A notepad with a handwritten to do list and ticked boxes beside a pen

Analysis · Wallets

Self-custody wallet safety: a checklist before you send anything

Published 2026-09-28By the CryptoGuardz Register Desk6 min read18 sources

Photo: Thomas Bormans / Unsplash

In short, from the documents

What should you check before sending from a self-custody wallet?

Seven checks drawn from MetaMask's and Phantom's own help centres, read on 28 September 2026. Both say their support will never ask for a recovery phrase, neither can undo a confirmed transfer, and Phantom supports neither Tron nor BNB Chain, two common USDT networks.

Piece published 2026-09-28Reviewed by CryptoGuardz Register Desk, editorial desk

Self-custody wallet safety comes down to 7 checks, and MetaMask's and Phantom's own help centres state most of them in plain words: keep the recovery phrase offline, never type it into a site, match the network, read the whole address, revoke old approvals, use a hardware wallet for serious money and ignore anyone offering support by DM. On mistakes, Phantom says it cannot reverse a transaction, and MetaMask offers to cancel one only while it is still pending.

The help pages below were read on 28 September 2026. The binding terms for both wallets are summarised on the wallet register, with entries for MetaMask and Phantom. The checklist applies wherever the coins are going: a friend, an exchange, a DEX, a casino deposit address. It does not make any of those destinations lawful or sensible.

1. Where should I keep my recovery phrase?

On paper, offline, and nowhere else. Phantom's help centre is direct:

Store it offline only. Write it down and keep it in a secure location.

Phantom help centre, I was scammed or my wallet was drained, retrieved 2026-09-28

A hand writing in a lined notebook with a black pen — Illustration: handwriting on paper. Paper kept offline is where the wallet makers quoted here tell users to keep the phrase. Photo: Glenn Carstens-Peters / Unsplash

The same page adds "Never store it in a photo, notes app, email, or cloud storage" and "Never enter it into any website. You do not need your recovery phrase to connect to a dApp." MetaMask lists only two legitimate moments to enter the phrase: creating the wallet, and restoring it on a new device or after a password reset. Anything else asking for it, a site, a pop-up, a "sync" page, is theft.

One wrinkle. Both wallets now offer sign-in with Google or Apple. MetaMask says the phrase is then "encrypted and sharded across five different nodes" and recommends you "still secure your SRP" anyway. For Phantom wallets made that way, the register records that the private key sits under Phantom's key management rather than on the device. Convenient, and a different custody model from the one the word self-custody suggests.

2. Should I send a small test transaction first?

Yes, for any new address or network. Neither help centre page read makes it a rule, but both say a confirmed transfer is final: Phantom states it "cannot reverse or retrieve transactions". A test costs one network fee. A mistake costs everything sent. Attackers know this too: the address that collected the Duelbits theft moved 1 ETH ahead of each large transfer, according to the Blockscout record read for the Duelbits post.

3. How do I avoid sending USDT on the wrong network?

Pick the network on the sending side that the receiving side lists, every time. USDT exists on Tron, Ethereum, BNB Chain and more, and the same ticker on different chains is not interchangeable. Phantom's supported networks page lists Solana, Ethereum, Bitcoin, Base and Polygon among others; Tron and BNB Chain are not on it. MetaMask's network page lists both. On the exchange side, 8 of 10 exchanges whose USDT list could be read withdraw on Tron, while Coinbase and Crypto.com Exchange do not (exchange register).

When it goes wrong, the outcome depends on the chain family. MetaMask says a transfer on the wrong EVM network is recoverable because the same phrase gives the same address, but for a non-EVM network "it's likely your tokens are gone forever". Phantom says tokens sent on an unsupported network "like BNB Smart Chain or Arbitrum" are "often recoverable" with another EVM wallet.

Check	MetaMask help centre	Phantom help centre
Recovery phrase	Never share, support never asks	Offline only, never on a site
Tron USDT	Tron listed	Tron not listed
BNB Chain USDT	BNB Chain listed	Not listed
Wrong network	EVM recoverable, non-EVM likely lost	Unsupported EVM often recoverable
Lookalike address	Warns on 4 plus 4 match	Not disclosed
Approvals	Etherscan checker, Revoke	Revoke.cash, Famous Fox's Revoker
Hardware wallet	For large balances	Ledger named
Reversal	Only while pending	"cannot reverse transactions"

4. What is address poisoning and how do I check an address?

Address poisoning plants a lookalike address in your history with a tiny transfer, hoping you copy it next time. MetaMask's page says to "pay particular attention to the middle characters, not just the start and end", and to stop copying addresses from transaction history. MetaMask now warns when a destination matches a past one on the first four and last four characters but differs in the middle. Use the saved contacts list for addresses you send to often. The Duelbits address received 23 dust transfers of 0.000000001 ETH or less between 24 and 28 September, most from lookalikes, which is what the attack looks like on Blockscout.

