# Security for the Rest of Us By [Lista DAO](https://blog.lista.org) · 2026-08-17 --- The wisteria was gone. In the two weeks before this meetup, the long pale clusters had dropped, browned, and been swept up by the park's groundskeepers, and the wall where they had hung was now bare green. The hydrangeas were beginning to come in, fat blue buds tightening at the tips of the bushes. The temperature had climbed by ten degrees in a week. Tokyo had the soft, slightly damp warmth of early summer, and Dev - for the first time in months - had taken his coat off entirely and was wearing a t-shirt in an aggressive shade of orange. Moolah had asked us to bring our phones and our laptops and, if we had them, our hardware wallets. "Today," she said, when we sat down at the bench, "we are going to do something I have been planning for several weeks. I am going to audit both of your security setups. In front of each other. With as little judgment as I can manage. And we will fix what is broken. Because you have now learned six chapters of disasters, and I want to make sure that none of them happen to you." Dev sat up slightly straighter. "You should be nervous," she added, not unkindly. * * * She started with me. "Priya. Open your wallet on your phone. Do not show me the seed phrase. Just the wallet. Tell me what's in it." I opened the app. "About three hundred dollars in stablecoins. A small amount of ether. The receipt for a deposit I made on a lending protocol last month. That's it." "And where else do you have funds?" "Nowhere. That's everything." "Good. First test passed. You haven't accumulated funds in five different wallets and lost track of which one has what. Most users fail this test. Continue. Where is your seed phrase stored?" "In the notebook. Hand-written. The notebook is in a small fireproof box at my apartment. The box is bolted to the floor of a closet." "Backup?" "There's a second copy. Hand-written. In a sealed envelope at my parents' house. They don't know what it is. They've been told it's important paperwork to be opened only if I die or am incapacitated." Moolah's whiskers twitched. "I have heard worse plans. Continue. Do you have a hardware wallet?" "No." "Why not?" "Because the amount of money I'm dealing with doesn't seem to justify it. A hardware wallet is, what, a hundred dollars? My total exposure is three hundred. I'd be paying a third of my position to protect the rest." "That math is not crazy. But let me make a counter-argument." She settled in. "A hot wallet - a wallet on your phone or computer - is connected to the internet, all the time. Every malicious website you visit, every malicious app you install, every browser extension you forget you have, is one careless moment away from accessing it. The keys are stored in your device's memory. Sophisticated malware can extract them. It is not common. It is also not impossible. The probability of any single user being targeted is low. The cost, if it happens, is total." "And a hardware wallet?" "A hardware wallet is a small physical device - looks like a USB stick, often - that holds your keys _offline_. The keys never leave the device. When you want to sign a transaction, your phone sends the unsigned transaction to the device, the device signs it internally without ever exposing the keys, and sends back the signed transaction. The keys live on the device, in a secure chip, behind a PIN you have to enter physically. To steal funds from a hardware wallet, an attacker would need physical access to the device _and_ knowledge of your PIN. That is a much higher bar than the hot wallet's bar of _anyone-with-malware-on-your-machine._" "And it's worth a hundred dollars?" "At three hundred dollars of exposure, perhaps not. At three thousand, certainly. At thirty thousand, _absolutely._ My recommendation: get a hardware wallet now, while your balance is small, and learn to use it before you have anything significant on it. Mistakes are cheap when there is little at stake. They are catastrophic when there is much. Your future self will be grateful." I wrote it down. _Hardware wallet ≠ luxury. Practice with it cheap before you need it expensive._ "Final question," Moolah said. "When you signed your first swap, in Episode Eight, you approved the smart contract to spend a certain amount of your USDC. Do you remember that?" "Vaguely." "Open this site." She gestured at my screen and recited a URL. I opened it. The page connected to my wallet and showed me a list of every smart contract I had ever granted spending permission to over the months I had been using DeFi. The list was longer than I had expected. Twenty-three contracts. "Read me the top one." "It says - _unlimited approval for USDC, granted to -_" I read the contract address. "That contract is the swap router you used in Episode Eight. You granted it _unlimited_ approval to move USDC from your wallet. Every swap you have done since has used that approval. The convenience is real - you don't have to re-approve