Ilia Zavialov

Protection

Why Ilia Zavialov Treats Crypto Wallet Protection as a One-Time Setup

English version for the United States.

Most crypto wallet guides list steps and stop there, without saying what an attacker actually does once a phrase, a device or a phone number falls into the wrong hands. Ilia Zavialov starts from the other end here: which measures still work after an account is already compromised, and which ones only look reassuring on the page where they were written. Nobody avoids every mistake indefinitely, so the more useful question is which few decisions, made once and left alone, keep a single slip from turning into a total loss. That question is what the rest of this article works through, measure by measure.

·13 min read·Ilia Zavialov

Diagram of the crypto wallet protections Ilia Zavialov treats as a one-time setup: custody split, offline phrase, whitelist, delay, hardware key
Diagram of the crypto wallet protections Ilia Zavialov treats as a one-time setup: custody split, offline phrase, whitelist, delay, hardware key

01Deciding before the pressure arrives

A theft rarely gives warning. The account looks normal until a balance is gone, a session is open that the owner never started, or a message asks to confirm a withdrawal nobody made. By then, only protections set up in advance still matter. Anything that depends on noticing the attack while it happens has already missed its window.

This is what separates protection that holds from protection that merely looks thorough. A rule that says check the address carefully every time relies on attention that a tired person will eventually fail to give. A rule that keeps a new withdrawal address inactive for a set number of hours relies on nothing of the kind, and keeps working exactly when attention has already failed.

The measures below are grouped around that difference. Some decide who holds the funds before there is any incident to react to. Others assume the phrase or the password is already known to somebody else, and ask what still stands in an attacker's way. None of them depend on becoming a more careful person under pressure.

02Splitting custody on purpose

Funds on an exchange are subject to that platform's own decisions. An account can be frozen during a security review, a withdrawal delayed pending checks, and if the platform itself fails, the funds sit inside whatever process follows. This is simply the nature of holding an asset inside somebody else's system. Roughly half of all the losses reported to the FBI's Internet Crime Complaint Center in 2025 were connected to cryptocurrency in some way, which is why the custody decision carries unusual weight here.

Funds in a self custody wallet answer to nobody but the holder of the recovery phrase. There is no support desk to call if the phrase is lost, no password reset that restores access, and no institution standing behind the balance if a device fails at the wrong moment. Independence removes every safety net an exchange provides.

Most people who think this through arrive at a split rather than a single choice. What is actively traded stays where it moves quickly, typically an exchange account with its own protections layered on top. What is not touched for months moves to self custody, where the absence of a support desk stops mattering because nothing is being actively managed. The split, made on purpose, is itself a form of protection.

Crypto wallet protections ordered by what they cost to set up and what they stop
MeasureTime to set upWhat it stops
Custody split between exchange and self custodyOne eveningTotal loss to a single platform freeze or failure
Offline recovery phrase, stored in more than one placeFifteen minutesDevice loss, malware, a compromised cloud account
A test restore of the wallet from the phraseFifteen minutesA transcription error nobody has caught yet
Withdrawal whitelistTen minutesA withdrawal to a new address after account takeover
Delay window on newly added addressesTwo minutesGives the owner time to notice and revoke
Hardware security key on the recovery mailboxTwenty minutesPhishing pages and intercepted one-time codes
Backup codes stored away from the phoneTen minutesLoss of the phone or a SIM swap
Annual review of contact details and device listFifteen minutes a yearConfiguration drift nobody noticed

03The recovery phrase is the whole asset

A password can be reset. A recovery phrase cannot, and that difference changes how it has to be treated. The phrase is a complete, portable copy of the key that controls the funds, and anyone who reads the words, in order, owns whatever the wallet holds. There is no separate account or service standing behind it that could verify identity and issue a replacement. Losing it, or letting somebody else read it, is final in a way a forgotten password never is.

The storage medium matters more than most people assume. A phrase kept in a note application syncs to a cloud account that can be reached without ever touching the phone or the wallet, and paper survives most handling but not a fire, a flood or years of wear. It is never typed into a page, a form or a chat regardless of how the request is framed, whether that request comes from a fake wallet app, a cloned support chat or a page claiming the wallet needs restoring. No genuine service ever needs to see it.

A phrase that has never been tested rests on an assumption that the words were copied correctly, in order, without a slip. The only way to know for certain is to restore a wallet from it on a separate device before the balance grows large enough for a mistake to matter. A transcription error found there costs nothing. Found later, it costs everything the phrase protected.

04Why a voice on the phone proves nothing

A phone call from someone who sounds exactly like a colleague, a relative or a support agent used to be reasonably strong evidence the call was genuine. That assumption no longer holds, and any protection built on top of it inherits the same weakness. Voice cloning is the reason, and the numbers behind it are worth stating plainly.

A convincing clone can now be produced from roughly three seconds of recorded audio and reaches about 85 per cent accuracy against the original. In a listening experiment, people distinguishing a real voice from a cloned one got it right only 37.5 per cent of the time, worse than simple chance. Voice phishing built on cloned audio grew by 1,633 per cent in a single quarter in the data tracked on this trend, and call center fraud generally produced more than 80,000 complaints and over 2.9 billion dollars in the FBI's 2025 figures.

The consequence for wallet protection is specific. Any step completed because someone on the phone sounded right, whether that is reading out a code, approving a device, or adding a withdrawal address after a convincing call, rests on a signal that no longer distinguishes an attacker from a genuine contact. What holds instead are measures that never ask a human to make that judgment at all.

05The pair that changes outcomes after a breach: whitelist and delay

Where a platform offers a list of approved withdrawal addresses alongside a waiting period on newly added ones, the two work best enabled together. The whitelist stops a withdrawal from reaching anywhere except an already approved destination. The delay stops a freshly added destination from receiving anything until a fixed number of hours has passed, regardless of who added it or how.

