Wallets – hot vs cold, multisig, operational security

Introduction

In crypto there is no complaints department. If you sign a malicious transaction, send funds to the wrong chain or expose your seed, the transaction is irreversible. Most losses do not come from “Hollywood hackers” but from basic operational errors: phishing, unlimited approvals, one wallet for everything.

This lesson is the operational security (OPSEC) standard for a DeFi trader. You will learn to tell wallets apart, design a 3-wallet architecture, use multisig and verify transactions before you sign them. This is not paranoia – it is a procedure like a stop loss.

Wallet taxonomy

The rule: hot for interaction, cold for storage. Never the other way round.

The 3-wallet architecture – the KursTradera standard

Do not keep everything in one MetaMask that you also use to farm airdrops.

Wallet A – Vault (cold, hardware):

• 70-80% of long-term capital.
• Zero interaction with new dapps. Only staking through the official interface + sending to Wallet B.
• Steel seed backup, never entered digitally. 2 copies in different locations.
• Connected only through Rabby/MetaMask as watch-only, for signing.

Wallet B – Operating (hot, Rabby – the main one):

• 15-25% of capital in dapps with an established reputation (Uniswap, Aave, Lido).
• Approval limit – you grant an approval only for the transaction amount, not unlimited.
• Separate for each major narrative (e.g. one for ETH mainnet, another for L2) if you want to limit the blast radius.

Wallet C – Burner / Airdrop (hot, a new seed every quarter):

• 1-5% of capital, for tests, mints, new chains.
• You assume it will be drained. You regularly migrate funds to B.
• Never send from the Vault straight to the Burner – always through B or a new intermediate address.

Flow:
Vault (cold) -> B (operating, verified dapps) -> C (burner)
Never: C -> Vault (you contaminate your anonymity and your security)

Seed, private key, passphrase – what you are really protecting

• Seed (12/24 words): The master key. Whoever has it owns everything on every chain.
• Private key: A derivative of the seed for one specific address. Exposing one key = losing that address, but the seed still compromises the rest.
• Passphrase (25th word, BIP39): An extra word that creates a hidden wallet. It works as 2FA. If you lose the passphrase, even with the seed you will not recover the funds. If someone steals the seed without the passphrase, they will not recover the hidden wallet.

Procedure:

1. Generate the seed offline on a hardware wallet, not on a website.
2. Write it down by hand, 2 copies on steel plates (Cryptosteel/Titanium). Never a photo, never the cloud, never Notepad.
3. Test the recovery on a second device before you send larger funds.
4. Consider a passphrase for the Vault – store it separately from the seed.

Approvals, permit and transactions – where the money disappears

The most common cause of a drain: an unlimited ERC20 approval.

When you give a DEX an approval for USDC, you tell the contract: “you can spend any amount of my USDC until I revoke it”. If the DEX contract is hacked or swapped for a phishing one, it can clear out the USDC.

How to defend yourself:

• Use Rabby – before you sign it shows what you are actually signing: an approval, a permit or a transfer.
• Grant the approval for the transaction amount, not unlimited (Uniswap lets you set a custom limit).
• Regularly clear approvals: Revoke.cash, Rabby Approval Center.
• Tell the difference:

The rule: if a dapp asks for setApprovalForAll for NFTs and it is not OpenSea/Blur, do not sign it from a wallet holding expensive NFTs.

Checklist before signing (mandatory)

1. Is the URL the official domain? (check the project's Twitter, not Google Ads)
2. Does Rabby/MetaMask show the correct contract and network?
3. Is this an unlimited approval? If so -> change it to a limit or use the Burner
4. Is the function called "Claim" but the contract wants "TransferFrom" on every token? -> SCAM
5. Is the gas amount absurd (e.g. 1 ETH gas for a claim)? -> often a hidden transfer

Multisig – Safe

Safe (safe.global) is a contract that requires M of N signatures.

Example: your Vault as a 2/3 multisig:

• Key 1: Ledger at home
• Key 2: Trezor in a bank safe deposit box / at family
• Key 3: Keystone or paper in a safe

To send funds you need a signature from 2 of the 3 devices. Stealing one does not end in a loss. Losing one does not block the funds.

Multisig is also the standard for DeFi projects – if a project keeps its treasury on an EOA (an ordinary wallet) rather than on a multisig with a timelock, that is a red flag.

Uses:

• Your personal treasury >$25k
• Any shared management of capital
• Storing seeds for a company – key 3 with a lawyer

Phishing – vector #1

Attacks do not break cryptography. They break your process.

