Staying Safe

Crypto is irreversible and self-custodial, which is exactly why scammers target it: there’s no bank to reverse a fraudulent transfer. The good news is that almost every theft comes down to a few repeatable tricks, and a handful of habits stop most of them.

The golden rules

1. Never share or type your recovery phrase. Not into a website, a “support agent” chat, a wallet-import box, or an app. No legitimate person or tool ever needs it. This single rule stops the majority of thefts. (Why →)
2. Verify every address and amount on the device screen. Your computer can be lying; the KeepKey screen is a separate display that your computer does not draw. Read the whole address, not just the ends. (How →)
3. Buy your device from official sources and let it verify genuine, signed firmware on first boot. (Why →)
4. Keep firmware current. Updates close known issues. Official releases are signed by KeepKey, and your KeepKey checks that signature and warns you when firmware is not official. (How →)

Scams to recognize

• Phishing sites & emails — fake “KeepKey” or “wallet” pages that ask you to “validate” or “import” your recovery phrase. Real setup shows the phrase on the device; it never asks you to type it into a browser.
• Fake support — someone in a chat, DM, or search ad posing as support, steering you toward entering your phrase or installing software. Real support will never ask for your phrase.
• Address poisoning — an attacker sends you a tiny transaction from an address that looks like one you’ve used, hoping you’ll copy it from your history later. Always pull addresses from the source (or your Address Book), never from your transaction history, and verify on-device — see Address poisoning & dust.
• Clipboard malware — software that swaps a copied address for the attacker’s the instant you paste. Reading the full address on the KeepKey screen is how you catch it — see Clipboard swapping.
• Fake firmware / apps — altered downloads. Download KeepKey Desktop only from keepkey.com/desktop. Official firmware is signed; a genuine KeepKey checks the signature and warns when firmware is not official — never continue past a warning you didn’t expect.
• “Send 1, get 2 back” / giveaway scams — there is no free money. Anyone promising returns for a deposit is stealing it.

Why a KeepKey helps

A hardware wallet doesn’t make you immune — you are still the last line of defense — but it removes the easy attacks. Keys never leave the device, so remote malware can’t read them. Every transfer needs a physical button press, so nothing moves silently. And the device’s own screen is a second, independent view of what you are about to sign — one your computer does not draw.

On your KeepKey

• The full, honest threat model and the fixes for every disclosed issue: Security.
• The verification habit that defeats clipboard malware and address poisoning: Verifying Transactions.
• Quick answers to “did I mess up?” moments: FAQ.