Onchain and crypto security

Use a dedicated phone for wallet approvals

Keep wallet and custody approval apps on a phone used only for that purpose.

• No email, social media, messaging or everyday browsing on it.
• Lock the phone number with a carrier PIN and port-out protection.
• Use a long passcode, and keep the operating system updated.

Use a clean computer

A new machine bought directly from the manufacturer is the cleanest start for a device that signs transactions. Fully erasing and reinstalling a used one removes most risks, but can't rule out tampering in firmware or hardware left by a previous owner or reseller.

• Turn on disk encryption and automatic updates.
• Use a standard (non-admin) user for daily work.
• Install only what the wallet work needs, with no unofficial software or unneeded browser extensions.

Sign on trusted networks

Approve transactions on your home network or your phone's own cellular data, not public or hotel Wi-Fi.

• Wi-Fi practices

Understand what MPC changes

A legitimate wallet never broadcasts a private key; a transaction carries only a signature. A fake or compromised wallet app can still steal one, so install wallets only from official sources.

• In a multi-party computation (MPC) wallet, the complete private key isn't held in one place. Separate parties hold key shards and produce a signature together, so one stolen device or shard isn't enough to move funds.
• Recovery and backup are the exception. Depending on the product, recovery can rebuild the key, so the recovery material needs the same protection as the wallet.

• How Protocol Wealth's client-controlled wallets work

Use wallet policies

Shards protect the key; policies protect against approving the wrong transaction. Where your wallet supports them, use:

• an allow-list of approved destination addresses;
• amount and velocity limits;
• a second approver for large transfers.

Avoid address reuse

For most Bitcoin address types, the address holds only a hash of the public key, so the key becomes visible only when coins are spent or a message is signed. Taproot addresses (starting bc1p) are the exception: they show the key as soon as they receive funds. On Ethereum and similar chains, an account's public key can be recovered from its first signature of any kind, whether a transaction or a signed message such as a dApp sign-in or a token permit.

• Receive to a fresh address. Most Bitcoin wallets do this automatically.
• Fresh addresses help privacy today. They are also a low-cost precaution against future advances in computing, including quantum computing, that could one day threaten exposed public keys. No computer today can derive a private key from a public key.

• The cryptography behind our sites and wallets

Verify the full address on the signing device

Address-poisoning attacks send tiny transfers from look-alike addresses that share the first and last characters with one you use. Copying an address from your transaction history can then pick the attacker's.

• Check the whole address on the device that signs.
• Use your address book or allow-list, not your history.
• Send a small test transaction before a large one.

Read what you sign

Token approvals and signed messages can grant a contract the right to move your assets later. Be wary of unlimited approvals and of signature requests from sites you reached through a link. Review and revoke old approvals periodically.

Download only from official sources

Fake wallet apps and sponsored search ads that impersonate wallets and exchanges are common. Reach the app store listing from the vendor's own website, which you type in yourself.

Keep backups separate from what they unlock

An encrypted backup file can be stored in a password manager or cloud storage, but its decryption secret must be held somewhere else.

• Never store a plaintext seed phrase in a password manager, cloud drive, email or photo.
• Use the recovery method your wallet provides, such as a third-party recovery service or a recovery phrase you hold, and know where each piece is.

Test recovery before you rely on it

Practise a recovery with a small balance. Write down who should be contacted, and how, if you are unavailable, and keep that note somewhere secure.

Never share recovery material

Protocol Wealth will never ask for your seed phrase or private key. No legitimate support team will ask for a seed phrase, key shard, backup file or screen share.

• Social engineering and fraud