Let’s face it. We’ve all been neglecting wallet security best practices for too long.

Every week it seems there is another high profile hack where millions of dollars of NFTs are stolen. As scams get more and more sophisticated, even web3 veterans are getting affected. The majority of these instances can be prevented or at least significantly mitigated by following a simple wallet security framework.

This is a quick guide to set that up, designed to keep you safe throughout your web3 explorations.

The best time to think about wallet security is before you get scammed, not after.

The overview

We will be using three wallets in this framework, that each serve different, clearly separated purposes.

• Trading wallet - this is the wallet you are probably using today for everything: minting, trading NFTs, buying crypto, connecting to web3 dapps, etc. We are going to repurpose this to be used only for very specific things.
• Vault wallet - this is the wallet that will be your ultra-secure private bank vault. This is where your NFTs and crypto will be stored when being actively used.
• Minting wallet - this is the wallet that you use to mint NFTs, perform peer to peer swaps, or interact with any web3 applications that one might consider “degen”.

Trading wallet

Many people use one wallet address for everything. Trading crypto, buying and selling NFTs, interacting with random smart contracts. That opens you up to a major risk of losing everything you own to one bad, irreversible mistake.

In your new setup, your trading wallet is going to have a very specific role: be used only for buying/selling NFTs and trading cryptocurrencies.

When selling NFTs on secondary marketplaces like OpenSea or trading crypto on decentralized exchanges like Uniswap, you have to grant something called a “token approval” which gives the platforms the ability to withdraw the NFT/tokens out of your wallet at any point in the future. This is so that trades can facilitate automatically when your order is met.

The major downside of this is that if those platforms get hacked, then the tokens/NFTs that you gave “approval” for can be drained out of your wallet without your knowing.

Because this is the only wallet that will be granting “token approvals”, if you transfer the tokens out of the trading wallet, it cannot be withdrawn without your consent in a different wallet.

You mitigate the risk of losing NFTs and tokens that you are not currently wanting to sell by only storing those that you are currently selling in this wallet. You will also use this wallet for buying NFTs on verified secondary marketplaces.

For DeFi users, I recommend creating a separate trading wallet just for DeFi, in addition to a NFT trading wallet.

I recommend wallets like MetaMask or Coinbase wallet for this. You can use your existing main wallet for this.

Vault wallet

Sometimes called a “cold wallet”, this wallet is designed to be your ultra-secure military grade protected bank vault. Everything that you are not currently intending to sell should be stored in here.

This wallet should also never be used to interact with a secondary marketplace, decentralized exchange or grant any “token approvals” to any smart contracts. Periodically check that this wallet has not granted any by using either of these tools: https://etherscan.io/tokenapprovalchecker or https://revoke.cash. If you see any (you shouldn’t if you stick to this guide), revoke them immediately.

The only transactions that your vault wallet should be used for are: (1) sending crypto or (2) NFTs to another wallet.

If you need to mint an NFT, send enough ETH to cover the mint price + gas into your minting wallet.

Similarly, if you need to purchase an NFT on a secondary marketplace, send enough ETH to cover the purchase + gas.

I recommend hardware wallets like Ledger for this.

Minting wallet

Sometimes called a “burner wallet” this is the wallet you will be using for anything related to minting NFTs, peer to peer swaps, or interacting with new web3 websites. There should only ever been enough crypto in this wallet to complete your intended transaction.

This wallet should not hold any NFTs either, with the exception of any NFTs you might need as part of a “token gated” mint.

The single purpose of this wallet is to be a single access point between you and smart contracts in the wild.

Any NFTs you purchase with this wallet should immediately be sent to your trading wallet (if selling) or vault wallet (if storing).

Similar to the vault wallet, this wallet should not ever grant token approvals. Periodically check that this wallet has not granted any by using either of these tools: https://etherscan.io/tokenapprovalchecker or https://revoke.cash. If you see any (you shouldn’t if you stick to this guide), revoke them immediately.

I recommend wallets like MetaMask or Coinbase wallet for this.

You can create multiple addresses within the same wallet with most wallet software. So I recommend using MetaMask and creating one address to be your trading wallet, and another to be your minting address. Separately, I highly recommend creating your vault wallet address using a hardware wallet like Ledger if possible.

Using this simple wallet framework properly will prevent scammers and hackers from being able to draining your entire web3 net worth at once. If you do end up accidentally interacting with a malicious contract from a scammer or hacker, your loss is minimized to only what is currently in your minting wallet.

Remember, this isn’t the Apple App Store, where there is a rigorous review process before a single user can interact with new software, it’s still the Wild Wild West.

P.S. One downside to this added security is… more addresses to write down and manage! Well, there’s an easy elegant solution for that using ENS subdomains (on Ethereum). If you have more time and want to get a bit more advanced, continue reading below!

Bonus: Using ENS subdomains to easily manage your wallets

Most of you have probably already heard of ENS domains or seen people using them to replace their name on Twitter, some of you might already be using one. These are human readable names that map to ETH addresses, managed by a popular protocol called ENS (Ethereum name service). This lets you send NFTs or crypto to other addresses directly to a human friendly .eth domain rather than typing an entire 43 character Ethereum address.

If you haven’t heard of ENS I highly recommend this article to learn more about it.

After this is all configured correctly you will be able to easily transfer crypto and NFTs between your 3 wallets using ENS domains. (Note: following this part of the guide will require multiple gas transactions and purchasing an ENS domain if you don’t already have one.)

This is what an example setup looks like:

web3surfoor.eth → 0x0011DB7bfB0f1F77F03a726C2a4135c759FF515B (Trading wallet)

vault.web3surfoor.eth → 0x2f2E21B7E1248FdAc5e802435Ef5AFa48Fb1f8Fe (Vault wallet)

minting.web3surfoor.eth → 0x8a4716f66e7D204BE0d0223D6Dba91Dd23b4F7f7 (Minting wallet)

“web3surfoor.eth” will be replaced with whatever your ENS Domain is.

I won’t go into the details on how to set up ENS subdomains, but this article by Bankless has a guide on how to set them up in the “Subdomains” section.

Congrats! Now you have all 3 wallets set up within ENS for easy transfers.