This NFT wallet security checklist gives collectors and creators a repeatable way to store NFTs safely, review transactions, reduce approval risk, protect recovery materials, and respond quickly if a wallet may have been exposed to phishing.
Overview
A secure NFT wallet is not defined only by the app or hardware device you choose. Security depends on the complete workflow around the wallet: how you create it, where you keep the recovery phrase, which sites you connect to, what you sign, and how you respond when something looks wrong.
Start by separating wallets according to their purpose. A small, limited-balance wallet can be used for unfamiliar mints or experimental applications. A trading wallet can handle routine marketplace activity. A vault wallet should hold valuable NFTs and interact with as few websites as practical. This separation limits the damage from a mistaken signature or compromised application. For a fuller setup plan, see how to set up separate mint, trading, and vault wallets for NFTs.
For high-value holdings, consider a hardware wallet for NFTs. A hardware wallet can keep signing keys isolated from the computer or phone used to browse, but it does not make every transaction safe. You still need to verify the website, collection, network, recipient address, and requested permission before approving an action. A hardware device also needs a carefully protected backup; losing the device is inconvenient, while losing the recovery material can be more serious.
Use this checklist before connecting to a new application, before signing an unfamiliar request, after installing wallet software, and whenever you suspect phishing. The exact buttons and terminology vary by wallet app, marketplace, and network, so treat the steps below as a control process rather than a promise that every interface will look the same.
Checklist by scenario
When creating a new wallet
- Download the wallet from a source you reached through the provider’s verified official channel. Avoid sponsored search results, unsolicited messages, and copied download pages.
- Generate the wallet in a private environment. Do not photograph, email, message, or paste the recovery phrase into a notes app or cloud document.
- Write the recovery phrase on a durable offline medium and store it where other people cannot access it. Do not share it with support staff, marketplace representatives, or anyone claiming to help recover funds.
- Record which wallet belongs to which purpose, but do not record the recovery phrase alongside the wallet address in an exposed digital file.
- Make a small test transaction before moving a valuable NFT. Confirm the destination address and network, then verify that the asset appears in the receiving wallet.
Before buying, minting, or listing an NFT
- Navigate to the project or marketplace through a trusted bookmark rather than a link in a direct message.
- Check the domain carefully. Look for altered spelling, extra words, unusual subdomains, and prompts that ask for a recovery phrase.
- Confirm that the wallet is connected to the intended network. An Ethereum NFT workflow is not interchangeable with a Polygon, Base, or Solana workflow, even when an application supports several networks.
- Read the transaction or signature request. A marketplace listing, a token approval, and a transfer are different actions. If the wallet cannot clearly show what will happen, pause and investigate.
- Review the collection contract and asset details using a trusted marketplace or block explorer. A familiar image or name is not proof that the asset is authentic.
- Keep only the funds needed for the activity in a mint or trading wallet. Do not expose the wallet that stores your most valuable NFTs to unnecessary applications.
Before transferring an NFT
- Copy the recipient address from a trusted source, then compare the first and last characters. For important transfers, verify the complete address through a second channel.
- Confirm the NFT’s network, the receiving wallet’s support for that network, and whether the asset is being transferred directly or through a bridge.
- Check the estimated gas fee and leave enough native network currency for the transaction. Guidance on planning and reducing gas fees for NFT transfers can help with this step.
- Send a low-value test asset first when the address, chain, or wallet integration is unfamiliar.
- Wait for the transaction to appear on a block explorer before treating the transfer as complete. Do not rely only on a wallet notification.
After a suspicious signature or phishing incident
- Stop using the affected wallet for new activity. Disconnect it from websites, but remember that disconnecting alone does not necessarily cancel approvals.
- If the recovery phrase or private key may have been exposed, create a new wallet on a clean device or trusted wallet setup and move remaining assets there. Treat the old wallet as permanently compromised.
- If only an approval may be involved, review and revoke unnecessary token or NFT permissions using a reputable wallet approval revoke tool or the relevant network tools. Revoking an approval does not reverse a completed transfer.
- Prioritize valuable NFTs and liquid balances, while avoiding rushed transactions from the compromised wallet. Check every destination address before signing.
- Save transaction hashes, phishing URLs, screenshots, and timestamps. This record can help you understand what happened and communicate accurately with a marketplace, wallet provider, or relevant platform.
For a more detailed pre-connection review, use the NFT wallet scam checklist.
What to double-check
Recovery material: Your recovery phrase is the key to the wallet, not a password that support can reset. Confirm that backups are readable, complete, and stored separately from devices that may be lost or damaged. Never enter the phrase into a website to “verify” ownership.
Transaction intent: Distinguish between viewing an NFT, connecting a wallet, signing a message, approving a token, listing an asset, and transferring an asset. A request that appears free can still authorize an action, depending on what is being signed.
Approvals: Periodically inspect active permissions, especially after using unfamiliar marketplaces, games, mint pages, or claim sites. Remove permissions that are no longer needed, and use a separate trading wallet when an application requires broad access.
Addresses and identity: Do not assume an ENS name, profile image, or saved address is enough verification. Check the underlying address before sending. Be cautious with messages that use social familiarity, urgency, giveaways, support claims, or requests to move assets immediately.
Wallet compatibility: A crypto wallet for NFT trading may support one network or application better than another. Before using a new wallet app, confirm its support for the NFT standard, chain, marketplace, and hardware signer you intend to use. Comparing options for Ethereum or Base can help identify integration limitations before you move assets; see the guides to Ethereum NFT wallets and Base NFT wallets.
Common mistakes
- Keeping everything in one wallet: Convenience creates a single point of failure. Separate routine activity from long-term custody.
- Confusing a connection with safety: A trusted wallet connection does not validate the website or the transaction it requests.
- Approving without reading: “Free mint” or “claim” language can distract from a permission request. Stop when the request is unclear.
- Reusing a compromised wallet: Moving one NFT out does not make an exposed seed phrase safe. Migrate to a new wallet if the key material may be known.
- Relying on a single backup: A backup that is unreadable, incomplete, or stored in one vulnerable location is not a tested recovery plan.
- Bridging casually: Cross-chain transfers add contract, network, and compatibility considerations. Review the risks before using a bridge, and do not assume an NFT will retain identical functionality on another chain. See cross-chain NFT bridge guidance.
- Sending before testing: Blockchain transfers are difficult or impossible to reverse. A small test can expose a wrong network or address before the main transfer.
When to revisit
Run this checklist before seasonal collecting or minting cycles, before using a new marketplace or wallet integration, and whenever your device, browser, or wallet software changes. Revisit it after a phishing attempt, a suspicious approval, a lost device, or a change in who can access your backups.
At a regular interval that suits your activity, review wallet permissions, confirm that recovery backups remain readable, remove unused browser extensions, update wallet software from verified sources, and check that your wallet labels still match your actual holdings. If you use a hardware wallet, test the recovery process with a separate, controlled wallet rather than experimenting with valuable NFTs.
Before your next transaction, use this short version: right wallet, right website, right network, right address, right asset, right permission, right fee, then sign. If any answer is uncertain, do not approve the request until you can verify it independently. For transfers, also consult the guide on moving NFTs between wallets safely. Security is not a one-time wallet choice; it is a repeatable habit that should change when your tools and workflows change.
