Modulis 2 · Security and practice

1/8

Wallet security and your seed phrase

After this module

You'll manage your own keys, spot a scammer's message at a glance, and have a clear plan for any situation. Security in DeFi isn't a natural talent — it's a handful of skills you master once and use for the rest of your life.

Affiliate link

This is an affiliate link. It costs you nothing extra, but the platform pays us a commission. This helps keep the course free.

In DeFi, you are your own bank. That means you hold the keys yourself — with no intermediary who could freeze or seize them. In this lesson you'll master how crypto wallets work and how to protect your assets with simple, repeatable habits.

Custodial vs. non-custodial — who holds your money?

Two ways to hold your money

Picture two options:

A bank holds your money — you just have a card and a password. Lose the card, and the bank issues a new one. But if the bank shuts down, your money gets stuck.
You hold your money in a safe at home — only you have the key. No one can take it. But if you lose the key, no one can help you find it.

In the crypto world, the first option is called custodial, the second — non-custodial.

Custodial (someone else holds it)

When you keep money on an exchange (Nexo, Binance, Kraken), the exchange holds your money. You just have login credentials (email + password).

Advantage: simple. If you forget your password, you can recover it
What to weigh: the exchange controls the keys, so if it collapses, that affects you too — which is why you keep larger amounts in a non-custodial wallet that only you control

Non-custodial (you hold it yourself)

When you use a DeFi wallet (Jupiter Wallet, MetaMask), you hold your own money. No one else has access.

Advantage: full control. No one can seize or freeze it
What to manage: the seed phrase is your only key, so you write it on paper in two copies — that way, even a lost phone or a broken computer can't touch it

Not your keys, not your coins

This is the core rule of crypto. If the keys to your money belong to someone else (an exchange, a friend) — that money isn't truly yours. In 2022, one of the largest exchanges, FTX, collapsed, and customers lost billions. For DeFi strategies, we always use a non-custodial wallet — so that only you control your money.

Jupiter Wallet — the Solana wallet

SOL

Jupiter Wallet (recommended) is the official Jupiter Exchange wallet with built-in currency swapping. It works as a browser extension and a mobile app.

What can a Solana wallet do?

Hold SOL, USDC, USDY, and all Solana tokens
Connect to DeFi protocols: Kamino, Orca, Meteora, Jupiter
Swap currencies directly in the wallet
Show a full history of your transactions

Installing Jupiter Wallet (recommended)

Download Jupiter Wallet

Go to the Chrome Web Store and search for 'Jupiter Wallet'. Or download Jupiter Mobile from the App Store / Google Play.

Use ONLY the official extension from the Chrome Web Store! Fake copies exist.

Create your wallet

You can sign in with Apple ID / email (simplest for beginners) or create a new wallet with a seed phrase.

Write down your seed phrase (if you chose that option)

If you chose the seed phrase option, write the 12 words ON PAPER. Not on your phone, not on your computer. Paper only.

This is the ONLY way to restore your wallet. If you lose these words, your money is lost FOREVER. There's no 'forgot password' button.

Set a password

Create a strong password for everyday use. You'll only need the seed phrase if you have to restore the wallet on a new device.

MetaMask — the Ethereum wallet

ETH

MetaMask is the most popular Ethereum wallet. It supports Ethereum, Arbitrum, and other similar networks.

What can MetaMask do?

Hold ETH, USDC, and all Ethereum tokens
Connect to DeFi protocols: Aave, Uniswap V3
Switch between networks (Ethereum, Arbitrum, and others)
Show your transaction history
Work with hardware wallets (Ledger, Trezor)

Installing MetaMask

Download MetaMask

Go to metamask.io and download the browser extension. Works with Chrome, Firefox, Brave, Edge.

Use ONLY the official site, metamask.io. Fake sites look identical — but will steal your money.

Create a new wallet

Choose 'Create a new wallet'. MetaMask will generate a 12-word seed phrase.

Write down your seed phrase

Write the 12 words ON PAPER. Keep it somewhere safe. Best practice — two copies in two different places.

Add the Arbitrum network

Go to Settings → Networks → Add Network → Arbitrum One. Or simply visit Aave — MetaMask will offer to add it automatically.

Set a password

For everyday use — a strong password. The seed phrase is only for restoring the wallet.

Seed phrase — the 12 words that control everything

Seed phrase — like a secret safe code

Imagine you have a safe holding all your money. The code to that safe is a sequence of 12 random words. Anyone who knows these 12 words can open the safe and take everything. And there's no backup protection — no bank, no police.

That's why you must guard these words better than anything else you own.

Seed phrase (recovery phrase) — a sequence of 12 random English words that is the "master key" to your money.

How does it work?

