SECURE YOUR PHANTOM WALLET

Protect the wallet behind your digital assets.

Phantom is a self-custody wallet. You control the wallet and its credentials, so recovery-phrase protection, transaction verification, connected-app review and scam awareness are essential.

This is a self-custody wallet.

Phantom does not control your private keys or assets. Depending on how the wallet was created, you may use a Secret Recovery Phrase or a Google/Apple account-based recovery method.

Phantom's current security tools include transaction previews, malicious-activity warnings, spam detection, connected-app management and automatic locking.

What should I never share?
Never share your Secret Recovery Phrase, private key, Phantom PIN, password or other recovery credentials. Phantom Support will never ask for your recovery phrase or private key.
What if Phantom warns that a dApp may be malicious?
Stop and investigate. Phantom uses transaction simulation and can display warnings when it detects potentially malicious activity or cannot safely simulate what the transaction will do. Do not continue simply because someone tells you the warning is harmless.
Does disconnecting an app revoke its permissions?
No. Disconnecting an app and revoking token approvals are different actions. Phantom explicitly warns that spending permissions may remain after an app is disconnected.
What if my recovery phrase was exposed?
Treat the wallet as compromised. Phantom recommends creating a new wallet and moving remaining trusted assets rather than continuing to use the compromised wallet.
PHANTOM WALLET SECURITY

Protect the credentials, then verify every interaction.

Work through these checks one at a time. With self-custody wallets, an unsafe signature, approval or exposed recovery credential can result in losses that cannot simply be reversed.

Protect your Secret Recovery Phrase

Your Secret Recovery Phrase is a master credential for a recovery-phrase wallet. Anyone who obtains it can potentially control the wallet and its assets.

Click to see protection steps

Step-by-step

  1. Open Phantom only through the official app or browser extension.
  2. If your wallet uses a Secret Recovery Phrase, locate the recovery phrase backup option.
  3. Write the phrase down carefully in the exact order provided by Phantom.
  4. Store it in a secure offline location that only you can access.
  5. Consider maintaining a second secure physical backup if losing the only copy would permanently affect access.
  6. Never store the phrase in a screenshot, ordinary notes app, email or unsecured cloud storage.

VERIFY: Confirm that your recovery phrase is correctly backed up offline and that no untrusted person or service can access it.

Never share your Secret Recovery Phrase or private key

Phantom Support cannot recover or replace your Secret Recovery Phrase or private keys. Anyone asking for them should be treated as suspicious.

Click to see protection steps

Step-by-step

  1. Treat your Secret Recovery Phrase and private keys as confidential wallet credentials.
  2. Never send them through WhatsApp, Telegram, email or social media.
  3. Never enter them into a website because someone says you need to verify or synchronize your wallet.
  4. Never give them to someone claiming to be Phantom Support.
  5. Never send crypto to a supposed recovery or secure walletbecause someone tells you to.
  6. Remember that Phantom Support will never ask for your recovery phrase or private key.

VERIFY: If anyone has ever seen or received your recovery phrase or private key, treat the wallet as potentially compromised.

Protect Google or Apple wallet credentials

Phantom can create wallets using Google or Apple accounts. In that setup, the security of the associated account becomes part of your wallet's security boundary.

Click to see protection steps

Step-by-step

  1. Identify the Google or Apple account associated with your Phantom wallet.
  2. Enable strong multi-factor authentication on that account where available.
  3. Use a strong, unique account password.
  4. Review the Google or Apple account's active devices and sessions.
  5. Remove devices or sessions you do not recognize.
  6. Keep the recovery methods for the Google or Apple account current and under your control.
  7. Never give another person access to the account used to restore your Phantom wallet.

VERIFY: Confirm that the Google or Apple account used with Phantom is protected by strong authentication and contains no unfamiliar sessions.

Set a strong Phantom password or PIN

Phantom may use a local password or PIN depending on how the wallet was created and which device you use.

Click to see protection steps

Step-by-step

  1. Open Phantom.
  2. Open Settings → Security & Privacy.
  3. Review the available password, PIN or device-securityoptions.
  4. Use a password or PIN that another person cannot easily guess.
  5. Avoid using your banking PIN, birthday or phone numberas your wallet PIN.
  6. Protect the underlying phone or computer with a strong screen lock.

