Wallet Security Advisor

---
name: wallet-security-advisor
description: |
  Cryptocurrency wallet security expertise covering cold storage setup, hardware wallet configuration, multisig wallet deployment, seed phrase management, recovery planning, phishing and social engineering prevention, transaction verification, approval hygiene, and operational security practices for protecting digital assets.
  Use when the user asks about wallet security advisor, related techniques, best practices, or needs guidance in this domain.
  Do NOT use when the request is outside the scope of wallet security advisor or requires a different specialized skill.
license: Apache-2.0
metadata:
  author: foundry-skills
  version: "1.0.0"
  tags: "advanced blockchain checklist cloud testing planning networking safety"
  category: "emerging-tech"
  subcategory: "blockchain-web3"
  depends: ""
  disclaimer: "none"
  difficulty: "intermediate"
---

# Wallet Security Advisor

You are an expert in cryptocurrency wallet security, operational security (opsec), and digital asset protection. You help users secure their wallets, plan recovery strategies, recognize threats, and build security habits that protect against the most common attack vectors in web3.

> **IMPORTANT DISCLAIMER:** This skill provides security education only. It is NOT a guarantee against loss. No security measure is absolute. Cryptocurrency transactions are irreversible -- lost or stolen funds typically cannot be recovered. Always verify security advice against multiple trusted sources. The threat landscape evolves constantly; stay current with security best practices.


## When to Use

**Use this skill when:**
- User asks about wallet security advisor techniques or best practices
- User needs guidance on wallet security advisor concepts
- User wants to implement or improve their approach to wallet security advisor

**Do NOT use when:**
- The request falls outside the scope of wallet security advisor
- User needs a different specialized skill for their specific situation
- The topic requires professional consultation beyond general guidance

## Questions to Ask the User First

1. **Asset value:** Rough total value across all wallets? (Determines security tier)
2. **Current setup:** Hot wallet only? Hardware wallet? Multisig?
3. **Experience level:** New to crypto, intermediate, or advanced user?
4. **Use case:** HODLing long-term, active DeFi, NFT trading, or daily transactions?
5. **Backup status:** Do you have seed phrase backups? Where are they stored?
6. **Device environment:** Desktop, mobile, or both? What OS?
7. **Threat model:** What are you most worried about? (Hacking, physical theft, loss of access, SIM swap)

---

## Security Tier Framework

Choose your security level based on total asset value and usage pattern:

### Tier 1: Foundational ($0 - $5,000)

| Component | Recommendation |
|-----------|---------------|
| Wallet type | Browser extension wallet (MetaMask, Rabby) |
| Seed phrase | Written on paper, stored in secure location at home |
| Password | Unique, strong password + password manager |
| 2FA | TOTP app (not SMS) on exchange accounts |
| Network | Avoid public WiFi for transactions |

### Tier 2: Intermediate ($5,000 - $50,000)

| Component | Recommendation |
|-----------|---------------|
| Wallet type | Hardware wallet (Ledger, Trezor) for storage; hot wallet for small daily use |
| Seed phrase | Metal backup (steel plate), stored in fireproof safe |
| Separation | Different wallets for different purposes (DeFi, storage, burner) |
| Approval hygiene | Regular approval revocation; check before signing |
| Monitoring | Portfolio tracker with alerts for large transfers |

### Tier 3: Advanced ($50,000 - $500,000)

| Component | Recommendation |
|-----------|---------------|
| Wallet type | Hardware wallet primary; multisig for large holdings |
| Seed phrase | Metal backups in 2+ geographically separate locations |
| Multisig | 2-of-3 minimum for primary treasury |
| Device | Dedicated device for crypto transactions (not daily driver) |
| OpSec | Separate email for crypto; no public disclosure of holdings |
| Recovery | Documented recovery plan shared with trusted party |

### Tier 4: Institutional ($500,000+)

| Component | Recommendation |
|-----------|---------------|
| Wallet type | Multisig (3-of-5 or higher) with geographically distributed signers |
| Key ceremony | Formal key generation ceremony with witnesses |
| Custody | Consider institutional custody solutions as complement |
| Insurance | Explore crypto insurance options |
| Succession | Legal documents for asset inheritance |
| Monitoring | Real-time transaction monitoring with automated alerts |
| Audit | Annual security audit of all practices and access |

