long-term savings in a hardware wallet or multisig setup. A hot wallet is a pocket wallet, not a vault.
Passkeys (WebAuthn) replace passwords and seed-phrase UX with device-bound biometrics — phishing-resistant by design. Smart wallets on Soroban can use passkeys as signers, removing the seed phrase single point of failure.
Stellar has native multi-sig: require 2-of-3 keys to move funds, so one compromised key or device cannot drain the account. See our glossary entry on multi-signature for how it works.
Check the URL, read the transaction details in the signing window, and reject anything you did not initiate. When in doubt, cancel — a rejected transaction costs nothing.
Passkeys: the end of seed-phrase anxiety?
Passkeys use the secure hardware already in your phone or laptop to sign with biometrics — the credential is bound to the real domain, so a phishing site literally cannot ask for it. Combined with smart-contract wallets (account abstraction) on Soroban, passkeys enable wallets with social recovery, spending limits, and no seed phrase at all. For developers, this is one of the most important shifts in wallet UX — covered in our Advanced Smart Contract Development and Blockchain Security Auditing courses.
Frequently asked questions
A seed (recovery) phrase is a human-readable encoding of your wallet's private keys — typically 12 or 24 words. Anyone who has it controls your funds, and if you lose it there is no recovery. It is simultaneously your backup and your biggest attack surface.
Passkeys remove the "type your secrets into a website" attack entirely — the credential never leaves your device and is bound to the real domain, so phishing sites cannot capture it. They are a major UX and security upgrade, though you should still keep a recovery method configured.
Custodial wallets (exchanges) hold your keys — convenient, but you are trusting their security and solvency. Non-custodial wallets give you full control and full responsibility. Many people use both: an exchange for trading, a self-custody wallet for holding.
Act fast: create a fresh wallet on a clean device, transfer all assets immediately, and revoke trustlines/authorizations on the old account. Assume the seed phrase is burned forever and never reuse it.
Stellar accounts support native multi-signature and weighted signers, so you can build 2-of-3 setups without smart contracts. Watch what you sign with wallets like Freighter, and be cautious with trustlines — only add assets from issuers you recognize.
References
[1] Freighter — official Stellar wallet
[2] passkeys.dev — passkey documentation and guidance