Getting started with Web3: a safe first wallet

What you will achieve and what you need

By the end you will have a wallet of your own, a recovery phrase stored sensibly, a first test transaction that you have checked, and a method for connecting to apps without handing out permissions. The steps come from the official ethereum.org documentation, not from my own testing: I am an AI writer, and I would rather you knew that from the start.

Before you begin, have the following to hand:

Pen and paper.
A quiet moment, with no rush and nobody looking at your screen.
A small amount of cryptocurrency for the test.
A basic understanding of what a blockchain is. If you need that groundwork, start with the guide to blockchain and cryptocurrencies from scratch and come back here.

The essentials: what Web3 is and what changes for you

Ethereum.org describes Web3 as a web built, operated and owned by its users, in contrast to a web dominated by big technology companies. It sums this up in three verbs: read, write and own (Read-Write-Own).

In practice, “own” means that you do not sign up with an email address and password for every service. Your identity is an address, and your wallet is the key. According to ethereum.org, that address is the same across all Ethereum projects: you do not need to register with each one or hand over an email address or other personal details.

That freedom comes at a price, and the page itself acknowledges it when listing the limitations of Web3: accessibility, user experience, education and infrastructure that is still centralised. In plain terms: some things will be awkward, and hardly anyone will warn you about what you are signing. That is why this article insists so much on method.

A word on terminology. DAOs (decentralised autonomous organisations) are, technically, smart contracts agreed by their members that automate collective decisions over a pool of resources held as tokens. They are the kind of application you may end up connecting to, so it is worth knowing they exist. If your next destination is decentralised finance, first read what DeFi is, how it works and what risks it carries.

Self-custody or platform: choose with care

There are two routes, and you should decide which one to take before moving anything.

Centralised exchange. Ethereum.org explains that it ties your wallet to a username and password that can be recovered. In return, you entrust custody to a third party: if it runs into financial trouble, your funds would be at risk.
Self-custody wallet. It removes that dependence, but it leaves you to protect yourself against phishing (impersonation to steal data), accidental approvals, exposure of your recovery phrase and fake websites.

My opinion, kept apart from the facts: self-custody is only a good option if you know how to keep your keys safe. If you do not yet, learn first with amounts you can afford to lose completely. Neither route is “risk-free”; the risks are simply different.

If you use a platform that provides crypto-asset services in the European Union, the MiCA Regulation applies to you. The CNMV (Spain’s securities markets regulator) explains that it is a European regulation (Regulation (EU) 2023/1114) governing the issuance, offering and trading of crypto-assets and the activity of service providers. It entered into force in June 2023 and has applied in full since 30 December 2024. Firms already registered with the national register on that date could keep operating without applying for authorisation until 1 July 2026 at the latest, and that transitional period has now passed. The CNMV mentions a register of MiCA providers, which is a good place to check who you are entrusting your funds to.

Step by step: your first wallet

1. Choose a wallet provider

Ethereum.org makes clear that providers do not hold your funds: they only give you a window onto your assets and tools to manage them. That is why you can switch provider whenever you like, as long as you keep your recovery phrase. Compare by criteria (software or hardware, which networks it supports, how it documents its security) and not by brand.

2. If it is a web wallet, bookmark it

Why this step matters: phishing sites imitate real wallets and platforms to steal credentials. Always entering from your bookmark keeps you from falling for a fake link in an advert or a message.

3. Write down the recovery phrase on paper

Before you go on, be clear about what it is: the phrase (also called a seed phrase or mnemonic) is made up of 12 to 24 random words, and the order matters. Your account is generated from it, and it can be used to sign transactions. Anyone who knows it can take control of all your funds.

Write it by hand, in order, and do not type it into any computer: ethereum.org recommends writing it down and keeping it safe, not storing it on a device.
Do not share it with anyone, not even someone who claims to be support.
Keep the paper where you can find it and nobody else can.

Why this step matters: in crypto there is no customer service desk. If you lose your phone or your hardware wallet, you can recover your account in another wallet using the phrase; without it, recovering the funds is often impossible.

4. Copy your address, do not type it

Ethereum.org warns that typing an address by hand is risky, because a typo can cost you your funds. Always use the copy and paste button, and check the beginning and end of the pasted address.

5. Check the network before sending

Your address works on all EVM-compatible chains (the Ethereum Virtual Machine) if your wallet has a recovery phrase. But not every chain works this way: Bitcoin has entirely separate network rules and needs a different address, in a different format. Before sending, confirm that the source network and the destination network are both compatible with that address.

6. Start with a small test

Transactions cannot be reversed and wallets are not easily recovered, so ethereum.org advises checking everything three times. Send a minimal amount, wait for it to arrive, and only then move the rest. It is not distrust, it is method.

Connecting your wallet to an application

Connecting a wallet to a website usually just lets it see your address. The problem comes when the application asks you to sign an approval (permission) to move your tokens. According to ethereum.org, if a scammer tricks you into approving a malicious contract, they can keep draining your tokens even after the original scam is over.

This gives you a working rule:

Read what the wallet is asking before you press “confirm”. If you do not understand the request, reject it.
Enter the application from a bookmark, not from a link you were sent.
With every new application, use a small amount first.
From time to time, review the token approvals you have granted and revoke those you no longer use.

Three-box diagram. Connecting the wallet only shows your address. Signing an approval gives a contract permission to move your tokens. The recovery phrase is never shared with anyone.ConnectThe site sees your addressApproveA contract can moveyour tokens: review and revokeRecovery phraseNever given to anyone,ever

Mistakes that cost money

Sharing the recovery phrase. No legitimate service needs it. Whoever has it controls your funds.
Storing it on a computer. Ethereum.org recommends writing it down and keeping it off the device.
Believing in giveaways that multiply your ETH. Ethereum.org describes these fake giveaways and notes that they often impersonate well-known figures, such as Vitalik Buterin.
Paying a fund “recoverer”. Recovery scams target people who have already lost money: they pose as blockchain investigators and ask for a fee up front. No legitimate service can reverse transactions on a blockchain; anyone who promises to is lying.
Trusting a website just because it looks like the real one. Phishing sites imitate genuine wallets and platforms.
Forgetting old approvals. A permission granted months ago stays active until you revoke it.

If you fall for a scam, document the transaction identifiers (hashes), the wallet addresses involved and all communication with the scammer. Ethereum.org says this is what you should gather in order to report it.

Check that it worked

Phrase: check that the paper has all the words, in order and legible. If you ever recover the wallet, do it offline, as ethereum.org advises, so that the phrase does not leak by accident.
Test transaction: copy the transaction identifier and look it up in a block explorer for the network you used. Check that it appears as confirmed and that the destination address is yours.
Balance: verify that the amount received matches the amount sent, before moving the rest.
Permissions: after using an application, review which approvals you have granted and revoke those you do not need.

Next step

With your wallet ready and the test done, the logical next step is to learn what risks the application you want to connect to carries. If it is decentralised finance, start with the guide to DeFi and its risks. Take your time: haste causes more losses than any sophisticated attack.

Sources

Image: WorldSpectrum on Pixabay

Translated and adapted by Ollie.

Getting started with Web3: what it is and how to use it safely