Best Practices
Managing crypto comes with responsibility. These best practices will help you stay secure, avoid common mistakes, and keep full control of your assets at all times.
Setting up two-factor authentication
Two-factor authentication (2FA) is required for every Vault account. It's set up the first time you sign in, right after verifying your email with a one-time code — there's no separate settings screen to find it in.
When prompted, you'll choose one of two methods:
Authenticator app (TOTP)
Scan a QR code with an app like Google Authenticator, Authy, or 1Password, then enter the 6-digit code it generates to confirm setup. This is the most portable option — it works even if you switch devices, as long as you've backed up the app.
Passkey
Use Face ID, Touch ID, Windows Hello, or a hardware security key. Passkeys are tied to your device and are highly resistant to phishing, since they only work on the real Vault sign-in page.
Recovery codes
Right after you finish setup, Vault shows you a set of one-time recovery codes. Each code can only be used once, and they won't be shown again after this step — copy them and store them somewhere safe before continuing.
Safely exporting your private keys
Vault is self-custodial, so you can export your embedded wallet's private key at any time. You'll find this under Account → Wallets, in the Security section, under Export private key.
Before the key is revealed, you'll be asked to re-verify your identity. You'll also see a notice explaining that you're solely responsible for safeguarding whatever you export — read it carefully, since once a private key leaves Vault, protecting it is entirely on you.
Rules for handling your exported key
Only export from inside Vault
The private key reveal only happens through Vault's own export flow. If any website or message asks you to paste or type your key elsewhere, it's a scam — close it immediately.
Never share it, screenshot it, or send it anywhere
No Vault team member will ever ask to see your private key. Once it's exposed to anyone else, your funds can be moved without your consent — and that can't be undone.
Verify your identity first
Exporting requires you to re-authenticate before the key is revealed. This step exists so that only you — not someone who's simply signed into your session — can access it.
Write it down, then close the tab
Copy it to somewhere physically secure, like paper stored in a safe. Avoid cloud notes, email drafts, password managers synced to the cloud, or screenshots that can be backed up automatically.
Common crypto scams
Crypto scams keep evolving, but most fall into a handful of patterns. Vault's Keeping Your Account Secure guide covers phishing, fake support agents, and approval scams in more detail — here are a few more worth knowing about.
Impersonation & fake giveaways
Accounts on X, Discord, or Telegram that copy a real project's name and profile picture, announcing a "giveaway" or "airdrop" that asks you to send crypto first to receive more back. Legitimate giveaways never require you to send funds.
Pig butchering / romance investment scams
A scammer builds a personal relationship over weeks or months — often starting on a dating app or social media — before introducing a "trading opportunity" on a fake platform. Early withdrawals may be allowed to build trust, then larger deposits are blocked or the platform disappears entirely.
Fake wallet or exchange apps
Counterfeit apps uploaded to app stores or distributed via direct links that mimic real wallets or exchanges. Once you enter your seed phrase or private key, funds are drained immediately. Only install Vault from an official link, and check the publisher before entering any recovery information anywhere.
Malicious wallet connection requests
A site or pop-up prompts you to "connect wallet" or sign a message that looks harmless but is actually a token approval or a signature that authorises a transfer. Read what you're signing every time — if the request doesn't match what you expect to be doing, reject it.
Address poisoning
An attacker sends a tiny or zero-value transfer from an address designed to look almost identical to one you've used before, hoping you copy it from your history by mistake on a future send. Always copy addresses from a trusted source, and double check the full string, not just the first and last few characters.
SIM swapping
An attacker convinces your mobile carrier to move your phone number to a SIM they control, letting them intercept SMS codes tied to your accounts. Vault doesn't use SMS for sign-in, but this can still expose email or other accounts used to recover your wider digital identity — ask your carrier about a port-out PIN or lock.
General best practices
None of these habits require any special expertise — they just need to become routine.
Bookmark the real Vault URL
Navigate to Vault from a saved bookmark rather than a search result or a link in a message. Search ads and DMs are common ways scammers distribute lookalike phishing sites.
Read every transaction before you sign
Your wallet shows what you're approving before you confirm it. Check the contract, the amount, and the token — especially for approvals, which can grant ongoing access rather than a one-time transfer.
Prefer a passkey where you can
Passkeys are bound to your device and the real Vault domain, so a phishing site simply can't use one even if you're tricked into visiting it. If you use an authenticator app instead, keep it backed up.
Keep your devices and apps up to date
Install operating system and browser updates promptly, and avoid installing browser extensions or apps you don't fully trust — a compromised device undermines every other precaution.
Treat unsolicited contact with suspicion
Vault will never message you first asking for your key, a verification code, or remote access to your device. If someone claiming to be from Vault reaches out to you unprompted, assume it's a scam.
When you're not sure
If you're ever uncertain whether a transaction, wallet address, exchange, or investment opportunity is legitimate, the safest move is to pause before you send anything and get a second opinion.
Contact our support team
Reach out and describe what you're looking at — a suspicious message, an unfamiliar contract, or a deal that feels off. We can help you think it through before you commit any funds.
Ask for a VeriTrans check
For anything that needs deeper due diligence — verifying a company or platform, checking international licensing, or tracing a wallet address on-chain — we offer VeriTrans, our transaction verification service, to investigate and report back before you proceed.