Most wallet drains don't begin with a stolen seed phrase. They begin with a signature you clicked months ago and forgot about. The habits that actually protect you are boring and repeatable: revoking old approvals, simulating transactions before signing, and keeping your hot wallet separate from long-term holdings. Together they take about five minutes a week. Skip them and no amount of hardware will save you.
Why approval hygiene beats almost everything else
Token approvals are the quiet leak in most DeFi setups. When you interact with a contract, you often grant it permission to spend a token, sometimes an unlimited amount. That permission persists until you revoke it. If the contract gets exploited or the team turns malicious, your balance can be pulled without a single further click from you.
The $40 lesson
Say you approved an obscure farming contract in 2023 for an unlimited USDC allowance, then moved on. Two years later that contract gets compromised and the attacker sweeps every wallet holding a live approval. You lose $40 because that's all you had in the wallet. A friend who approved the same contract with $12,000 sitting there loses $12,000. Same mistake, wildly different damage.
How to actually do it
Revoke.cash and similar tools let you connect a wallet and see every live approval. Run a check monthly, or at least after trying any new protocol. On Uniswap, approve a specific amount rather than an unlimited one; the extra step caps your worst-case loss. Small friction, real payoff.
Simulation before signing isn't paranoia
Wallet drainers work by making a malicious transaction look routine. The signature request looks like a swap. The payload sends your tokens somewhere else. Simulation tools show what will actually happen: the token leaving your wallet, the destination address, the exact amount.
- Rabby Wallet simulates transactions by default and flags risky approvals.
- Pocket Universe and similar browser extensions intercept signing requests and show a preview.
- Block explorers let you paste a contract address and read what functions it exposes before you touch it.
None of these are foolproof. A simulated "safe" transaction can still be malicious if the simulator is compromised or the contract upgrades. But the bar is low, because most drainers rely on you not looking at all.
Read the address, not the label
Scam sites clone Uniswap's interface pixel for pixel. The URL is the tell. Bookmark app.uniswap.org and always arrive from that bookmark, never from a search result or a DM link. A phishing page can fake the logo, the font, and the swap widget. It cannot fake the domain in your address bar.
Separate your wallets by job
One wallet for everything is how people lose their savings to a single bad click. Treat wallets like tools.
| Wallet type | What lives there | What you do with it |
|---|---|---|
| Hot "burner" | Small trading balance | New protocols, airdrops, anything unvetted |
| Hot "main" | Moderate DeFi positions | Established protocols you've used before |
| Hardware / cold | Long-term holdings | Rarely touched, never connected to dApps |
The burner absorbs the damage. If a new protocol drains it, you lose what you put in and nothing more. Your cold wallet never sees a signature request from a site you found on X.
Seed phrase handling: the habits people skip
Never type it into anything
No legitimate dApp, wallet app, or support agent will ever ask for your seed phrase. Not Uniswap. Not MetaMask. Not anyone. If a "support" DM asks, it's a scam, full stop. Write the phrase on paper or metal, store it offline, and never photograph it. A photo in your camera roll syncs to the cloud.
Verify what you're backing up
Before you move real funds to a new hardware wallet, wipe it and restore from your written seed phrase. If the restored addresses match, your backup works. If they don't, you found out before it mattered. Do this once per device.
Frequently asked questions
Do I need to revoke approvals if I trust the protocol?
Trust is a snapshot, not a guarantee. Teams get acquired, contracts get upgraded, keys get leaked. Revoking an approval you don't need costs a small gas fee and removes a whole class of risk. Keep approvals only for protocols you actively use, and revoke the rest on a schedule.
Is a hardware wallet enough on its own?
No. A hardware wallet protects your private key from being stolen by malware, but it cannot stop you from signing a malicious transaction. You still need to read what you're approving and simulate when possible. The device is one layer, not the whole defense.
What should I do if I think my wallet is compromised?
Move remaining funds to a fresh wallet immediately; don't wait to investigate. Then revoke every approval on the old wallet. If the attacker holds an active approval, they can drain at any time, so speed matters more than understanding what happened in the moment.
Open Revoke.cash right now and check your approvals. Five minutes today beats a very bad morning later.