for every trade. The risk is also real - if that contract is ever exploited, an attacker can drain every USDC in your wallet, up to your full balance, in a single transaction. The approval has no expiration. It will sit there until you revoke it." "Should I revoke it?" "Revoke any approvals you don't actively need. For approvals you do need, set them to _limited_ amounts - only the size of the trade you are about to do - rather than unlimited. Most wallets default to unlimited for convenience. Convenience is, in security, almost always the enemy. A limited approval costs slightly more gas but immeasurably less risk." I started clicking through, revoking the approvals I had forgotten existed. The list shrank from twenty-three to four. "Approval hygiene," Moolah said. "Most users never do this. They have hundreds of forgotten approvals from years ago, sitting on their wallets, each one a small unlocked door. The doors are mostly safe. Until they are not. The Curve weekend involved several vulnerabilities being chained - and one of the vulnerabilities the white-hats raced to address was that vulnerable contracts had unlimited approvals from millions of users, who were exposed to the bug whether they had used the protocol recently or not. _Approval is a standing invitation_. Take back the ones you no longer mean." I underlined that. _Approval is a standing invitation._ She turned to Dev. He visibly braced. * * * "Phone," she said. He handed her the phone. She did not, of course, take it - she was an otter - but she looked at the screen as he scrolled. "Open your wallet. How much is in it?" "Uh - about eight thousand dollars across various -" "Show me." He scrolled. He named a number, then another, then a third. He had wallets across four different chains. Some of them he had not opened in months. He was not entirely sure which wallet had what. Moolah was very quiet. "Where is the seed phrase for your main wallet?" "In a password manager." "Encrypted?" "Yes." "What's the password to the password manager?" He told us, in the tone of a man confessing to a crime. It was a password he had been using since college. It contained the name of his first dog. It contained his year of birth. It was, by any reasonable standard, a password that could be guessed by anyone who had spent twenty minutes reading his social media. Moolah did not say anything. "It's only the password manager," he said weakly. "The actual wallet has a separate password." "What's the wallet password?" He confessed, with even less strength in his voice, that it was the password manager password with a 1 added to the end. I looked at my hands. I did not feel like making eye contact with anyone. "Hardware wallet?" Moolah said. "I bought one. Two years ago. I haven't actually moved anything to it yet. It's in a drawer." "Is it set up?" "I - set it up, generated the seed phrase, then I just kept using the hot wallet because moving stuff over felt like a hassle -" "Where is the seed phrase?" "It's a piece of paper. It's in the drawer. With the device." The silence that followed was, I think, the longest I had ever experienced in Moolah's company. When she finally spoke, her voice was the same gentle voice she had used in the Yanaka bar two months ago, the voice she used when she was trying to be kind about something terrible. "Dev. I want you to listen to me carefully. Because I am about to describe to you, in order, the security situation you have built for yourself, and I want you to hear it the way I am hearing it. You have eight thousand dollars across several chains, in hot wallets, on a phone you carry around in public. The seed phrase to your main wallet is in a password manager whose password is guessable from your social media. You bought a hardware wallet which is sitting unused in a drawer, in the same drawer as the seed phrase, which is on a piece of paper, exposed, with no copy, no backup, and no protection. If your apartment is robbed, the thief can drain your entire wallet. If your phone is stolen and the thief is competent, they can drain your entire wallet within the hour. If a phishing attack catches you on a tired afternoon, you can drain your own wallet by signing a malicious transaction without realizing what you are doing. Every single one of the disasters I told you about over the last six weeks would have been preventable for you, with adequate preparation, that you have not done. You are _not safe_." Dev said nothing. "This is not a moral failing," Moolah said, more gently. "It is the most common security profile in this entire industry. Most users are exactly here. Most users have not been audited like this and, accordingly, do not know how exposed they are. Today is the day you find out. Tomorrow should be the day you fix it." "Okay." "Tell me what you are going to do this week." He took a long breath. "Move funds off the phone. Onto the hardware wallet. Set up a new seed phrase - fresh, generated on the device, never typed into any computer. Write