Setting Up Your First Wallet Safely
With the custody concepts from the last two lessons in hand, this lesson walks through the actual mechanics of installing and configuring a self-custody wallet you can use for the rest of this course. The most widely used option for the DeFi protocols you'll encounter later is a browser-extension or mobile wallet like MetaMask, though the same principles apply to any reputable self-custody wallet.
The process has five steps, and the order matters. First, download only from the official source — the project's own website (verify the URL carefully) or an official app store listing with a verified publisher, never a link from a search ad, a social media DM, or a site you reached by clicking an unsolicited link. Fake wallet extensions and phishing clones that look pixel-identical to the real thing are a well-documented and common attack vector, and once installed, they can capture your seed phrase the moment you enter it. Second, choose "create a new wallet" rather than entering any existing seed phrase into a wallet you haven't verified. Third, the wallet will generate and display your seed phrase — this is the moment to execute the offline, handwritten backup plan from the previous lesson, before doing anything else. Fourth, set a strong local device password for the wallet app itself (this protects quick access on your device, separate from the seed phrase, which protects the funds themselves). Fifth, before ever sending a meaningful amount of funds, verify your wallet's public address carefully and send a small test transaction first.
Beyond these five steps, two ongoing habits round out a safe setup. The first is keeping the wallet software itself updated through the official app store or extension marketplace rather than a manually downloaded file from elsewhere — security patches for wallet software are released regularly, and delaying updates leaves known vulnerabilities open. The second is understanding what your wallet will and will never ask you for: a legitimate wallet interface will never ask you to type your seed phrase into a website, a pop-up, a support chat, or anywhere other than the wallet's own restore screen when you are deliberately recovering a wallet on a new device. Any prompt claiming to be a wallet, an airdrop, or "support" that asks you to "verify" or "connect" by entering your seed phrase is, without exception, a theft attempt.
Worked Example
A common and costly attack pattern works like this: a user searches for "MetaMask download" and clicks a sponsored search ad or a link shared in a chat group, landing on a site that looks identical to the real MetaMask site, down to the logo and layout. The fake extension installs normally and even generates a seed phrase, and may even function for a basic wallet — but behind the scenes, it has either stolen the seed phrase as it was generated or is configured to intercept transactions, and the moment any meaningful funds are deposited, they're swept to the attacker's address.
The safe pattern avoids every opportunity for this substitution: navigate directly to the official project's domain by typing it yourself or using a bookmark you created after verifying the URL once, rather than clicking any link from search results, ads, or messages. After installing, generate the new wallet, complete the offline seed phrase backup exactly as practiced in the previous lesson, and before transferring any significant funds, send a small test amount — for example, a few dollars' worth — to the new wallet's address first. Confirm the test transaction arrives correctly and that the address displayed in the wallet matches what you expect, character for character, before ever sending a larger amount. This small-test-first habit costs a few extra minutes and a tiny transaction fee, and it's the single cheapest insurance policy against a wrong address, a fake wallet, or a clipboard-hijacking malware substituting a different address than the one you copied.
A second, equally common pattern targets wallets that are already correctly set up: a fake "customer support" account on social media replies to a user's public question about a stuck transaction, asking them to "verify their wallet" on a linked site by entering their seed phrase. A user who has internalized the rule "a legitimate wallet never asks for my seed phrase outside its own restore screen" recognizes this instantly as an attack regardless of how official the account's profile picture or name looks, and reports or ignores it rather than engaging.
Exercise
If you don't already have one, install a reputable self-custody wallet by navigating directly to its official source (type the URL yourself rather than clicking a link), generate a new wallet, and complete your offline, handwritten seed phrase backup exactly as planned in the previous lesson — do this before moving to the next step. Set a strong local device password for the wallet app, and confirm the app is set to receive updates through its official store or extension marketplace.
Then, send yourself a small test transaction: if you're using a testnet (free test tokens meant for exactly this kind of practice, with no real monetary value), use that; otherwise use the smallest real amount you're comfortable with. Before sending, carefully verify the destination address character by character against what the wallet displays. After the transaction confirms, check that the received amount and address match exactly. Finally, write one sentence in your own words describing what a legitimate wallet will never ask you for — you'll rely on this instinct again in Module 6's lessons on scams and red flags. Only once your test transaction succeeds should you consider moving larger amounts into this wallet for the swap, liquidity, and lending exercises in later modules.
Recap
- Always install a wallet from the official source you navigate to directly — never from a search ad, DM link, or unverified site — and keep it updated through official channels.
- Complete your offline seed phrase backup immediately upon wallet creation, before doing anything else with the wallet.
- A small test transaction, verified address-by-address, plus the rule "a legitimate wallet never asks for your seed phrase outside its own restore screen," are the cheapest protections before you move real funds.