The most common scenarios:

• Fake airdrop: DMs on Discord/Telegram “You are eligible, click here”. A domain with a typo.
• Fake update: “You must restart MetaMask”. Never enter your seed in a browser.
• Drainers as Google ads: a sponsored “Uniswap” result leads to uniswaρ.com.
• Clipboard swap: malware replaces the copied address with the attacker’s address. Always check the first 4 and last 4 characters of the destination address.

Mitigation:

• Bookmarks: all dapps in favourites – enter only from bookmarks.
• Rabby + Wallet Guard / Pocket Universe simulates the transaction.
• A separate browser for crypto only (e.g. a Brave profile), with no random extensions.
• DNS: use an extension that warns you about a new domain (<30 days).

When the plan says do not trade

1. When you have only one wallet for everything. With no Vault / Operating / Burner split – one bad transaction = losing everything. Architecture first, trading second.
2. When a dapp asks for an unlimited approval and you have no time to check what you are signing. No time = no trade. Use a Burner with a small amount.
3. When you are four hours into clicking airdrops and you are tired. Tiredness = no checklist = signing a drain. Every farming session ends with a revoke and closing the browser.
4. When the seed has ever been in a clipboard, a photo, the cloud, Discord. Treat the wallet as compromised. Create a new Vault.
5. When a hardware wallet tells you to update the firmware from a link in an email. Update only from the official Ledger Live / Trezor Suite. Never from a link. If you have doubts – do not update on a trading day.

The mistakes that cost the most

1. One seed for 20 wallets in MetaMask with no hardware. One hole and every account falls.
2. Keeping all your capital in a hot wallet “because it is more convenient”. Convenience costs 100% when you get drained.
3. Copying the seed into 1Password/Notion/Gmail as a “backup”. That is not a backup. That is exposing the key to the internet.
4. No $1 test transaction before sending $10k to a new chain. Wrong networks, memo, chain ID – a $1 test saves capital.
5. Ignoring approvals after farming. After an airdrop campaign you have 30 unlimited approvals to suspicious contracts. Those are ticking bombs. Clear them every week.

Measurable exercise

OPSEC audit – 60 minutes once a month:

1. Open Rabby Approval Center + Revoke.cash for every wallet. Record the number of active unlimited approvals.

2. Target: 0 unlimited on the Vault, <5 on Operating, any number on the Burner, but cleared every 14 days.
3. Run a Vault recovery test on a second device (without wiping the first) – does the seed + passphrase work?
4. Simulate phishing: send yourself a fake link and check whether the bookmark procedure protects you.
5. Write down the inheritance procedure: what should the family do if you lose access? Where is the seed, where are the instructions? Without it the vault becomes a furnace.

Metrics:
Number of unlimited approvals: 0 in the Vault = PASS
Time to recover the wallet from the seed: <15 min = PASS
$1 test transaction before every transfer >$1000: 100% = PASS

Check yourself

1. How does a seed differ from a private key and why is the seed critical?
2. Describe the 3-wallet architecture and the flow of funds.
3. What is a permit and why is it more dangerous than an ordinary signature?
4. When does a Safe 2/3 protect you, and when is it not enough?
5. How do you check whether you are signing an unlimited or a limited approval?

Frequently asked questions

Ledger or Trezor? Both are better than hot. Ledger has a Secure Element, Trezor is 100% open source. For the Vault consider both (manufacturer diversification). The most important thing is to buy from the official store, not from a marketplace like Allegro.

Is Rabby safer than MetaMask? Rabby has better transaction simulation, shows an approval breakdown and warns about phishing. That does not mean MetaMask is bad – but in multi-chain farming Rabby reduces operational errors.

Is keeping the seed in a bank a good idea? Yes, as one of the copies, in steel form. Not paper in an envelope – paper degrades. A bank safe deposit box protects against home theft, but not against institutional inflation – hence the second copy in another location.

What if a project asks me to sign a message to get an airdrop? An off-chain message signature (personal_sign) is usually safe – it does not send a transaction. But if the message contains strange hexadecimal data and Rabby shows “Permit” – do not sign. A message signature can also be abused for ownership verification, but not for transferring funds, as long as it is not typed data permit.

Can I use the same address on many L2s? Yes, the same EVM address works on many L2s (the same keys). That is convenient, but it links your activity. If you want to separate identities (e.g. airdrop farming 20 accounts), use different addresses and avoid funding them from a single source – the chain sees it.

---