Wallet Security Center

Security guidance for recovery phrases, private keys, scams, theft, permissions, devices and phishing.

Recovery Phrases & Private Keys

Recovery phrases and private keys are critical wallet credentials. Write them down offline and store them in a secure, durable location. Do not screenshot, upload to cloud storage, send through email or chat, or provide them to supposed support or technical staff.

Anti-scam & Anti-phishing

Verify domains, download entry points and certificate information. Avoid unknown links claiming wallet upgrades, account issues or rewards. imtoken staff will not ask for recovery phrases, private keys or verification codes.

DApp Permission Reviews

Before approving a token, verify the contract, allowance and purpose. Unlimited approvals can increase risk. Review old permissions regularly, revoke or reduce them when appropriate, and remember that revocation may require gas.

Device & Remote-control Risk

Use trusted devices, keep systems and browsers updated, and avoid untrusted software. Be cautious of “support” asking for remote desktop, screen sharing or assistive control, which may expose wallet activity and sensitive information.

Transfer Verification

Once a blockchain transfer is confirmed, it usually cannot be reversed by a wallet provider. Verify network, address, asset and amount before sending. For a new address or significant transfer, consider a small test first.