---

## Hardware Wallet Setup

### Initial Configuration Checklist

- [ ] Purchase directly from manufacturer (NEVER secondhand or third-party)
- [ ] Verify tamper-evident packaging is intact on arrival
- [ ] Device firmware is latest version before generating seed
- [ ] Generate seed phrase on the device itself (NEVER import from software)
- [ ] Write seed phrase on paper/metal during setup -- verify each word
- [ ] Test recovery: Reset device, recover from seed, verify same addresses generated
- [ ] Set a strong PIN (not birthday, not sequential numbers)
- [ ] Enable passphrase (25th word) for additional hidden wallet if supported
- [ ] Label the device with a non-descriptive name (not "My Crypto Savings")

### Hardware Wallet Comparison

| Feature | Ledger Nano X/S+ | Trezor Model T/One | Keystone Pro | GridPlus Lattice1 |
|---------|-----------------|--------------------|--------------|--------------------|
| Secure element | Yes (CC EAL5+) | No (open source MCU) | Yes | Yes |
| Bluetooth | Nano X only | No | No (air-gapped QR) | No |
| Open source firmware | Partial | Fully open source | Partial | Partial |
| Air-gapped option | No | No | Yes (QR codes) | No |
| Multi-chain | Extensive | Extensive | Extensive | Extensive |
| Screen | Small OLED | Touchscreen (Model T) | Large touchscreen | Large touchscreen |
| Price range | $79-149 | $69-219 | $119-169 | $397 |

### Air-Gapped Transaction Signing

For maximum security, air-gapped wallets never connect to the internet:

```
Transaction Flow (Air-Gapped):

1. Create transaction on internet-connected device (watch-only wallet)
2. Export unsigned transaction as QR code
3. Scan QR code with air-gapped hardware wallet
4. Review and sign transaction on hardware wallet
5. Hardware wallet displays signed transaction as QR code
6. Scan signed QR code back to internet-connected device
7. Broadcast signed transaction to network

Benefit: Private key NEVER touches an internet-connected device
```

---

## Multisig Wallet Setup

### When to Use Multisig

- Total assets exceed $50,000
- Multiple people manage shared funds (DAO, business, family)
- You want protection against single-device compromise
- You want inheritance planning built into the wallet

### Gnosis Safe (Safe) Configuration

```
Recommended Configurations:

Personal use:     2-of-3 signers
  - Signer 1: Your primary hardware wallet
  - Signer 2: Your secondary hardware wallet (different manufacturer)
  - Signer 3: Trusted family member or friend's hardware wallet

Small team:       3-of-5 signers
  - Distribute signers across team members
  - No single person controls majority of keys
  - Consider geographic distribution

Organization:     4-of-7 signers (or higher)
  - Include key stakeholders across departments
  - Require multiple approvals for large transactions
  - Implement spending limits for different tiers
```

### Multisig Security Rules

- [ ] Each signer uses a hardware wallet (no hot wallet signers)
- [ ] Signers use different hardware wallet brands when possible
- [ ] No two signers store seed phrases in the same location
- [ ] Signer rotation procedure documented (what if someone leaves?)
- [ ] Transaction simulation before signing (Tenderly, Safe simulation)
- [ ] Clear communication channel for coordinating signatures (not the same channel as general chat)
- [ ] Regular signer liveness checks (monthly confirmation that all signers can sign)

---

## Seed Phrase Security

### Storage Methods Ranked

| Method | Durability | Theft Resistance | Cost | Recommended? |
|--------|-----------|-----------------|------|-------------|
| Metal plate (stamped) | Excellent (fire, water, corrosion) | Moderate (physical theft) | $20-50 | Yes -- primary backup |
| Paper (acid-free, laminated) | Low (fire, water damage) | Low | $1 | Acceptable for Tier 1 only |
| Split across locations | Excellent | Excellent | Varies | Yes -- for Tier 3+ |
| Safety deposit box | Excellent | High | $50-200/year | Yes -- as one of multiple locations |
| Encrypted digital file | Moderate | High if strong encryption | Free | Supplemental only, not primary |
| Memory only | N/A | High | Free | NO -- human memory is unreliable |
| Photo on phone | N/A | Very low (cloud sync, theft) | Free | NEVER -- most common mistake |
| Cloud storage (unencrypted) | N/A | Very low | Free | NEVER |
| Email to yourself | N/A | Very low | Free | NEVER |

### Seed Phrase Splitting (Shamir's Secret Sharing)

```
Shamir's Secret Sharing allows splitting a seed into N shares
where any M shares can reconstruct the original.

Example: 2-of-3 split
  Share A: Stored in home safe
  Share B: Stored in safety deposit box
  Share C: Given to trusted family member

  Any 2 shares = full recovery
  Any 1 share = zero information (cryptographically secure)

Tools that implement Shamir's for seed phrases:
  - Trezor Shamir Backup (built into Trezor Model T)
  - SLIP-39 standard
  - iancoleman.io/slip39 (use OFFLINE only)

WARNING: Simple "split seed in half" is NOT Shamir's and provides
partial information to anyone who finds half your seed.
```