Your private key (a secret code) is mathematically derived from the 12 words
Your public address is derived from the private key (like an account number — safe to share)
Anyone who has the 12 words can restore your wallet on any device
You don't need Jupiter Wallet or MetaMask specifically — a seed phrase works with any compatible wallet

Seed phrase example

abandon ability able about above absent absorb abstract absurd abuse access accident

This is 12 words from a standardized list of 2048 words. Each word encodes part of your secret code.

NEVER do these things with your seed phrase

Don't photograph it with your phone (photos can sync to the cloud)
Don't store it on your computer or in any app
Don't send it via Telegram, WhatsApp, or any messenger
Don't type it into any website (not "Jupiter support," not "airdrop," not "verification")
Don't tell anyone — not even "official support" (real support NEVER asks for your seed phrase)
Don't store it in Google Drive, Dropbox, iCloud, or any cloud service

How to store your seed phrase safely

Write it on paper

Write the 12 words on paper by hand. Use a pen, not a pencil (pencil marks fade or smudge).

Make 2 copies

Keep them in two separate places. For example: in a home safe + with a trusted family member.

Consider a metal plate

For larger amounts, engrave your seed phrase onto a stainless-steel plate. It protects against fire and water.

Popular products: Cryptosteel, Billfodl, SeedPlate.

Consider an extra passphrase

Think of it as a 13th word. Even if someone found your 12 words, they couldn't reach your money without this extra password.

No one can recover this password for you — write it on paper SEPARATELY from the 12 words. Lose it, and you won't be able to restore the wallet even with all 12 words.

Hardware wallets — maximum security

A hardware wallet — like an extra safe

Imagine that, besides your seed phrase (the master key), you also have a physical device — like a spare key. Even if someone hacked your computer, they couldn't reach your money without this physical device.

For large amounts, a hardware wallet is recommended — a small physical device that stores your keys separately from your computer.

Device	Price	Solana	Ethereum	Works with
Ledger Nano S Plus	~$80	Yes	Yes	Jupiter Wallet, MetaMask
Ledger Nano X	~$150	Yes	Yes	Jupiter Wallet, MetaMask (+ Bluetooth)
Trezor Model T	~$170	Limited	Yes	MetaMask

How it works: the private key is stored in a physical chip. When you want to carry out an operation, you press a button on the device. Even if your computer is infected with a virus, a hacker can't reach the key.

When is it worth using a hardware wallet?

Portfolio over $5,000 — recommended
Portfolio over $20,000 — essential
DeFi strategies with multiple positions — strongly recommended

Jupiter Wallet vs. MetaMask — comparison

What matters	Jupiter Wallet SOL	MetaMask ETH
Main network	Solana	Ethereum + Arbitrum
Transaction cost	Under $0.01	$0.01–$0.30
Speed	Under 1 sec.	2–12 sec.
DeFi protocols	Kamino, Orca, Meteora, Jupiter	Aave, Uniswap
Hardware wallet	Ledger	Ledger, Trezor
Mobile app	Yes (iOS, Android)	Yes (iOS, Android)
Browser extensions	Chrome, Firefox, Brave, Edge	Chrome, Firefox, Brave, Edge
Built-in currency swap	Yes	Yes
In our strategy	Primary (SOL collateral)	Alternative (ETH collateral)

Ethereum transaction costs change with network load — during congestion they can temporarily jump several times over. Before a larger operation, check the current price at etherscan.io/gastracker.

Security rules — what NEVER to do

1. Never share your seed phrase

Even if you get a message from "Jupiter support," "MetaMask support," or "Kamino team." Real projects NEVER ask for your seed phrase. It's 100% a scam.

2. Never sign unclear transactions

When a DeFi site asks you to confirm a transaction — read what you're confirming. If you see "Approve unlimited" or an unfamiliar smart contract — reject it.

3. Use a separate browser for DeFi

Keep a separate browser profile just for DeFi. Don't install random extensions. Don't visit untrusted sites.

4. Check the URL

kamino.finance — correct
kaminoo.finance or kamino-app.com — a scam (phishing — a fraudulent site or link)
Use bookmarks instead of Google search

5. Revoke old approvals

Periodically check and revoke old token approvals (permissions to use your tokens):

Solana: use solscan.io or your wallet's "Manage connections"
Ethereum: use revoke.cash or etherscan.io/tokenapprovalchecker

The most common scam schemes

Fake websites — look identical to the real ones, but steal your seed phrase
Fake airdrops — "You received 1000 USDC, connect and claim it" — it's a trap
Discord/Telegram scams — an "Admin" messages you privately offering "help" — steals your seed phrase
Dangerous approvals — a site asks for access to all your tokens — can empty your wallet
Unknown tokens — appear in your wallet for no reason — never touch them

How to prepare for our strategy

Install Jupiter Wallet + MetaMask

Both browser extensions — Jupiter Wallet for Solana operations, MetaMask for Ethereum/Arbitrum operations.

