Stablecoin wallets are attractive targets because the assets can move quickly and transfers are often difficult to reverse. Security therefore needs to cover more than a strong password. You must protect account recovery, signing keys, devices, browser sessions, destination addresses, token approvals, and the people who can authorize a transfer. The strongest setup is one you can operate consistently, including during travel, device loss, or a convincing support scam.
This checklist applies to USDC, USDT, and similar token wallets. Some controls are specific to self-custody, while others apply to hosted accounts. Begin by identifying your custody model, then use the relevant sections below. For a higher-level comparison, see custodial versus self-custody wallets.
1. Inventory what you are protecting
List every wallet, hosted account, network, device, recovery method, and connected application. Include old wallets that still have token approvals or transaction history. Record the purpose and expected maximum balance for each. An unknown or forgotten wallet cannot be monitored, updated, or retired safely.
Separate assets by function. A phone wallet used for daily payments should not hold the same balance as a reserve wallet. A business should separate treasury, vendor payments, customer refunds, and testing. Set target and maximum balances so excess funds are moved to a more restrictive layer on a schedule.
2. Protect recovery phrases and private keys
A recovery phrase is typically the master secret for a self-custody wallet. Anyone who obtains it may recreate the wallet and transfer assets. Ethereum.org’s security and scam-prevention guidance emphasizes that legitimate services should not ask for recovery phrases or private keys. Treat any such request as an attempted theft, even when the message uses the name and logo of a familiar provider.
- Write the phrase offline and verify every word and its order.
- Do not photograph it, email it, paste it into notes, or store it in ordinary cloud storage.
- Keep backups in physically separate, secure locations appropriate to the value at risk.
- Do not type the phrase into a website reached through search results or a direct message.
- Test recovery with a low-value wallet before relying on the method.
- Document instructions for trusted successors without exposing the secret itself.
For significant balances, consider a hardware signer, multi-signature arrangement, or professionally designed recovery solution. Avoid inventing complex secret-splitting schemes that your future self or family cannot reconstruct. Complexity can become a denial-of-access risk.
3. Harden hosted wallet accounts
Use a unique password generated and stored by a reputable password manager. Enable the strongest authentication offered, preferably a hardware security key or passkey rather than SMS when available. Protect the email account connected to the wallet with equal or stronger controls because email recovery can bypass the wallet password.
Review active sessions, authorized devices, withdrawal addresses, API keys, and notification settings. Remove anything you do not recognize. Turn on alerts for logins, password changes, withdrawals, and new address additions. A delay before a newly added withdrawal address becomes active can provide time to respond to account takeover.
4. Secure the device that signs or accesses transactions
Install operating-system and browser updates promptly. Use device encryption, a strong unlock code, and automatic locking. Avoid rooting or jailbreaking a device used for financial accounts. Do not install wallet software from links in messages; navigate to the verified provider site or official app store listing and confirm the publisher.
For self-custody, consider using a dedicated browser profile or device that is not used for risky downloads, gaming modifications, or unknown extensions. Browser extensions can read and alter page content. Remove extensions you do not need and review permissions. A hardware wallet can keep keys off the computer, but you must still verify transaction details on the hardware device’s trusted display.
5. Build a phishing-resistant support rule
Scammers exploit urgency: “your wallet will be frozen,” “your funds are at risk,” or “complete verification now.” They may impersonate support in search ads, social media replies, chat groups, and phone calls. Establish one rule before a crisis: support never receives your recovery phrase, private key, full authentication code, or remote control of your device.
Use bookmarks for wallet and exchange sites. Verify domain spelling and certificate warnings. Do not trust a site merely because it appears first in search results. When an alert seems real, close the message and open the provider through your saved route. Contact support through the authenticated app or official site, not through a number or link provided by the alert.
6. Review every transaction on the final signing screen
Malware can replace a copied address. Address-poisoning attacks can insert a look-alike address into your transaction history. A malicious application can request broad token permissions while describing a harmless action. The final review must therefore happen at the moment of signing, using the wallet or hardware display.
- Confirm the token and network.
- Compare the destination with the source from which you copied it.
- Check the amount, decimal placement, and total fee.
- Review any memo, destination tag, or reference.
- For contract interactions, understand whether you are sending, approving, swapping, or granting ongoing access.
- Reject unexplained “set approval for all” or unlimited allowance requests.
For new addresses or large amounts, use a test transfer. Save verified recipients in an address book only after a successful test, and require additional approval before changing a business allowlist.
7. Manage token approvals and connected applications
Some decentralized applications ask for permission to spend tokens from your wallet. An approval can remain active after you stop using the application. If the contract or interface is compromised, that permission may be abused. Review and revoke unnecessary allowances periodically using a trusted network explorer or wallet feature.
Disconnecting a website from the wallet interface does not always revoke an onchain token allowance. These are separate actions. Keep a low-balance interaction wallet for experimental applications and avoid granting approvals from a reserve address. Verify contract addresses through official documentation before interacting.
8. Add governance for business wallets
Businesses should not share one seed phrase or login among employees. Use named users, role-based permissions, multiple approvals, transaction limits, and auditable actions. Separate payment creation from approval. Require an independent communication channel to verify changes to supplier addresses, especially after an email request.
Create an incident plan covering lost devices, suspected phishing, compromised staff accounts, provider outages, and unexpected token movements. Identify who can pause payments, rotate credentials, contact providers, and communicate with counterparties. Run a tabletop exercise before an incident so responsibilities are familiar.
9. Monitor without creating alert fatigue
Enable alerts for meaningful events: login from a new device, recovery change, new withdrawal address, large transfer, token approval, and failed authentication. Review wallet activity on a schedule. For business addresses, consider independent watch-only monitoring so an observer can detect activity without possessing signing authority.
Keep transaction records that include the hash, network, token, amount, fee, destination, purpose, and approver. Good records speed investigation and reconciliation. They also help distinguish a legitimate payment from an unauthorized transfer when activity is discovered later.
10. Know what to do during an emergency
If a hosted account may be compromised, use a clean device to change credentials, revoke sessions, secure the connected email, and contact the provider through its official channel. If a self-custody seed phrase may be exposed, create a new securely generated wallet and move remaining assets after verifying the destination. Do not send funds to an address supplied by an unsolicited “recovery specialist.”
When malicious token approvals are suspected, revoke them from a trusted environment and move valuable assets if necessary. Preserve transaction hashes, messages, email headers, phone numbers, and screenshots for reports. Be cautious of secondary scams that promise guaranteed recovery for an upfront fee.
A monthly wallet security review
- Confirm balances are within the intended limits for each wallet.
- Review hosted-account sessions, devices, and withdrawal addresses.
- Check self-custody token approvals and connected applications.
- Install verified software and firmware updates.
- Test transaction alerts and watch-only monitoring.
- Confirm recovery materials remain readable, complete, and securely stored.
- Review staff access and remove former employees or contractors.
- Update the incident contact list and provider support routes.
Security is a repeatable process
A stablecoin wallet is secure only when keys, accounts, devices, approvals, and people are managed together. The most important habits are simple: keep recovery secrets offline, use strong authentication, verify final transaction details, limit exposed balances, and separate routine activity from reserves.
Apply this checklist before your next transfer, then use the USDC and USDT pre-transfer workflow to reduce address and network errors at the point of payment.