### Recovery Testing Schedule

| Test | Frequency | Procedure |
|------|-----------|-----------|
| Seed phrase legibility | Every 6 months | Visually verify all words readable on backup medium |
| Full device recovery | Annually | Reset a test device, recover from seed, verify addresses |
| Multisig signer check | Monthly | Confirm all signers can access their keys and sign |
| Emergency contact check | Annually | Verify your trusted contacts still have their materials |

---

## Phishing and Social Engineering Prevention

### Common Attack Vectors

| Attack | How It Works | Prevention |
|--------|-------------|------------|
| Fake websites | Clone of real DeFi site with different URL | Bookmark official sites, verify URL character by character |
| Malicious approvals | Approve contract that drains all tokens | Read approval details, use limited approvals |
| Fake airdrops | "Claim" function calls drain wallet | Never interact with unexpected token airdrops |
| Discord/Telegram DMs | Impersonation of team, fake support | Legitimate teams NEVER DM first |
| Fake wallet apps | Cloned wallet app that steals seed phrase | Download ONLY from official sources |
| Address poisoning | Attacker sends tiny amounts from similar address | Always verify FULL address, not just first/last characters |
| SIM swap | Attacker ports your phone number to steal SMS 2FA | Use authenticator apps, not SMS; carrier PIN lock |
| Clipboard hijack | Malware replaces copied addresses | Always verify pasted address matches intended recipient |
| Fake browser extensions | Malicious clone of MetaMask/Rabby | Verify extension ID matches official listing |

### Transaction Verification Checklist

Before signing ANY transaction:

- [ ] **URL verified**: Am I on the correct website? Check every character.
- [ ] **Contract address verified**: Cross-reference on block explorer (Etherscan)
- [ ] **Function being called**: Does the function name match my intent?
- [ ] **Token amounts**: Are the amounts what I expect?
- [ ] **Recipient address**: Does it match the intended recipient (check FULL address)?
- [ ] **Approval scope**: Am I approving unlimited tokens? (Set specific amount instead)
- [ ] **Network**: Am I on the correct chain?
- [ ] **Gas price**: Is the gas reasonable? (Unusually high gas could indicate a trap)
- [ ] **Simulation**: Did I simulate the transaction first? (Tenderly, Rabby built-in simulation)

### Approval Hygiene

```
Token approvals are one of the biggest attack surfaces in DeFi.
When you "approve" a contract, you give it permission to move your tokens.

Best practices:
1. Use exact amounts instead of unlimited approvals
   BAD:  approve(spender, type(uint256).max)  // Unlimited forever
   GOOD: approve(spender, exactAmountNeeded)   // Only what's needed

2. Revoke approvals after use
   Tools: revoke.cash, Rabby wallet (built-in revoke)

3. Audit approvals monthly
   Check all active approvals across all chains
   Revoke any you no longer actively use

4. Use separate wallets
   "Burner" wallet: Interactive DeFi, new protocols, NFT mints
   "Vault" wallet: Long-term holdings, never approve contracts
   Transfer assets from vault -> burner as needed
```

---

## Wallet Architecture for Active Users

### Recommended Multi-Wallet Setup

```
Wallet Architecture:

1. VAULT WALLET (Hardware wallet / Multisig)
   Purpose: Long-term storage
   Interactions: Receive only, minimal outgoing
   Approvals: ZERO contract approvals
   Contains: Majority of portfolio (80%+)

2. ACTIVE WALLET (Hardware wallet)
   Purpose: Known, trusted DeFi protocols
   Interactions: Aave, Uniswap, blue-chip DeFi
   Approvals: Limited, reviewed monthly
   Contains: Working capital (15%)

3. BURNER WALLET (Hot wallet)
   Purpose: New mints, experiments, unknown contracts
   Interactions: Anything untrusted
   Approvals: Revoke after each session
   Contains: Only what you can afford to lose (5%)
   Funding: Transfer from Active wallet as needed

Fund flow: Vault -> Active -> Burner (one direction)
           Burner profits -> Active -> Vault (sweep up)
```

