Starter Kit
Twelve things worth doing.
Ordered by effort, not by fear. It opens on what anybody can finish tonight and closes on the parts worth sitting down for. Most people are already doing some of these.
Scan this list against a wallet
SoonRead-only when it opens. We never ask you to connect a wallet, and there is no signature.
Start here
The largest effect for the least explaining. Three cost nothing; one arrives in the post.
01–04 · 4 items
01Move long-term holds off your trading wallet
$1.7B left compromised wallets across 34 incidents in the first half of 2025. What you are not trading should not be reachable from the tab you trade in.
How
Make a second wallet in the app you already use, never connect it to a site, and send it everything you are not actively trading. It costs nothing and takes about ten minutes.
Tools
- Houdini Private SendFixed by
Moves funds to the second wallet without publishing the link between the two.
Holds several accounts in one wallet, so the second address costs nothing to create.
Add a second account inside the wallet you already have. The new address is the one you never connect anywhere.
02Separate your hot wallet from cold storage
The largest single theft of 2024 took $55.5M from one address. A second address helps only until the machine holding its key is the one that gets compromised.
How
Buy a hardware wallet and let it hold the keys for the address above. Keep about a week of trading money in the hot one and nothing else.
03Support never DMs first
Seed-phrase social engineering took $284M in January 2026, about 71% of that month's total crypto theft. Nobody legitimate ever needs your seed phrase.
How
Close the message. Open the project's official site yourself and use the support link you find there.
04Never install a browser extension mid-trade
$1.7B left compromised wallets in H1 2025. A new extension is an unaudited piece of software sitting next to your keys.
How
Install extensions on a day you are not trading, from the official store, and check the publisher name first.
Close the identity gap
What connects the wallet to a person.
05–09 · 5 items
05Stop using one address for everything
332,000 addresses were drained in 2024. One address doing every job is one address a stranger has to find.
How
Run one address per job: one for trading, one for mints, one for receiving from people you know.
Tools
- Houdini Private SendFixed by
Move between your own addresses without publishing that they are both yours.
Self-custody, and holds several accounts in one wallet, so a fresh address per job costs nothing.
06Break the exchange deposit link
181,565 crypto fraud complaints were filed in the US in 2025, reporting over $11B lost. Targeting starts with someone being able to see who you are.
How
Move funds through Houdini instead of withdrawing from the exchange straight into the wallet you trade from.
The tool
- Houdini Private SwapFixed by
Breaks the on-chain link between the exchange withdrawal and the wallet you trade from. The only tool in this category.
07Move between chains without connecting your addresses
Drainers took $83.85M in 2025, down 83% in dollars, while the number of victims barely moved. Every bridge that ties two of your addresses together adds to what strangers can see.
How
Bridge through Houdini rather than a direct bridge that makes you sign from both addresses.
Tools
- Houdini Onchain DEX SwapFixed by
Routes across 100+ chains without joining the two addresses together.
- Houdini No Wallet Connect SwapFixed by
Swaps using only a receiving address. No connection and no signature, which is the point.
08Use a browser that isn't leaking you
Phishing ran 132 separate incidents in H1 2025, more than any other vector. A browser that blocks the fake site never gets you as far as the signature.
How
Use Brave or Firefox with a separate profile just for crypto, and install nothing else into that profile.
Tools
Blocks trackers and known phishing domains without an extension doing it.
Use a separate profile for crypto and nothing else.
The one extension worth the exception. Install it before you start trading, not during.
09VPN on for anything touching funds
181,565 people filed crypto fraud complaints in the US in 2025. Your IP is one more thing that connects a wallet to a person.
How
Turn the VPN on before you open a wallet or an exchange, not after you are already signed in.
Tools
No account, no email, pays by cash if you want. Flat rate.
Audited, no-logs, and takes anonymous signup.
Free tier that is genuinely usable if you are not paying for one yet.