it on paper. Make a second copy on paper. Store them in two separate physical locations. One at home, in a fireproof box. One - somewhere else. My parents' house. A bank deposit box. Somewhere not my apartment." "Good." "Generate a new password for the password manager. A long one. Random. Don't use anything related to me. Use the password manager's built-in generator. Write that password down on paper, too - separately - and store it the same way as the seed phrase. Different location." "Good." "Stop using the same password across services. Let the password manager generate unique long ones for everything." "Good." "Revoke every approval I don't actively need." "Good." "And - never download a PDF from a stranger's job offer." Moolah's whiskers twitched. "That, too. Good." I had been writing all of this down. The list became, over the next ten minutes, a checklist that ran for two pages of my notebook. Moolah added items I had not thought of. _Never enter your seed phrase into a website, ever, for any reason. The official wallet apps do not ask for it. If anyone asks, they are an attacker._ _Never sign a transaction whose details you do not understand. Read what you are signing. If your wallet says it is granting unlimited approval to a contract you do not recognize, stop. If your wallet says you are signing a message instead of a transaction, stop - message-signing exploits are increasingly common._ _Use a different browser, on a different machine, for high-value transactions, if you can. Disable browser extensions on the machine you use for trading._ _Don't click links in DMs. Don't click links in tweets. Don't click links in emails. If you must click a link, type the destination URL into the browser yourself, by hand._ _If a website you've used a hundred times suddenly looks slightly different, stop. The most successful phishing attacks are pixel-perfect copies of the real site, served from a domain that differs by one letter._ The list grew. The summer afternoon grew long. By the time we were done, Dev's posture had changed. He looked, somehow, both more tired and more awake. "That's a lot," I said. "It's the whole defensive curriculum," Moolah said. "Most of it can be done in a single weekend. Most users never do it. The ones who do - even partially - are dramatically less likely to lose anything. The threat model in DeFi is real. The defenses are real. Both are knowable. The gap between _knowing_ and _doing_ is the gap that has cost most of the people I've watched lose money over the years. Do not be in that gap." We sat for a while in silence. The hydrangeas at the edge of the path were almost open. A bee landed on one of the buds, considered it, and moved on. "There is one more thing I want to say," Moolah said, after a while. "Security is an ongoing practice. You will not, after this weekend, be permanently safe. You will be, for a while, less exposed than you were. New threats will appear. New defenses will be needed. The wallets you trust today may have vulnerabilities tomorrow. The protocols you use today may be hacked next year. The work is ongoing. Set yourself a calendar reminder, every six months, to do exactly what we did today. Audit your wallets. Revoke unused approvals. Check that your seed phrase backups are still where you think they are. Update the software on your hardware wallet. The half-hour you spend, twice a year, doing this, will be the most valuable time you spend on this hobby. The people who do this, mostly, do not become victims of the disasters I told you about. The people who do not, mostly, eventually do." I wrote in the notebook, in capital letters: _SECURITY IS AN ONGOING PRACTICE._ Underneath, I added: _every six months. set the reminder._ "Same place next week?" Dev asked. "Yes." Moolah looked at her empty cup. "Next week we talk about lawyers. And tax notices. And the long, slow attempt by various governments around the world to figure out what to do with all of this. You will, both of you, hate it. It is also necessary. Bring patience." "Have you already gotten a tax notice?" I asked Dev. He sighed. "I have a feeling," he said, "that next week's lesson is going to be specifically tailored to me." "Most of them are," I said. "That's because most of them need to be," Moolah said, very kindly, and slipped off the bench and padded toward the pond. Halfway there she paused, turned back, and said: "Dev." "Yes." "You are going to be fine. The fact that you can hear what I just told you and respond by writing a checklist instead of getting defensive - that is the whole game. Most people get defensive. You did not. That is the difference between someone who survives this industry and someone who does not. I am genuinely proud of you." He blinked at her. She slipped into the water. He sat there for a long time afterward, just looking at where she had gone. * * * _Next: Rules and Referees_ --- *Originally published on [Lista DAO](https://blog.lista.org/security-for-the-rest-of-us)*