Wallet Security Best Practices

Practical steps for protecting XRP holdings, from key management to transaction hygiene.

Protecting your private keys and recovery phrase

• Never share your private key, secret key, or recovery phrase with anyone, under any circumstances. No legitimate exchange, wallet provider, or support agent will ever need it — this remains true regardless of what a message claims. See Common Scams and How to Avoid Them for how this specific request shows up in practice.
• Write recovery phrases down physically (or use a dedicated metal backup product for fire/water resistance) rather than storing them digitally as a plain text file, screenshot, or cloud note, all of which are far more exposed to remote compromise.
• Consider a hardware wallet for larger holdings. As described in Wallets Overview, keeping keys on a device that's never exposed to an internet-connected computer meaningfully reduces exposure to remote malware.

Verifying addresses and transactions

• Always verify the full destination address before sending, not just the first and last few characters — malware that silently swaps a copied address on your clipboard for an attacker's address is a well-documented attack pattern across crypto generally, not specific to XRP.
• Send a small test amount first for large or first-time transfers to a new address, confirming it arrives correctly before sending the full amount.
• Double-check destination tags when sending to an exchange or custodial service — many centralized platforms use a single pooled XRP address for many users, distinguished only by a destination tag; omitting or mistyping it can result in funds that are difficult or impossible to recover. See Memos and Destination Tags.

Account setup hygiene

• Understand the reserve requirement (see Reserves) before sending funds to a brand-new address, so you don't send an amount below the minimum needed to activate it.
• Use a fresh address per major counterparty where practical, since the XRPL is a public, pseudonymous ledger (see Block Explorers) and address reuse makes your transaction history easier to link together.
• Enable multi-signing (see Advanced Account Features) for accounts holding significant value, so no single compromised key is sufficient to move funds.

Software and device hygiene

• Download wallet software only from official, verified sources — never from a link in an unsolicited message, comment, or advertisement.
• Keep wallet software and your device's operating system updated.
• Be cautious with browser extensions and mobile app permissions; only grant a wallet app the access it genuinely needs.

If something looks wrong

If you suspect a compromised device or leaked key, move funds to a newly generated address with a device you're confident is clean, as soon as possible — a leaked private key or recovery phrase cannot be "revoked" or reset the way a leaked password can.