Keeping Your Account Secure

Security is the most important aspect of managing crypto. Unlike a bank, there is no customer service line that can reverse a transaction or recover lost funds. This guide covers the key practices that will help you protect your Vault account and keep your funds safe.

Self-custody and key ownership

Vault is a self-custodial wallet. That means you own your funds outright. No Vault employee, server, or system has the ability to access, move, or freeze your assets. When you create a Vault account, a wallet is generated that belongs entirely to you.

This is fundamentally different from keeping crypto on an exchange. With an exchange, the platform holds your funds on your behalf. With Vault, the keys are yours and only yours. This gives you full control, but it also means full responsibility.

What self-custody means in practice

  1. You are always in control

    Vault cannot block, reverse, or hold your transactions. Every action you take is signed directly by your wallet. No third party can intervene.

  2. Vault never stores your complete keys

    Your private key is secured using MPC (Multi-Party Computation) technology. The key is split into shares that are never assembled in one place, meaning no single breach can expose your full key.

  3. You can always export your keys

    At any time you can export your private key from Account, then Wallets, in the Security section. This lets you import your wallet into any compatible wallet app if you ever need to.

Your private keys

A private key is a long string of characters that proves ownership of your wallet. Anyone who has your private key has complete control over your funds. Treat it like the PIN to your bank account, except it can never be changed and never reset.

Vault uses MPC (Multi-Party Computation) to protect your key while it is in use. The key is never stored in full on any single server or device. When you sign a transaction, the key shares collaborate to authorise it without ever being assembled in one place.

Rules for handling your private key

Never share your private key with anyone

No legitimate support agent, Vault team member, or protocol will ever ask for your private key. If anyone asks for it, it is a scam.

Never enter your key into a website or form

Phishing sites are designed to look legitimate and will steal your key the moment you submit it. Only ever export your key directly within the Vault app.

Store a backup offline

Write your private key down on paper and store it somewhere physically secure, such as a safe or a locked drawer. Avoid storing it in cloud notes, email drafts, or screenshots.

Export from Account when needed

If you want to import your wallet into another app, go to Account, then Wallets, and use the Export private key option in Security. You will be asked to re-verify your identity before the key is shown.

Recognising and avoiding scams

Crypto scams are common, well-funded, and increasingly convincing. Understanding the most common tactics is one of the best defences you have. If something feels off, trust that instinct and stop before acting.

Vault will never contact you unsolicited asking for your key, password, or to verify your account via a link. Any message claiming to be from Vault that asks for sensitive information should be treated as a scam.

Common scam types

Phishing

Fake websites or emails that impersonate Vault or other crypto services, designed to steal your login credentials or private key. Always check the URL carefully before entering any information. Bookmark the real Vault URL and navigate from there rather than clicking links in emails.

Fake support agents

Scammers pose as Vault support staff on social media, Discord, or via direct message. They offer to help resolve issues but eventually ask for your private key or to install remote access software. Vault support only operates through official channels and will never ask for your key.

Approval scams

A malicious dApp or link prompts you to approve a token allowance that gives an attacker unlimited access to spend your tokens. Always read transaction details carefully before signing. If you see an approval request for an unlimited amount from an unfamiliar source, reject it.

"Too good to be true" schemes

Promises of guaranteed returns, airdrop claims that require you to send funds first, or investment opportunities with unusually high yields are almost always scams. No legitimate protocol guarantees returns, and no real airdrop requires you to send crypto to receive crypto.

Quick checklist

Related articles