How to keep a crypto wallet safe

The coins are controlled by the recovery phrase, also called a seed phrase. It is usually 12 or 24 words. Anyone who has those words can move the tokens. A password on the phone is not a second copy of the phrase. ZyCrypto never sees the phrase, and it cannot reset one you lost.

This is lesson 2 of the DeFi swap lessons. Read it before you connect a wallet to a new DeFi site. It is not investment advice. You can lose the full amount in the wallet you connect.

The lesson series

1. Start here
2. What a decentralized swap is
3. How to keep a wallet safe (this page)
4. How to check a token contract
5. The fee and the price move
6. The seven chains
7. Your first swap

What actually protects the wallet

• The phrase stays offline. Write it on paper. Keep two copies in two places you control. A photo, a screenshot, a cloud note, an email, and a chat are copies someone else can reach.
• You install the wallet yourself. Open the vendor's site by typing it, or use the official store page you searched for. A link in a message is how a fake wallet gets installed.
• The phone and the wallet app lock. Use the wallet's own passcode or biometrics. A locked phone is not enough if the wallet app opens straight onto the funds.
• Savings and experiments are different wallets. The wallet you connect to a new project should hold only what you can lose. The savings wallet does not visit new sites.

A hardware wallet is the stronger place for savings. You confirm the transaction on the device. The experiment wallet can stay a normal phone wallet. A new DeFi project is an experiment until you have checked it.

Some wallets add an extra passphrase on top of the 12 or 24 words. If you turn that on, it is part of the backup. Lose it and the coins stay locked. Leave it off until you know how that wallet stores it.

Connecting is not sending

On zyai.org you connect a wallet you already control. Connecting shares the address so the desk can show a balance and a quote. It does not hand ZyCrypto the phrase, the keys, or the tokens.

Tokens move when you sign. Until you approve the quote in the wallet, nothing leaves. Bought tokens come back to that same wallet. A failed deposit comes back there too. ZyCrypto cannot send them to an address you did not connect, and it cannot undo a signature you already gave.

Disconnect on the desk clears the connection in this browser. It does not cancel a token approval you signed earlier. An approval can still be used until you revoke it from inside the wallet.

What to read before you sign

The wallet popup is the check. Match it to the quote on the page.

1. The site is zyai.org, the domain you typed or bookmarked. A padlock on a different domain is still a different site.
2. The chain is the one you selected.
3. The token and the amount are the ones you chose. The contract lesson shows how to read the address.
4. The wallet is not asking for the recovery phrase.
5. You can explain the signature in one sentence. If you cannot, reject it.

The first time you use a wallet, or the first time you use a site, use a small amount. A successful tiny swap teaches the path. It does not make the next signature safe. Read that one too.

An approval, permit, or "unlimited" allowance lets another contract move that token later, up to the amount you allowed. The swap you want is a trade of the amount on the quote. An unlimited approval of a token you hold is a separate decision. If the popup is not the trade you came to make, reject it.

To remove an old approval, use the list inside the wallet you already trust, or a revoke page whose address you typed yourself. A revoke link that arrived in a chat is another ask for a signature.

What not to trust

New projects arrive with a lot of noise. These are the parts that do not protect you.

• The ticker, the logo, and the follower count. All three are copied. The contract and the domain are the checks. The next lesson is the contract.
• A countdown, a "claim", or an airdrop. A timer is there to stop you reading. A token that appeared in the wallet by itself is not a prize. Do not visit the site printed on it.
• Restore, sync, validate, or rectify. No swap needs those words. They are how a page asks for the phrase.
• Support in a chat. A person, a bot, or an account named ZyCrypto that asks for the phrase, a screenshot of it, or a remote-control app is fake. Email to contact@zyai.org will not ask for the phrase either.
• The padlock, a VPN, or a long Terms page. None of those makes a lookalike domain real. None of them makes a bad signature safe.
• "Audited", "official", or "risk free" on a project site. Those are sentences. They are not the phrase, and they are not the quote.
• A QR code or a link from a stranger. Open the swap from a bookmark. On a phone, use the wallet chooser on zyai.org and finish inside that wallet's browser. Then look at the domain again.
• The newest address in your history. A stranger can send a transfer from an address that looks like yours. Copy a recipient from your own saved address. On ZyCrypto the bought tokens return to the connected wallet. You do not type a destination.
• Points, a bonus, or a fee that only appears after you sign somewhere else. ZyCrypto shows the 1.50% fee on the quote before you sign. Points are a label on a filled swap. They are not cash, and they are not a reason to sign a popup from another site.

If a page asks for the 12 or 24 words, close it. A real wallet asks for the phrase only inside the wallet app, when you are restoring a backup you already made.

If the phrase may already be exposed

1. Stop signing. Do not "test" the old phrase on a helper site.
2. Install the wallet again from the source you typed yourself, and create a new phrase.
3. Write the new phrase on paper. Do not photograph it.
4. From the old wallet, while you still control it, send the remaining tokens to the new wallet. Start with a small test. Then move the rest.
5. Treat the old phrase as burned for savings. Do not keep using it because the app still opens.

If you no longer control the old wallet, those tokens are not recoverable here. ZyCrypto does not hold them and cannot reverse the transfer. A message that says it can, for a fee paid in advance, is a second theft.

A short setup

1. Install the wallet from the vendor you typed.
2. Write the phrase on paper. Check the words once. Put the paper away.
3. Create a second wallet, or a second account in that app, for new sites. Fund it only with what you can lose.
4. Bookmark https://zyai.org/.
5. Read the policy on the swap. Accept it only if it is true for you. That acceptance is stored in the browser. It is not a backup of the wallet.
6. Connect the experiment wallet. Read the quote. Sign only that quote.

The fee on a live swap is 1.50% of what you sell. The gear that says 0.50% is the price move, not the fee. Both are explained in the fee lesson. The product page is ZyCrypto.

Questions

Does ZyCrypto ask for my recovery phrase? No. The swap asks you to connect a wallet and sign a quote. A page, email, or chat that asks for the 12 or 24 words is not ZyCrypto.

Does connecting a wallet send my coins? No. Connecting shares the address so the desk can show a balance and a quote. Coins move only when you approve that quote in the wallet.

What should I ignore? Ignore the ticker, the logo, a countdown, a token that appeared by itself, and anyone who tells you to restore, sync, or validate the wallet.

What if I already typed the phrase into a website? Treat that wallet as exposed. Create a new wallet with a new phrase and move the remaining tokens there yourself. Do not type the old phrase into a second site that offers to help.