A magnifying glass held up, bringing an autumn landscape into focus — Illustration: a magnifying glass. Check the middle characters of an address, not just the start and end. Photo: Steven Wright / Unsplash

5. How do I revoke token approvals?

With an approval checker, then a revoke transaction. An approval lets a contract move a token from your wallet, and it stays live after you disconnect the site. MetaMask's help centre names the approval checker on block explorers such as Etherscan, and tools including Revoke. Phantom sends EVM users to Revoke.cash and Solana users to Famous Fox's Revoker. Phantom's advice is to "Regularly check and revoke permissions for apps you no longer use."

6. When do I need a hardware wallet?

For any amount you cannot afford to lose. MetaMask: "If you have a large value of tokens in your account(s), consider getting a hardware wallet." Phantom names Ledger and says the keys "stay on the hardware device". The address check gets stronger too: most hardware wallets make you confirm the destination on the device screen, per MetaMask's poisoning page.

7. Is a support agent messaging me real?

No. Phantom's help pages carry the line "Phantom Support will never DM you or ask you for your recovery phrase." MetaMask: "We will never ask you to provide your SRP." Anyone who opens with a DM offering to fix a stuck transfer is the problem, not the fix.

What can the wallet do after a theft?

Almost nothing. Phantom says it "cannot access, freeze, or recover your funds", and its terms cap liability at 100 US dollars. MetaMask's cap is fees paid in the prior 12 months, or $25,000 if none were. Prevention is the whole plan.

Quick answers

Is a self-custody wallet safe?

As safe as the phrase and the habits around it. Phantom says it cannot reverse a transaction; MetaMask can cancel one only while it is pending. Wallet register.

Can I send Tron USDT to Phantom?

No. Phantom's supported networks page lists 0 Tron entries. Use a Solana or Ethereum route the sender also supports. Phantom entry.

How do I spot address poisoning in MetaMask?

Check the middle characters. MetaMask warns when the first 4 and last 4 characters match a past address but the middle differs. MetaMask entry.

Which tools revoke token approvals?

Revoke.cash and the Etherscan token approval checker on EVM chains, and Famous Fox's Revoker on Solana, as named by the 2 wallets' help centres. Swaps and their approvals are on the DEX register.

If gambling has stopped being a choice, the responsible gambling page lists the helplines and self-exclusion schemes by market. Outside those markets, Gambling Therapy offers free support at gamblingtherapy.org.

More analysis

2026-10-14How to send bitcoin to another wallet, and how to find a bitcoin wallet address, step by stepSending bitcoin means pasting the recipient's address, choosing the amount and fee, and signing. Coinbase's web flow has 6 steps and Trezor Suite's has 4. Addresses start with 1, 3, bc1q or bc1p. Mempool.space recommended 1 sat/vB on 14 October 2026, and bitcoin.org says a transaction "cannot be reversed".2026-10-14How to set up a bitcoin wallet, step by step from the Blockstream and Trezor guidesA self-custody bitcoin wallet is set up by installing the app, generating keys, writing down a 12 or 24 word recovery phrase and checking it. Blockstream's app guide lists 4 steps; Trezor says its hardware setup takes about 15 minutes and wipes the device after 16 wrong PINs.2026-10-14Ledger Nano X review from Ledger's own pages, specs, price, Ledger Recover and two incidentsThe Ledger Nano X lists at US$99 on Ledger's US shop, read 14 October 2026, with an ST33J2M0 chip rated CC EAL5+, Bluetooth 5.2 and a 5 hour battery. Ledger Recover is a paid, optional key backup. Ledger's 2020 customer-data breach and 2023 Connect Kit attack did not break the device; both fed theft through phishing and malicious signing.2026-09-28MetaMask and crypto casinos: what MetaMask's own terms sayMetaMask's terms of use name no gambling rule. They do let MetaMask suspend access on enumerated grounds, disclose that its own stablecoin can be frozen by third parties, and cap liability at fees paid or 25,000 dollars if none were.2026-10-14How do bitcoin ATMs work? Fees, state caps and the scam numbers from the FBI and FTCA bitcoin ATM sells bitcoin for cash and sends it to a wallet address the customer supplies. CoinFlip's terms price purchases at a 21.90% transaction fee. The FBI's IC3 recorded 13,460 complaints and $389 million in losses tied to crypto ATMs in 2025, and California caps kiosk fees at the greater of $5 or 15%.2026-10-14Coinbase scams: how the impersonation calls work, and what Coinbase says it will never askMost Coinbase scams are impersonation: a caller or text posing as Coinbase support pushes the customer to move coins to a "safe" wallet. Coinbase's help centre lists what its staff never ask for. In May 2025 Coinbase disclosed that bribed support contractors had taken customer data, including government ID images, for under 1% of monthly transacting users, which gave scammers real details to quote.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.