How to keep a crypto wallet safe
Practical, non-paranoid security for people who hold stablecoins: devices, recovery, phishing, address checks and the settings worth turning on.
By Luindy Editorial7 min read
Most losses in crypto are not clever hacks. They are a text message that looked real, a browser extension that was not, or a seed phrase photographed and uploaded to a cloud album. Good security is mostly habits. Here are the ones that matter, and how the Luindy account is designed to make them easy.
Recovery comes first
Before you hold anything meaningful, know how you get back in if you lose your phone. With Luindy there is nothing to back up: your wallet is created and run by Luindy, and you get back in by verifying your identity on a new device. Losing a phone is an inconvenience, not a catastrophe. If you use a self-custody wallet elsewhere, write its recovery phrase on paper, store two copies in two places, and never type it into a website.
Phishing is the real enemy
- Luindy will never message you asking for a code or a password. No legitimate service does.
- Type the address luindy.com yourself or use the app. Do not click links in emails or DMs claiming to be from us.
- Be suspicious of urgency. "Your account will be locked in 24 hours" is the oldest trick there is.
- Check the sender domain letter by letter. "luindy-support.com" is not us.
Check addresses like a professional
Address-poisoning attacks send you tiny transfers from an address that looks like one you use, hoping you copy it from your history later. Always take the address from the recipient directly, and compare the first four and last four characters against what they sent you. Luindy shows saved contacts with names and warns when an address is new.
Devices and settings
- Keep your phone's operating system up to date.
- Use a hardware-backed passkey or biometric to unlock Luindy, not a four-digit PIN.
- Turn on withdrawal limits and the 24-hour delay for large sends. It gives you time to cancel if something is wrong.
- Turn on notifications for every transaction. A surprise notification is the fastest alarm you will ever get.
- Do not install browser extensions you do not need. Extensions can read every page you visit.
Networks and wrong-chain sends
Sending USDC on the Ethereum network to a Solana address is the most common irreversible mistake we see. Luindy only accepts Solana. When someone sends you funds, tell them: USDC or USDT, Solana network. Say it every time.