Secure Crypto Wallets
Cold storage for size. Cautious hot tools for movement. Clear risk patterns and a drill you can actually run before the market gets loud.
// Overview
Sovereignty begins with keys you control. Store size in offline hardware (cold), and treat hot wallets like a jacket pocket — handy, never where you keep everything. Keep seed phrases off cameras and keyboards. Practice recovery while calm, not during a liquidation candle.
// Quick compare
🛡️ Hardware (Sovereign tier)
Trezor Safe 7 — Next-gen Trezor with upgraded secure element, color touchscreen, and hardened
cold-storage for long-term stacks.
Explore Trezor Safe 7 →
Foundation Passport — Air-gapped, QR-based Bitcoin wallet (no USB), built for minimal attack
surface and clear signing flows.
Explore Passport →
- Generate and record seed phrases fully offline. Never photograph or store them in cloud notes.
🧱 Mobile & Desktop (Cautious tier)
- Xverse — Stacks & Ordinals support.
- Phantom — Solana-focused, clean UI.
- Exodus — User-friendly desktop app (not cold storage).
Treat hot wallets as expendable. Size belongs in cold storage.
⚠️ Use with caution (risk patterns)
- Browser extensions: larger phishing surface and permission spoofing. Prefer hardware signing flows.
- Seed-in-UI flows: any wallet or site that asks you to type a seed phrase — do not proceed.
- Account-tied wallets: logins via email/phone can add custodial or telemetry risk; avoid for size.
- Closed-source or unclear audits: if the code/audits aren’t transparent, don’t store meaningful funds.
⚔️ Protection tips
- Write seeds by hand on paper/steel; keep off cameras and keyboards.
- Use a passphrase (25th word) and consider a small decoy account.
- Label devices and accounts with neutral names.
- Verify downloads from the vendor; check signatures when available.
- Test a restore with a tiny amount before moving size.
🛡️ Device security (Malware & phishing)
Your wallet is only as safe as the device you unlock it on. If malware can read your clipboard, inject fake addresses, or log keystrokes, cold-storage discipline won’t save a hot-wallet session.
I treat endpoint protection as part of my crypto hygiene: browser extensions, wallet apps, and random downloads all funnel through the same machine. A clean system is non-negotiable.
If you don’t already have endpoint protection, you can start with a trial here:
Note: this is an affiliate link — if you decide to upgrade, I may earn a commission at no extra cost to you. I only recommend tools that fit my own security stack.
🧭 10-minute recovery drill
- Use a spare device or fresh OS profile.
- Download the wallet directly from the vendor link.
- Go offline; verify checksum/signature if provided.
- Restore from written seed + passphrase.
- Confirm a receive address matches one you saved earlier.
- Sign a dummy message; verify the signature.
- Send a tiny outbound to self; confirm arrival.
- Note any steps you fumbled; update your doc.
- Store the spare device powered down, labeled neutrally.
- Repeat quarterly (calendar reminder).
// Links
Note: Some outbound links (e.g., Trezor Safe 7) may be affiliate links — we may earn a commission at no extra cost to you.