Write down and safely store your seed phrases

A separate seed phrase for each wallet. 2 paper copies, 2 different places.

Buy a hardware wallet (if your portfolio is over $5k)

Ledger Nano S Plus — the best price-to-quality ratio. Connect it to Jupiter Wallet and MetaMask.

Create a separate DeFi browser profile

A separate Chrome profile just for DeFi. No extra extensions — just Jupiter Wallet and MetaMask.

Save your bookmarks

app.kamino.finance, orca.so, app.aave.com, deribit.com — use ONLY bookmarks, not Google search.

Summary

Non-custodial wallet = you control your own money and are responsible for its security
Jupiter Wallet — the main wallet for the Solana network (Kamino, Orca, Meteora)
MetaMask — the main wallet for the Ethereum/Arbitrum network (Aave, Uniswap)
Seed phrase — 12 words that control everything. Keep it on paper. Never digitally
Hardware wallet — recommended once your portfolio exceeds $5,000
Security depends only on you — there's no "support" team that will recover lost money

Security rules and the most common mistakes

NEVER rules

NEVER — absolute rules

These eight rules are your personal protection. Learn them once, and no scam scheme will ever get close to your money.

NEVER share your seed phrase with anyone — no "employee," no friend, no website
NEVER type your seed phrase into any website (only into the wallet itself when restoring it)
NEVER store your seed phrase on your phone, in email, or in the cloud
NEVER click on unknown tokens that appear in your wallet
NEVER connect to DeFi through links from Discord, Telegram, or email
NEVER confirm a transaction you don't understand
NEVER keep all your assets in one place
NEVER send large amounts without a test transfer

ALWAYS rules

ALWAYS — required actions

ALWAYS check the website URL before logging in
ALWAYS use 2FA (Google Authenticator, NOT SMS)
ALWAYS send a small test amount the first time
ALWAYS check the network (Solana, Ethereum, Arbitrum) before sending
ALWAYS read what the wallet shows before confirming
ALWAYS keep your seed phrase on paper in a safe (2 copies)
ALWAYS have enough SOL/ETH for fees (0.05 SOL, 0.01 ETH)
ALWAYS use a different password for each exchange
ALWAYS disconnect your wallet from sites you no longer use
ALWAYS regularly check "Connected Sites" in your wallet

The 9 most common mistakes — and how to recognize each one

Below are real situations where people lost money. The good news: each one has a clear tell that you'll spot instantly once you've read this lesson. These are teaching examples — your "training ground" for recognizing danger before it reaches you.

1. Handing over your seed phrase to an "employee"

What happens: You get a message on Discord or Telegram: "Hi, I'm a Jupiter support employee. We found a problem. Please provide your seed phrase."

How to recognize it: No real project will EVER ask for your seed phrase. That request alone is 100% proof it's a scammer. See it, and you know what to do: ignore it.

2. Fake website (phishing)

What happens: You search Google for "Orca swap" and click the first result. The URL is 0rca.so (a zero instead of "o"). You connect your wallet and lose everything.

How to recognize a fake website

Check the URL letter by letter!
Use bookmarks for real sites
Official addresses: jup.ag, orca.so, app.kamino.finance, app.aave.com
Google ads can show FAKE sites above the real ones!
Never click links from Discord or Telegram

3. Wrong network when sending

What happens: You send SOL from Binance, but instead of the Solana network you pick a different one.

Result: The SOL is lost. It can sometimes be recovered, but it's very difficult.

Rule: ALWAYS check the network three times before sending.

4. Scam tokens in your wallet

What happens: A new token, "FREE-SOL" or "CLAIM-1000-USDC," appears in your wallet. You click on it — and everything disappears.

Result: You sign a transaction that lets the scammers take all your tokens.

Rule: Ignore ALL unknown tokens. Don't click on them.

5. "Unlimited" approval (token approval)

What happens: You use a DeFi protocol and it asks for permission to use your USDC. You approve an "Unlimited" allowance. Later, the protocol gets hacked.

Result: Hackers can take all your USDC, even if you haven't used that protocol in a long time.

Token approvals — what to know

Only approve the amount you need, NOT "Unlimited"
Regularly check your approvals: revoke.cash (Ethereum), solscan.io (Solana)
Revoke approvals for protocols you no longer use

6. Not enough SOL/ETH for fees

What happens: You swapped ALL your SOL into USDC. Now you can't carry out any transaction — not even sending USDC.

