Security

Self-custody explained: wallets, recovery phrases and smart contract risk

CryptoSurge HQ · Updated 18 October 2026 · How we write

Self-custody means holding the keys to your own crypto rather than leaving it with an exchange. It removes the risk of a platform freezing or losing your funds, but it moves all of the responsibility to you. There is no password reset and no fraud team. This guide covers the habits that matter most.

Hot wallets and hardware wallets

A hot wallet is an app on your phone, computer or browser. It is free and convenient for small amounts, but the key sits on a device that is connected to the internet, so malware or a phishing site can reach it.

A hardware wallet is a small device that keeps the key offline and signs transactions inside the device. You confirm each transaction on its own screen. It costs money, but it is the usual choice for larger sums. Buy one only from the manufacturer or an authorised seller, never second-hand, and set it up yourself so that you create the recovery phrase.

Protecting your recovery phrase

The recovery phrase is the master key to the wallet. Treat it as you would the deeds to your house.

Write it down on paper or stamp it into metal. Do not photograph it, type it into a notes app, email it to yourself or store it in cloud storage.
Keep it somewhere safe from fire, flood and casual discovery. Some people keep two copies in separate places.
Never type it into a website, and never share it with anyone, including people claiming to be from a wallet company, an exchange or "support". No genuine service will ask for it.
Think about how someone you trust could recover the funds if something happened to you, without giving them access today.

Sending crypto without losing it

Check the whole address, not just the first and last few characters. Some malware swaps addresses on your clipboard, and some scammers send tiny amounts from look-alike addresses so that a copied address from your history is the wrong one.
Check the network. The same token can exist on several blockchains. Sending on the wrong one can mean the funds are lost.
Send a small test first when using a new address, then send the rest.

Smart contracts and token approvals

On networks such as Ethereum, apps run as smart contracts: programs that hold and move tokens according to their code. To use one, you often sign an approval that lets the contract spend a particular token from your wallet. Some approvals are unlimited and last until you cancel them.

That is how many thefts happen. A fake site asks you to sign what looks like a routine request, and the approval lets the attacker empty the token from your wallet later. To reduce the risk:

Read what your wallet says you are signing. If it asks for permission to spend tokens you did not expect to use, reject it.
Only use apps you reached by typing the address yourself or from a bookmark, not from adverts, direct messages or search results you have not checked.
Review and revoke old approvals from time to time. Many wallets and block explorers show your active approvals.
Keep a separate wallet with a small balance for trying new apps, and keep savings in a wallet that never connects to them.

Smart contracts can fail on their own

Even an honest app can have a bug. Audits help, but they do not guarantee a contract is safe, and projects can change their code or be abandoned. Money held in a smart contract carries this risk on top of price risk.

A short checklist

Recovery phrase written down offline, stored safely, never shared.
Hardware wallet for anything you could not afford to lose, bought new from the maker.
Device software and wallet apps kept up to date.
Strong, unique passwords and two-factor authentication on exchange accounts.
Full address and network checked before every transfer.
Old token approvals reviewed and revoked.

Sources and further reading

Not financial advice. This article is for general information and education only. It is not financial advice or a recommendation to buy, sell or hold any cryptoasset. Cryptoassets are high risk and largely unregulated in the UK: you could lose all the money you put in, and you are unlikely to be protected by the Financial Ombudsman Service or the FSCS.