The value is easiest to see by assuming the worst has already happened. An attacker with the password, the second factor and full access still cannot move funds anywhere new the moment they arrive, because the address they add sits in the same waiting period as everyone else's. That period is the window in which a notification reaches the owner, who has time to see it and revoke the address before it can be used.

This is also the layer that survives the voice cloning problem, because it never depends on anyone judging whether a call sounded genuine. An attacker who talks a target into adding an address over the phone still waits out the same delay as one who stole the password directly. Setting both up takes minutes on a platform that supports them.

06Replacing a code with a hardware key

A one-time code sent by text or generated in an app proves only that whoever is logging in has that phone or app open at that moment. It says nothing about which website they typed the code into. A page built to look identical to the real login screen collects the password and the code in the same few seconds and passes them straight through, and a freshly generated code does not stop this.

A hardware security key does not share this weakness, because the approval it produces is tied to the actual address of the site requesting it, checked by the browser rather than by the person looking at the screen. A copy of the login page, however convincing, runs on a different address, and the key simply declines to respond to it. This removes the one step that depended on a person reading a web address correctly under pressure.

None of this decides what should be approved in the first place. A hardware key signs whatever request sits in front of it, so a malicious permission dressed as a routine confirmation still gets signed if the owner approves without reading it. Because the same weakness in codes reaches email and exchange logins too, a key earns its cost fastest on the recovery mailbox.

07The account recovery surface attackers actually use

Very few thefts begin with someone breaking the wallet's own security directly. It is far easier to reach the accounts around it, the email that receives password reset links and the phone number that receives recovery codes, because compromising either one can unlock everything downstream without touching the wallet's actual defenses. Attackers optimise for success rather than difficulty, and the recovery surface is simply where the easier path lies.

A phone number sits inside a mobile provider's system, and moving it to a new SIM card is a support decision made by a call center agent following a script. An attacker with enough personal detail to sound convincing to that agent can have the number transferred, after which every text code meant for the real owner arrives on a device they never touched. No wallet setting changes this.

A recovery mailbox tells a similar story. Many people set up an exchange account years ago using whichever address was current then, and that mailbox has since become secondary, checked rarely and protected with an older password. In the FBI's 2025 figures, people aged 60 and over lost an average of 38,501 dollars per complaint against 20,699 dollars overall, and a recovery surface nobody has revisited in years is exactly the gap a patient attacker looks for.

08Why most attempts fail, and what that implies

It is easy to read about these attacks and assume contact from an attacker is close to a guaranteed loss. The reported figures say otherwise, and the gap between attempts and successes is where the measures already described actually do their work. That gap is worth looking at directly before drawing any conclusion about what a single measure needs to achieve.

Among the imposter complaints the FTC tracked in 2025, four out of five involved no financial loss at all. Most of that gap comes down to targets who recognized the approach, hit a piece of friction that stopped them, or simply were not in a position to act at that moment. Attackers rely on volume precisely because most individual attempts go nowhere.

The typical loss where a scheme did succeed was around 700 dollars, a figure driven mostly by cases with no crypto holdings at all. A crypto wallet changes that arithmetic, since a single transfer can run far beyond that amount and cannot be reversed once it clears. None of the measures here need to defeat a determined attacker in isolation, only the much larger number of opportunistic attempts counting on a hurried response.

09The last line and the annual review

Backup codes printed and stored away from the device solve a problem nothing else here solves cleanly. They work without a phone in hand and without a network connection, which matters exactly in the SIM swap scenario above, where the phone number itself has become the attacker's tool. A code on paper cannot be redirected to a different SIM.

An annual review checks specific, concrete things. The contact number on file gets checked against the number actually in use, and the recovery mailbox gets opened and confirmed still reachable. The stored backup codes get checked against what the account expects, and the list of devices with standing access gets read line by line for anything unrecognised.

Once a year is enough, because none of this drifts quickly. A phone number changes every few years for most people, and a device authorized months ago and then forgotten simply sits there until somebody checks. This is the structure Ilia Zavialov keeps returning to: which few decisions, made in advance, still hold on the day one of them is tested for real.

10Questions and answers

Where should I store a crypto wallet recovery phrase?

Somewhere offline that does not synchronise to any account and is not photographed, kept in more than one location so a single fire or theft cannot end it. It should also be tested once by restoring a wallet from it, since an untested phrase is only an assumption about what the words say.

Does a withdrawal whitelist still help if my account is already hacked?

Yes, and that is exactly when it matters most. An attacker with full access still has to add a new address and wait out the delay period attached to it, which gives the owner time to see the notification and revoke it.

Is a hardware security key enough on its own to keep crypto safe?

It removes phishing pages and intercepted codes as a route in, because the approval it produces only works on the genuine site. Reading what a request actually grants before approving it still remains the owner's job, since the key signs whatever is placed in front of it.

Can a phone call really be faked well enough to fool me?

Yes. A convincing voice clone can now be produced from about three seconds of audio, and in a listening test people told a real voice from a cloned one correctly only 37.5 per cent of the time.

What does a withdrawal delay window actually do?

It keeps a newly added withdrawal address from being usable until a set number of hours have passed, regardless of how the address was added. That gap is what lets the account owner notice an unfamiliar address and remove it before anything can be sent to it.

How often should I review my crypto account security?

Once a year is enough for most of what matters, since a phone number, a device list or a recovery mailbox rarely changes faster than that. The review should confirm the current contact number, check that the recovery mailbox is still reachable, and read through the list of devices with standing access.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

11Read next

Back to the blog