A simple analogy

It's like a car without gas. Even with a truckload of gold, you're not going anywhere without gas. SOL and ETH are the "fuel" for your wallet.

Rule: Always keep 0.05 SOL or 0.01 ETH for fees.

7. SMS instead of Authenticator

What happens: You use SMS as your 2FA. Hackers hijack your phone number with a "SIM swap" attack.

Result: Hackers log in to the exchange and withdraw everything.

Rule: ALWAYS use Google Authenticator or Authy. NEVER SMS.

8. Public Wi-Fi

What happens: At a cafe, you connect to public Wi-Fi and carry out DeFi operations.

Result: Someone can intercept your login credentials.

Rule: Only carry out DeFi operations on a secure network (home Wi-Fi or mobile data).

9. All your assets in one place

What happens: You keep ALL your assets in one wallet. That wallet gets hacked.

Result: 100% lost.

Rule: Use several wallets: a "daily" wallet (small amount) and a "savings" wallet (large amounts).

Security checklist

Check this before you start doing DeFi operations:

Wallet security

Seed phrase written on paper (2 copies)
Seed phrase kept in a safe
Seed phrase is NOT on your phone, computer, or in the cloud
Password is strong and unique
Auto-lock set (5–15 min)
Connected sites reviewed

Exchange security

2FA enabled (Google Authenticator, NOT SMS)
Unique password for each exchange
Email confirmation for withdrawals enabled

Operation security

URL checked
Network checked before sending
Test transfer done (first time)
SOL/ETH balance sufficient for fees

Asset allocation

Not everything in one wallet
Not everything on one exchange

Official URL addresses — save these!

Save these addresses in your browser bookmarks:

Protocol	Official URL
Jupiter	`jup.ag`
Orca	`orca.so`
Meteora	`meteora.ag`
Kamino	`app.kamino.finance`
Aave	`app.aave.com`
Deribit	`deribit.com`
Uniswap	`app.uniswap.org`
Jupiter Wallet	Chrome Web Store
MetaMask	`metamask.io`
Nexo	`nexo.com`

Bookmark strategy

Create a "DeFi" folder in your browser and add all the official sites. Connect to DeFi ONLY through your bookmarks. NEVER through Google, Discord, or email. It's the simplest protection against scammers.

What to do if something goes wrong?

You think your wallet's been hacked

DON'T WAIT — every second counts
Create a new wallet (new 12 words)
Move all your tokens to the new wallet
Revoke all approvals (revoke.cash)
Never use the old wallet again

You lost your seed phrase

If you still have access to the wallet — create a new one and move everything over
If you don't have access — the money is lost forever (there's no "password reset")

You sent to the wrong address

Blockchain transactions are irreversible
If you sent it to an exchange address — contact that exchange's support
If you sent it to a random address — the money is gone

Blockchain = final

Blockchain transactions can't be undone — there's no "Undo" button. That's exactly why one simple habit works so well: before a large transfer, send a small test amount. Once you've confirmed it arrived where it should, you send the rest with confidence.

Hardware wallets — an extra layer of security

For large amounts (over $5,000), we recommend a physical security device:

What is a hardware wallet?

A hardware wallet is a small USB device that stores your keys. Even if your computer is hacked, hackers can't reach your money because the key lives on a physical device. It's like a safe you carry around with you.

Wallet	Price	Networks	Advantage
Ledger Nano S Plus	~$79	Solana, Ethereum	Most popular
Ledger Nano X	~$149	Solana, Ethereum	Bluetooth
Trezor Model T	~$170	Ethereum, Solana (limited)	Open source

Hardware wallet + DeFi

Ledger connects to both Jupiter Wallet and MetaMask. Every transaction must be confirmed by physically pressing a button on the Ledger. This protects you even from viruses on your computer.

Wrap-up

Security in DeFi is your personal responsibility. There's no bank, no insurance. But by following these rules, the risk is manageable. The essentials:

Keep your seed phrase on paper
Check the URL before every login
Use 2FA (Authenticator, not SMS)
Always test before sending large amounts
Never keep everything in one place

Quick check

What's the difference between a custodial and a non-custodial wallet?

Practice task

0 / 5

Run a security audit on your seed phrase

This task is a security audit with no money moved (~15 min). Most losses don't happen because hackers are brilliant — they happen because of a bad backup. Check your weak spots NOW, while they haven't cost you anything.

During this audit, never type your seed phrase anywhere and never show it to anyone. You're only checking where it's stored — the actual text should never end up on any device.

This is learning, not investing — use only small amounts you treat as tuition.

You just completed a full security audit of your own keys and know how to recognize the most common scam schemes — most crypto users never do this.

Cashing out to a bank Spotting crypto scams