When you're ready
Slower going. One habit to build, and two screens worth sitting down with.
10–12 · 3 items
10Never sign a message you can't read
0.4% of stolen crypto was recovered in Q1 2025, down from 21.2% a year earlier. Every drainer kit ends at a signature, and every one of them fails if you refuse.
How
If your wallet cannot say in plain words what a signature does, reject it and go find out why before you sign anything.
11Turn on signature simulation in your wallet
Phishing ran $410M across 132 incidents in H1 2025. Simulation shows you what a transaction does before you approve it.
How
It is under Settings, then Security, in Solflare, Phantom and Backpack. Turn it on, then read what it tells you before approving.
12Revoke stale token approvals
Drainers took $494M from 332,000 addresses in 2024. A standing approval is what makes it one click.
How
Open revoke.cash, connect nothing, paste your address, sort by oldest, and revoke anything you do not recognise. Do the stablecoins first, because those are the approvals worth the most to whoever holds them.
Tools
Paste an address and see every open approval. Read-only until you choose to revoke one.
Shows connected apps and lets you disconnect them from inside the wallet.
Ground rules
The rest of it, and none of it is scored.
The twelve above each carry a number we can source and a check we can run. These do not, and they are worth doing anyway. A wallet that follows all of this and none of the twelve is still worth scanning, which is exactly why they are kept apart.
- 01
Use a multisig for anything you can't afford to lose
Squads on Solana, Safe on Ethereum. Set the threshold above one signer, or it is a single key wearing a costume.
- 02
Bookmark the sites you use
Arrive from your own bookmark. Not a search result, and not a link someone sent you. The fake site buys the slot above the real one.
- 03
A chart page is not a source
Links on token scanners are submitted by whoever listed the token. Plenty of them lead to a drainer. Read the domain before you connect anything.
- 04
Never scan a QR code you didn't go looking for
A QR code is a link you cannot read before you follow it. Stickers on hardware, codes in a DM, a screen at an event asking you to verify: type the address in yourself instead.
- 05
Seed phrases go on metal
Paper burns, runs and fades. A stamped plate survives the house it was in.
- 06
Split the backup
A Shamir backup breaks the seed into shares, so one share found in a drawer is not your wallet.
How
Trezor calls it Shamir Backup and offers it during setup. Pick a threshold like 2 of 3, then keep the shares in places that would not burn down together.
- 07
Carry a physical security key
On every account that takes one. A code sent by text is the weakest second factor still in service.
- 08
Your phone is not a vault
Keep on it only what you would hand to a stranger, because one day you will hand it to one.
- 09
Money on a bot or a terminal is lent, not held
Count it as gone until it is back under keys you control. Then it is yours again.
- 10
Turn off automatic downloads
A browser that saves files without asking has already done the difficult half of the job for whoever sent it.
How
Chrome and Brave: Settings, then Downloads, then turn on “Ask where to save each file before downloading”. Firefox: Settings, then General, then Downloads, then “Always ask you where to save files”.
- 11
Travel with a travel machine
A second laptop, a small balance, and nothing signed on it you would miss.
- 12
Rebuild the machine now and then
A clean install is the only way to know what is running on it.
- 13
Don't let the boring money sit in one place
One stablecoin, one chain, one contract is a single point of failure. Spreading it is a backup, not a trade.
- 14
Nobody is too careful
Everyone this happens to was sure it would not. Work from the assumption that you are the mark and the twelve above get easier to finish.
The rest of the stack
Not security fixes.
These are here because people ask what we use, not because they do any of the twelve things above. A trading venue on a security list would only make the list mean less.
Where most Solana trading happens. Spot, perps, lending and staking in one place. A trading venue, not a security tool.
- HoudiniFixed by
Swaps across 100+ chains without connecting a wallet or signing. The privacy items above are the reason it is on this site.
Self-custody Solana wallet. Browser extension and mobile, pairs with a hardware device, holds multiple accounts.