Most mainstream self-custody wallets rely on BIP-39 mnemonics drawn from a fixed 2,048-word list, commonly 12 or 24 words. The standard uses PBKDF2 with 2,048 iterations to turn that mnemonic into a seed. If this key material leaks through screenshots, cloud notes, or phishing support requests, your wallet is permanently compromised.
Transaction integrity is the second surface: the address you see should be the address the network receives. Clipboard malware, malicious browser extensions, and lookalike QR codes cause losses because users trust what they copy without verifying the first and last characters.
Authorization drift is the third distinct surface. On chains that use ERC-20-style allowances, a one-time approval can authorize a contract to spend tokens later, sometimes for an unlimited amount. Security isn't finished when the swap completes, because a compromised contract can drain more than you authorized if you approved too much.
The best checklist doesn't demand a bunker; it demands discipline. Tools and materials that consistently pay off are simple: a pen and paper, a fire-resistant storage option if your risk model justifies it, a password manager for exchange and email credentials, and a hardware security key if you want to harden account recovery against phishing.
Add one clean environment for wallet creation: ideally a freshly updated computer profile or a dedicated device with minimal apps. The checklist loses points when it recommends complicated ceremonies that most people won't repeat, because the setup you can't reproduce is the one that fails during a restore.
A good checklist insists on a dry-run restore before funding. Wipe the app or use a spare device and confirm you can restore the wallet from the recovery phrase, then verify you can derive the same receiving address. This is the kind of muscle memory that helps you move funds off exchanges safely.
The checklist should treat fees as part of security, not just annoyance. Crypto withdrawal fees are often a flat exchange-charged amount denominated in the asset, and they can differ by network for the same token. Separately, the blockchain itself charges a network fee that fluctuates with congestion.
A checklist that tells you to just withdraw without checking the fee schedule encourages risky behavior: people delay withdrawals, batch too much value into a single transfer, or choose the wrong network to save a few dollars. Trading fees matter too, because the maker-taker model can change what you pay.
