Crypto Security Checklists — Wallet Setup, Token Checks, Incident Response

Wallet setup checklist

Three wallets by purpose — vault (never touches contracts), trading, burner
Hardware wallet for the vault, bought direct from the manufacturer
Device initialised by you, seed generated on the device
Seed phrase written physically, never photographed or stored in cloud/notes/email
Backup stored in a location appropriate to the amount
Restore tested once with a small amount, before it matters
Receiving addresses confirmed on the device screen, not just in the interface
Separate seeds for separate purposes — never restore a vault seed onto a hot device

Pre-trade token check

Roughly ten minutes. Full routine: how to verify a smart contract.

Contract address obtained from a project-controlled source — not a search result, ad, or message
Correct chain confirmed
Source code verified on a public explorer
It is the token contract — not a pool, proxy admin, or treasury wallet
Name, symbol, decimals match the project's documentation
Privileged functions enumerated: mint, pause, blacklist, fee, upgrade
Controllers identified — single key, multisig, or timelock
No asymmetric or owner-mutable sell fee (the honeypot pattern)
Ownership status understood, including roles beyond Ownable
Holder concentration acceptable
Claimed liquidity locks confirmed on-chain, with a meaningful expiry
Bid-side depth measured — could you actually sell, and at what price?

Account hardening checklist

Passkey registered (cannot be phished), with TOTP retained as fallback
Recovery codes stored offline, not on the authenticator device
2FA tested by logging out and back in once
Email secured at least as well as the exchange — it can reset most other accounts
Withdrawal addresses added in advance, so the cooldown does not block you in a hurry
API keys scoped minimally — read unless trade or withdraw is genuinely required
Unused API keys revoked
Trusted devices reviewed; anything sold, lent, or lost revoked
Carrier port-out PIN set if any account still uses SMS recovery

Periodic review

Every few months, or after anything unusual:

Revoke token approvals no longer needed
Confirm seed backups are present and legible
Review exchange trusted devices and active sessions
Review API keys — revoke unused, confirm scopes still minimal
Confirm recovery codes are where you can reach them
Verify saved withdrawal addresses are still ones you recognise

Incident response order

Order matters. Secure funds before investigating.

Move funds — from a clean device, to a wallet whose seed has never touched the suspect machine
Revoke approvals on the affected wallet
Assume the seed is burned if it may have been exposed; generate a new wallet, do not reuse
Secure surrounding accounts — email first, then exchange: password, sessions, trusted devices, API keys, withdrawal allowlist
Capture evidence — URLs as text, addresses, transaction hashes, screenshots, timestamps
Report — to the impersonated organisation via published channels, the hosting platform, and your jurisdiction's authority
Ignore recovery offers. Anyone approaching you afterwards is running a second fraud

The two-question fraud filter

Before acting on anything that reaches you:

Did I initiate this? If the contact was inbound, treat it as hostile regardless of how legitimate it appears.
Am I verifying the identifier or the label? Contract addresses, not token names. Full destination addresses, not the first four characters.

Neither question requires judging whether something looks legitimate — which is fortunate, since that judgement is precisely what attackers work to defeat.

Things that are not safety signals

"Audited" with no auditor named
"Ownership renounced" without checking surviving roles
A large community — that is marketing output
A rising price — during a honeypot, rising is expected
A verified badge on a social account — purchasable, and impersonation is routine
High 24-hour volume — backward-looking, and manufacturable

What CoinDock will never do

Ask for your seed phrase or private keys
Contact you first requesting a payment, approval, or credential
Send an invoice as an address in a message
Guarantee a price, return, or performance outcome

Guides

Concepts

How-to

Reference

Security Glossary

Security Resources — Checklists and Routines