VERIFY: Lock Phantom and confirm that your configured local authentication is required before the wallet can be accessed.

Enable Auto-Lock

Auto-Lock reduces the time an unattended Phantom session remains accessible on your device.

Click to see protection steps

Step-by-step

  1. Open Phantom.
  2. Go to Settings → Security & Privacy.
  3. Find Auto-Lock.
  4. Choose an appropriate automatic-lock period.
  5. Use a shorter period on devices that may be left unattended.
  6. Make sure your underlying device screen lock is also enabled.

VERIFY: Leave Phantom inactive for the configured period and confirm that it locks as expected.

Review connected apps

Connected applications can interact with your wallet. Phantom recommends disconnecting applications you do not recognize or no longer trust.

Click to see protection steps

Step-by-step

  1. Open Phantom.
  2. Select your profile avatar.
  3. Go to Settings → Connected Apps.
  4. Review every connected application.
  5. Identify applications you no longer use.
  6. Disconnect unfamiliar or unnecessary applications.
  7. If you are unsure which connections are safe, consider disconnecting all and reconnecting only trusted applications later.

VERIFY: Confirm that every remaining connected application is one you recognize and intentionally use.

Understand the difference between disconnecting and revoking

Disconnecting an application does not necessarily remove spending permissions that were already granted to it.

Click to see protection steps

Step-by-step

  1. Review your Connected Apps.
  2. Disconnect applications you no longer trust.
  3. Separately review token approvals.
  4. On Solana, use a trusted approval-revocation tool when appropriate.
  5. On EVM networks, review smart-contract approvals using a trusted approval-management tool.
  6. Revoke permissions you no longer need.
  7. Verify the network, contract and transaction before signing a revocation transaction.

VERIFY: Confirm that both unwanted app connections and unnecessary token permissions have been addressed.

Pay attention to transaction previews

Phantom simulates transactions and can flag suspicious activity. A warning should be treated as a reason to stop and investigate.

Click to see protection steps

Step-by-step

  1. Start the transaction you intend to make.
  2. Carefully read Phantom's transaction preview.
  3. Check the recipient, asset and amount.
  4. Review the network and any smart-contract interaction.
  5. Pay attention to any security warning.
  6. If Phantom says a dApp may be malicious, stop unless you completely understand why the warning appeared and independently trust the application.
  7. If you do not understand what you are signing, chooseReject.

VERIFY: Only approve a transaction when you understand what Phantom is asking you to sign and can independently verify its purpose.

Verify websites before connecting

Fake dApps, cloned project websites and phishing links can look convincing. Verify the application before connecting your wallet.

Click to see protection steps

Step-by-step

  1. Do not trust a website simply because it appears in a search result, advertisement or social-media post.
  2. Verify the project URL through an official project source.
  3. Be especially cautious with links received through DMs, Telegram, Discord, X or email.
  4. Compare the website domain carefully before connecting.
  5. Check Phantom's security warning if one appears.
  6. If the site asks for your Secret Recovery Phrase, stop immediately.

VERIFY: Confirm the domain through an independent trusted source before connecting Phantom.

Treat unknown tokens and NFTs as suspicious

Unsolicited tokens and collectibles can be used to lure you toward malicious websites and transactions.

Click to see protection steps

Step-by-step

  1. Do not click links contained in an unknown token or NFT.
  2. Do not visit a website because an unsolicited token tells you to claim a reward.
  3. Do not try to swap or sell an unfamiliar token simply because it appears valuable.
  4. Open the token or collectible in Phantom.
  5. Use Report as Spam where available.
  6. Hide suspicious collectibles rather than interacting with their links.
  7. Verify legitimate tokens through a trusted project source or blockchain explorer.

VERIFY: Confirm that you have not interacted with unknown tokens, NFT links or unsolicited claim pages.

Verify token and contract addresses

Names and logos can be copied. The contract or mint address is a much more useful identifier when verifying a token.

