Wallet Security: Seed Phrase, Phishing and Dangerous Approvals

What a seed phrase is and why it matters more than a password

A seed phrase (mnemonic phrase) is a set of 12 or 24 words from which a wallet mathematically restores all your private keys and addresses. Anyone who knows the phrase gains full control over the funds: they need neither your phone, nor the app password, nor access to your email.

This is why a seed phrase works differently from a website password. A password can be reset through support. A blockchain has no support: a transaction signed with your key is considered the owner’s will, and it cannot be cancelled. This is exactly what makes the seed phrase the main target of scammers.

How to store a seed phrase

The basic principle: the phrase lives offline and in several copies, but not in places with remote access.

• Write the words by hand on paper or stamp them on a metal plate, keeping the order and numbering.
• Keep copies in different physical places, for example at home and in a bank safe deposit box or with a trusted person, so that a fire or a loss does not destroy the only copy.
• Verify the record: restore the wallet on a clean device with a small amount before trusting it with larger funds.
• Do not tell strangers where and how you keep the phrase.

If you use an additional passphrase, keep it separately from the words: losing either of the two elements means losing access.

What never to do with a seed phrase and private keys

The actions listed below most often end in a loss of funds.

• Do not photograph the phrase or take a screenshot: images sync to the cloud and end up in the wrong hands if the account is hacked.
• Do not save the phrase in notes, messengers, email, cloud documents or a password manager without separate protection.
• Do not enter the phrase on websites, in “wallet verification”, “synchronization” or “ownership confirmation” forms.
• Do not send the phrase or a private key to a support chat, even if the other person introduces themselves as a service employee or a wallet developer.
• Do not dictate the words over the phone or show them over video call.

Remember a simple rule: a seed phrase is needed in only one case, when you yourself restore your own wallet in an app or on a hardware device.

A separate note on private keys: they are the same access data in a different form. A “private key” string or a key file requires the same handling as the words of the phrase. By importing a key into someone else’s program, you effectively hand over the wallet to it.

What phishing sites and messages look like

Phishing is an attempt to make you voluntarily give up data or sign a malicious operation. A copy of a site can look almost identical to the original, so you should judge not the design but the address and the context.

• The domain differs by one or two letters, contains extra words, hyphens or an unusual zone.
• The link came from a search ad, a private message, a comment or an email, rather than from a bookmark you saved yourself.
• The page rushes you: “your account will be blocked”, “the giveaway ends in 10 minutes”.
• The site asks you to enter a seed phrase or private key “to restore access”.
• You are offered an exchange “at a special rate” in private messages.

How to recognize unscrupulous services is covered in more detail in the material signs of a fake exchanger.

Address substitution and clipboard hijacking

Clipboard hijacking is malicious software that watches the clipboard. When you copy a wallet address, it quietly replaces it with the attacker’s address. You paste someone else’s address without noticing the difference and send the funds to them.

Protection is built on the habit of checking:

• After pasting, compare the address with the original in full, not just the first and last characters: scammers often pick addresses with a similar beginning and end.
• For large amounts, first send a small test payment and make sure it arrived.
• Use the wallet’s address book for regular recipients and check the address saved there.
• Keep your system and antivirus up to date and do not install programs from dubious sources.

The checking procedure is described in the article how to check a wallet address.

Token approvals: what to look at

On networks with smart contracts (for example, Ethereum, BNB Chain), tokens such as USDT can be sent in two ways: by an ordinary transfer or through an allowance (approve). An approve gives a contract the right to spend your tokens up to a set amount, sometimes with no limit on amount or duration. If you have granted such permission to a malicious contract, it can take the tokens later, without a new request.

Before confirming, check:

• Which contract or site is requesting access, and whether you initiated this action.
• Which token and what amount you are allowing. The wording “unlimited” raises the risk.
• Why the permission is needed at all. A simple transfer to an exchange address does not require an approve.

Periodically review the permissions you have granted in a blockchain explorer or special tools and revoke the ones you do not need. Revoking is also a transaction and requires a network fee.

Message signing and “free giveaways”

A wallet asks you to sign not only transactions but also messages. Signing a message does not by itself spend funds, but some signatures are used as permissions for future operations. Read the text of the request: if you do not understand what you are signing, decline the request.

A separate category of deception is “free giveaways”, invitations to “claim a bonus”, and tokens that suddenly appeared at your address. An attempt to sell such a token or to “claim” a reward on an outside site often leads to a malicious approve. If an unknown token appeared on its own, the safest option is to do nothing with it.

Cold and hot wallets: what the difference is

A hot wallet is constantly connected to the internet: a mobile app, a browser extension, a web wallet. It is convenient for frequent operations but vulnerable to malware and phishing. A cold wallet keeps keys on a device that is not permanently connected to the network: a hardware wallet or offline storage. Signing happens inside the device, and the keys never leave it. On the device screen you see the address and amount of the operation, and these are what you need to check before pressing the button.

• A hot wallet suits small amounts and everyday transfers.
• A cold wallet suits long-term storage of significant amounts.
• Neither type protects against user error: if you confirm a malicious operation on a hardware device, you still lose the funds.

Separating roles is a common practice: a small balance for operations is kept in a hot wallet, and the rest is stored separately.

How to choose a wallet and a device

There is no universal answer, but there are criteria that help compare options.

• Who holds the keys. In a non-custodial wallet the keys are yours and the responsibility is yours; in a custodial one (for example, on an exchange) a company controls the keys.
• Support for the networks you need: check that the wallet works with the coin and network you plan to receive.
• Source of the app. Download a wallet only from the developer’s official website or an official store, checking the name and the developer.
• Project transparency: open source code, regular updates, a clear history.

For the device the wallet is installed on, follow basic hygiene: updates, screen lock, no dubious extensions. Do not use public computers or unverified public networks for large amounts. For exchange sites it is convenient to set up a separate browser profile without extra extensions: a malicious extension can read pages and change addresses.

How to make sure you are on the service’s real website

Checking a site takes less than a minute and removes most of the risk.

1. Open the service from a bookmark or type the address manually, rather than following a link from a message or an ad.
2. Read the domain in the address bar character by character. BITWHITE has a single official domain: bitwhite.net.
3. Make sure the connection is secure, but remember: the padlock icon indicates encryption, not the honesty of the site.
4. Look for contacts only on the service’s own official “Contacts” page.
5. If the service asks for a seed phrase or private key, close the page: no genuine service does this.

What to do if your seed phrase may have reached scammers

If you entered the phrase on a suspicious site or sent it to a stranger, consider the wallet compromised. You need to act quickly.

1. Create a new wallet on a clean device with a new seed phrase.
2. Move the remaining funds to the new address as soon as possible, taking the network fee into account.
3. Revoke the permissions (approve) granted from the old address, if anything is still left on it.
4. Change the passwords of linked accounts and check the device for malware.

Do not trust strangers who offer to recover money for a prepayment: that is the next wave of deception. Funds that have already been taken usually cannot be recovered, so these steps are aimed at protecting what remains. If the amount is significant, it makes sense to contact a lawyer and law enforcement.

Protecting accounts and devices around the wallet

Even perfect storage of the seed phrase will not help if an attacker gains access to the email or phone that services are tied to. A few habits noticeably reduce the risk.

• Use unique long passwords for each service and enable two-factor authentication through an authenticator app, not only through SMS.
• Do not open attachments or links from emails that imitate notifications from an exchange, wallet or exchanger.
• Do not install remote access programs at the request of a “support specialist”: through them the screen can be seen and operations confirmed for you.
• Keep backups separate from the device the wallet is installed on.

If something in the situation seems urgent and demands that you immediately enter data or send funds, stop. Urgency is the main tool of social engineering, and an honest service does not deprive you of time to check.

Common mistakes

• Keeping the phrase in a photo or in phone notes “temporarily”.
• Checking only the beginning and end of the address.
• Confirming an approve without reading the amount and the contract address.
• Going to a service from a link in an ad or a private message.
• Trusting a person who “helps” with the wallet and asks for data for recovery.
• Keeping the entire amount in a hot wallet on the same device where random programs are installed.
• Sending a payment on the wrong network: see what to do if you sent to the wrong network or to a wrong address.

Security checklist before sending funds

• The seed phrase is written on paper or metal, stored offline and has not been photographed.
• The site is opened from a bookmark, the domain is checked character by character.
• The recipient address is checked in full after pasting.
• The correct network is selected, and a memo or destination tag is specified if needed (how it works).
• A test payment has been made for a large amount.
• All signature requests and approvals have been read before confirming.
• The order number and its link are saved; later the transaction can be found by txid (how to use the explorer).

The general procedure for an exchange is covered in the step-by-step guide.

How this relates to exchanging on BITWHITE

An exchange on BITWHITE requires neither a seed phrase nor private keys: the service never asks for them and does not offer exchanges in private messages. The only official domain is bitwhite.net, and the official support channels are listed on the “Contacts” page. No registration is required to create an order.

You specify the receiving address yourself, so check it after pasting. A payment address is issued separately for each order and is valid for up to 2 hours; send the exact amount and on the selected network. Transfers to erroneous details are not refundable, and in automatic mode you also specify the refund address yourself, so it is worth checking too. If you need help, contact only through official channels, giving the order number (BW-…), coin, amount and txid. If you are ready to create an order, open the exchange form at bitwhite.net from a bookmark.