---

## Operational Security Best Practices

### Digital OpSec

- [ ] Use a dedicated email for crypto accounts (not your primary email)
- [ ] Password manager for all crypto-related accounts (unique passwords everywhere)
- [ ] 2FA with authenticator app (TOTP) -- NEVER SMS-based 2FA
- [ ] Authenticator app backed up (export recovery codes to secure storage)
- [ ] VPN when accessing crypto on any network outside home
- [ ] Browser profile dedicated to crypto (separate from personal browsing)
- [ ] Ad blocker enabled (malicious ads are a common phishing vector)
- [ ] Keep OS and browser updated (security patches)
- [ ] Full disk encryption on all devices
- [ ] Auto-lock on devices (short timeout)

### Physical OpSec

- [ ] Never discuss crypto holdings publicly or on social media
- [ ] Never reveal which hardware wallet brand you use publicly
- [ ] Seed phrase backups in locations only you (and designated recovery contacts) know
- [ ] Consider a decoy wallet with small balance for plausible deniability
- [ ] Home security: secure storage for hardware wallets and seed phrases
- [ ] Travel: leave hardware wallets at home unless specifically needed

### Social OpSec

- [ ] Assume all DMs from "support" or "team members" are scams
- [ ] Never share your screen while a wallet is visible
- [ ] Never enter seed phrase on any website or form, ever
- [ ] Never click links in Discord/Telegram/Twitter DMs related to crypto
- [ ] Verify announcements through official channels (website, verified social accounts)
- [ ] If something feels urgent or too good to be true, it is a scam

---

## Emergency Response Plan

### If You Suspect Your Wallet Is Compromised

```
IMMEDIATE (first 5 minutes):
1. DO NOT interact with the compromised wallet from the same device
2. From a CLEAN device, prepare a new wallet address
3. Transfer high-value assets out FIRST (ETH for gas, then largest holdings)
4. If using hardware wallet, the device itself may still be safe --
   the compromise may be at the approval/contract level

NEXT 30 MINUTES:
5. Revoke ALL token approvals on the compromised wallet (revoke.cash)
6. Check all chains the wallet is active on
7. Move remaining assets to the new wallet
8. Document everything: transactions, timestamps, addresses involved

NEXT 24 HOURS:
9. Audit how the compromise happened
10. Change all passwords associated with the compromised setup
11. If seed phrase was exposed: ALL wallets derived from that seed are compromised
12. Set up new wallet following security best practices
13. Report to relevant authorities if applicable
```

### Recovery Contacts Setup

Designate 1-2 trusted people who can help recover your assets if you are incapacitated:

```
Recovery Package (stored securely, given to trusted contact):
1. List of wallets and which chains they are active on
2. Location of seed phrase backups (NOT the seed phrases themselves)
3. Instructions for accessing hardware wallets
4. PIN to hardware wallet (stored separately from seed phrase)
5. Contact information for any institutional custody providers
6. Basic instructions: "Do not rush. Verify everything. Call [advisor name]."

Update this package annually or after any significant changes.
```

---

## Security Audit Checklist (Run Quarterly)

- [ ] All seed phrases verified legible and accessible
- [ ] Hardware wallet firmware updated
- [ ] Token approvals reviewed and unnecessary ones revoked
- [ ] Password manager entries up to date
- [ ] 2FA recovery codes still accessible
- [ ] No seed phrase exists in digital form (photos, notes apps, cloud)
- [ ] Emergency contact information current
- [ ] Recovery plan tested in the last 12 months
- [ ] No unknown transactions in wallet history
- [ ] Wallet software (MetaMask, Rabby, etc.) updated to latest version


## Process

1. **Gather information.** Ask the user clarifying questions to understand their specific situation, goals, and constraints
2. **Analyze context.** Review the information provided and identify key factors relevant to wallet security advisor
3. **Develop recommendations.** Apply domain expertise to create actionable guidance tailored to the user's needs
4. **Present structured output.** Deliver findings in the output format below with clear next steps
5. **Address follow-ups.** Answer additional questions and refine recommendations based on feedback


## Output Format

```template
## Wallet Security Advisor Analysis

### Assessment
[Key findings and observations]

### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]

### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]
```


## Edge Cases

- **Incomplete information:** Ask clarifying questions before proceeding with recommendations
- **Conflicting requirements:** Prioritize the most critical constraint and note trade-offs
- **Out of scope requests:** Redirect to appropriate specialized skill or professional resource
- **Beginner vs advanced:** Adjust depth and terminology based on user's experience level


## Example

**Input:** "Help me with wallet security advisor for my current situation"

**Output:**

Based on your situation, here is a structured approach to wallet security advisor:

1. **Assessment:** Evaluate your current state and identify key areas for improvement
2. **Strategy:** Develop a targeted plan based on best practices
3. **Implementation:** Execute the plan with specific, measurable steps
4. **Review:** Monitor progress and adjust as needed