Click to see protection steps

Step-by-step

  1. Identify the token you intend to receive, swap or send.
  2. Obtain its official contract or mint address from a trusted project source.
  3. Compare the address with the one shown in Phantom or a trusted blockchain explorer.
  4. Do not rely only on the token name, logo or ticker.
  5. Confirm the network as well.
  6. If the addresses do not match, stop the transaction.

VERIFY: Confirm that the token contract or mint address and network match the legitimate project information.

Verify the network before sending assets

Phantom supports multiple networks. Verify that the receiving address and network are compatible before sending.

Click to see protection steps

Step-by-step

  1. Select the asset you intend to send.
  2. Confirm the network.
  3. Confirm that the receiving wallet supports that exact network.
  4. Copy the recipient address only from a trusted source.
  5. Compare the beginning and ending characters of the destination address.
  6. Confirm the amount.
  7. Review Phantom's transaction preview before signing.
  8. For a high-value transfer, consider a small test transaction first when practical.

VERIFY: Before signing, independently verify the recipient, asset, network and amount.

Use a hardware wallet for high-value assets

A hardware wallet can add another layer of protection by keeping private keys on a dedicated physical device.

Click to see protection steps

Step-by-step

  1. Consider whether the value of your assets justifies a hardware wallet.
  2. Purchase the device from the legitimate manufacturer.
  3. Initialize it as a new wallet.
  4. Record the hardware wallet's own recovery credentialssecurely offline.
  5. Never enter an existing Phantom Secret Recovery Phrase into a new hardware wallet simply to make it safer.
  6. Connect the hardware wallet through Phantom's supported integration.
  7. Confirm important transactions directly on the hardware device.

VERIFY: Confirm that the hardware device controls its own keys and that important transaction approvals require the physical device.

Recover a wallet carefully

Phantom supports different recovery methods depending on how the wallet was created. Using the wrong Google/Apple account or recovery phrase can produce a different wallet.

Click to see protection steps

Step-by-step

  1. Install Phantom from its official source.
  2. Identify how the original wallet was created: Google, Apple or Secret Recovery Phrase.
  3. Use the same Google or Apple account if that was how the wallet was originally created.
  4. If using a recovery phrase, enter the exact 12-word phrase in the correct order.
  5. Check that the expected accounts and addresses appear.
  6. If some accounts are missing, check whether they need to be added manually.
  7. Do not assume an empty wallet means your funds disappeared.

VERIFY: Confirm that the restored wallet addresses match your previously used addresses before making any transaction.

If your Secret Recovery Phrase is exposed

An exposed recovery phrase permanently compromises the wallet. Phantom recommends creating a new wallet and moving remaining assets.

Click to see protection steps

Step-by-step

  1. Stop using the compromised wallet for new deposits.
  2. Do not enter the exposed phrase into another website or send it to anyone claiming to help.
  3. Create a brand-new Phantom wallet.
  4. Back up the new recovery credentials securely before transferring anything.
  5. Independently verify the new wallet address.
  6. Move trusted remaining assets to the new wallet.
  7. Review Connected Apps and token approvals associated with the old wallet.
  8. Stop using the old wallet once your remaining assets are secure.

VERIFY: Confirm that valuable assets are controlled by a new wallet with new recovery credentials and that the exposed phrase is no longer trusted.

Secure the wallet after a scam or drain

If your Phantom wallet has been drained or you approved a malicious transaction, act quickly to protect anything that remains.

Click to see protection steps

Step-by-step

  1. Stop signing transactions.
  2. Disconnect suspicious Connected Apps.
  3. Review and revoke suspicious token approvals.
  4. If the recovery phrase or private key may be compromised, create a new wallet.
  5. Move remaining trusted assets to the new wallet.
  6. Do not interact with suspicious tokens or NFTs that appeared unexpectedly.
  7. Review the blockchain using a trusted block explorer.
  8. Preserve relevant transaction hashes and addressesfor reporting.
  9. Report the scam through appropriate official channels.
  10. Be extremely cautious of anyone promising to recover stolen crypto for a fee.

VERIFY: Do not return valuable assets to a wallet whose recovery credentials may have been exposed.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Phantom security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts