How to create a crypto wallet and not hand it to a scammer

Learning how to create a crypto wallet takes about ten minutes, and almost every guide stops there. The part that decides whether you still have the wallet in six months is everything after those ten minutes, and I have watched that part go wrong from an unusual seat. I run community for Syndicate, an airdrop tracker, and in August somebody took over our Discord, gave themselves an admin role, and pushed a fake token claim at just under thirteen thousand members. I spent the following days reading the audit log and tracing the drainer's wallets across six chains, which is a strange way to learn wallet security and a very effective one.

So this is both halves. First the setup, because you need a wallet before anything else matters, and then what actually came for ours, with the numbers attached.

What is a crypto wallet, custodial vs non custodial?

A crypto wallet doesn't hold your coins, it holds the key that proves the coins are yours, and the coins themselves sit on a public ledger that everyone can read. In 2025, crypto scams received at least $14 billion on-chain according to Chainalysis in its 2026 Crypto Crime Report, published January 2026, and almost none of that was recovered, because a ledger that nobody controls is also a ledger nobody can roll back for you.

That single fact drives every recommendation below. When your bank card is stolen you call the bank, and somebody on the other end can freeze the card and reverse the charge, because the bank is the system of record and it can change its own mind. A wallet has no such office. The key is the ownership, so whoever holds the key owns the money, and that is the entire security model.

Wallets split into two kinds, and the difference matters more than the brand names:

	Custodial	Non-custodial
Who holds the key	The company (an exchange like Coinbase or Binance)	You
How you log in	Email and password, with support and password reset	Your 12 or 24 recovery words, no reset
If you lose access	Recoverable through support	Gone permanently
If they freeze or fail	Your funds are frozen with them	Unaffected
What most guides mean by "crypto wallet"	No	Yes

An exchange account is a convenient place to buy your first coins and a bad place to keep them, because you're trusting a company. A non-custodial wallet hands you full control and the full consequences of it. For airdrops and anything on-chain you need the second kind, so that's what the steps below set up. Governments can close that door as well: in October 2026 the Bank of Russia barred transfers from regulated accounts to personal wallets, which I broke down in what the Russia self custody ban actually says.

How to create a crypto wallet, step by step

Nine steps, about ten minutes, and the whole thing is free. The two steps people skip are 5 and 6, and those are the two that decide whether the wallet survives.

#	Step	Time	What it actually gets you
1	Pick one well-known wallet. MetaMask, Rabby, or Phantom for Solana	2 min	The app is the most dangerous decision here. Fake wallet apps reach app stores regularly
2	Install it only from the official site, typed by hand, or a store link found from that site	2 min	Never install a wallet from a search ad, a DM, or a QR code. This is the single most-abused install path
3	Choose "create a new wallet", not "import"	10 sec	Import is for a wallet you already own. Anyone telling you to import their words is giving you a wallet they can empty
4	Set a password for the app	1 min	This only locks the app on this device. It is not your wallet and it recovers nothing
5	Write the 12 or 24 recovery words (the seed phrase) on paper, in order, by hand	3 min	This is the wallet. Paper has no cloud, no screenshot folder, and no clipboard
6	Confirm the words, then delete every digital trace you made of them	1 min	No photo, no notes app, no password manager on an internet-connected phone, no email to yourself
7	Copy your public address and check it reads the same as the app shows	30 sec	The public address is safe to share. It starts 0x on Ethereum chains and is 42 characters long
8	Send a tiny test amount first, $1 or $2, and confirm it arrives	2 min	Cheap insurance against a wrong address or a wrong network
9	Only then send anything you'd mind losing

Writing the recovery words on paper, step 5, is the one worth slowing down for. Those twelve or twenty-four words are called your seed phrase, and they are a full mathematical description of the wallet, so anyone who reads them can rebuild it on their own device, in another country, without your phone and without your password. That's why nobody legitimate will ever ask for them, and why every request for them is the same request regardless of how it's dressed.

Hot wallet vs cold wallet, and the burner in between

A hot wallet is a browser extension or phone app that stays connected and signs transactions all day, while a cold wallet is a hardware device that keeps the key offline and signs without ever exposing it. Those three wallet types, counting the burner below, cover almost every real need, and the useful way to sort them is by what you'd lose if that particular wallet were emptied tonight.

Being permanently connected is what makes the hot wallet both the convenient one and the one that gets drained, so it should hold spending money and nothing more. The cold wallet becomes worth buying once your holdings are worth more than the device itself, usually somewhere between $50 and $150, and you should buy it from the manufacturer rather than secondhand, because a resold device can arrive with somebody else's recovery words already loaded into it.

A burner wallet sits between the two. It's a throwaway hot wallet holding almost nothing, which you point at minting, testnets, and anything unfamiliar, on the understanding that if it gets drained you've lost pocket change and learned something cheaply.

The burner is the one beginners in airdrop farming reach for, usually after reading that more wallets means more chances at a drop. Our own data says otherwise, and I mean our own literally: across Syndicate's Farming Season marathon in 2026, with 1,164 registered participants, the weekly sybil sweeps I run found one burner wallet submitted as the farming address of six different accounts, and another on five. Eleven accounts inside a single 84-account cluster were provably one person on the wallet evidence alone, before we looked at anything else.

So a burner protects you from a malicious contract, and it does nothing to hide you from a project deciding who gets paid. If you want the detail on what those filters see, I wrote up what sybil detection actually catches from the operator's side, and the same logic is why wallet score airdrops reward a single wallet with real history over a dozen clean-looking ones.

A valid address can still be a hole in the ground

An address that passes every format check can still be somewhere your money cannot come back from, most often because it belongs to a token contract rather than a person, or because it is a lookalike planted in your transaction history by an attacker. Neither of these is hypothetical, and we have hit the first one in our own data. Two unrelated participants set their payout address to 0xdAC17F958D2ee523a2206206994597C13D831ec7, which is not a wallet at all, but the USDT token contract, sitting at the top of every Tether page on every block explorer, one copy button away from the address field it doesn't belong in.

Nobody holds the private key to a token contract, so a payout sent there is simply gone, and our address validation waved it through because a contract address is a perfectly valid, correctly checksummed address. Two separate people made the identical mistake, which told us it was a copy-paste off a token page rather than anything coordinated. One of them had it in both of their address fields.

Our finding at Syndicate, 2026: in a single base of 1,849 participants, two people independently pasted the Tether USDT contract address into a payout field, and our format check accepted it both times. Money sent to a token contract is unrecoverable, because no human holds its key.

The habit that prevents sending funds into a dead address costs three seconds: after pasting any address, read the first four characters and the last four, and compare them against the source. Do it every time, because there's an entire attack built on people not doing it. Address poisoning drops transactions into your history from an address that matches yours in exactly those first and last characters, differing only in the middle, betting that you'll copy the wrong line out of your own transaction list. Nobody reads the middle.

The quieter version of this problem is having no wallet at all. In one recent Inner Circle payout run we paid 72 people and held 8, and those 8 weren't skipped for anything they did, they simply had no wallet linked. In a raffle the month before, 54 of 60 winners were paid and 6 weren't, because where their address should have been the file had a dash, and their share of the pool sat in our wallet waiting for them to send one. Winning and being payable are different things.

What does a Discord crypto scam actually look like?

On 19 August 2026 somebody used a compromised admin account on Syndicate's Discord and needed 67 seconds. In that window they created a role, named it "Dyno" after the well-known public moderation bot so it would read as ordinary furniture in the role list, raised its permissions to full Administrator, and planted a webhook in our announcements channel. Then they stopped, and that fake admin role sat in our server untouched for 60 hours, because Discord doesn't notify anyone when an administrator role is created.

I want to be precise about what we know, because this is where incident write-ups usually start guessing. Discord's audit log records what an account did rather than how it came to be doing it, and it carries no session, login or address data at all. So we can walk you through those 67 seconds in detail, and we still cannot tell you how the account was taken.

Two days later, on the evening of 21 August 2026, the rest of it ran. A second fake role appeared carrying the name of our real admin role. Four admins, including me, were stripped of the Verified role that gates half our channels. The hijacked bot then handed Verified to 5,410 accounts that had never earned it, which took our verification barrier from covering about 58% of the server to 99.9% of it, and a barrier that everyone is past is not a barrier.

Then came the detail I still think about. At 21:44 they created an AutoMod rule that blocked messages and applied a seven-day timeout, and the blocked words were the names and handles of the admin team, with the exemption lists left empty. Any member who tried to call for help by tagging an admin got their message swallowed and themselves muted for a week. It fired six times on five people, and it kept working through the night after the account that made it had already been banned, with its last two hits landing at 05:52 and 06:00 the next morning. Two members sat on week-long mutes purely for trying to report the attack, and we lifted those by hand.

The attacker went for the alarm before the vault, which is the detail I'd most want a beginner to notice, because any system where raising your hand is the thing that gets punished stays broken far longer than it should.

The fake airdrop arrived through a channel they already trusted

The phishing didn't arrive in Discord at all. We checked every channel and found no phishing messages, and our announcements channel held four messages across those four days, all posted by the team. What our members describe is a push notification, and their own words in the chat that night are the clearest evidence of the mechanism:

"I didn't know it was a scam, it came from the app afterall"

"I also got the notice on the app... I almost fell for the scam because I saw the notification on the app"

Discord's logs say nothing about how a push notification was delivered, so this rests on what members told us rather than on a forensic finding, and I'd rather say that plainly than dress it up. What the quotes do establish is that nobody was fooled by a clumsy message. They were fooled because of where the message turned up, and they said so themselves while it was still happening.

The link took them to sndcte.xyz/claims. Our real domain is sndct.app. One inserted letter and a different ending, which is enough, because nobody proofreads a domain they arrived at by tapping a notification about free money.

The same trick runs at smaller scale constantly. Two weeks later I got a DM myself, a friendly invitation that wanted me to verify through a bot at capLcha.bot rather than captcha.bot, where verifying means typing your Discord credentials into somebody else's form. A capital L standing in for a lowercase i is a single pixel of difference at chat font size. And during the takeover one of the accounts issuing commands was a clone of a real admin's handle with a full stop added to the end.

The anatomy of a $18.75 drain

One member came to us with a wallet address, which let me trace exactly what happened, and the total was $18.75. Small enough to be embarrassing and detailed enough to be the most useful thing in this article.

On Polygon, at 22:11 UTC, he approved a contract on the phishing site. He didn't send anything, he signed a permission, and a separate operator wallet used that permission to pull 2.7511 USDC out about a second later. The take was split instantly, 80% to one wallet and 20% to another, which is a revenue share, and I'll come back to what that implies.

Ten minutes later, on BSC, 16 USDT left the same wallet in an ordinary transfer that he sent himself. Here I have to stop short of the story you'd expect, because the chain cannot tell me which story it was. He may have been talked into sending funds "to unlock the claim", which is a standard second act, or he may have been moving money to safety after realising what happened. Both look identical on-chain, and I'd have to ask him to know.

The approval is the lesson here. The member never typed his recovery words, and nothing was hacked in any normal sense. He clicked a button in his own wallet confirming that he trusted a contract, and the contract then did exactly what he had permitted it to do. In 2025 this kind of signature phishing took $83.85 million from 106,106 victims, according to Scam Sniffer in Scam Sniffer 2025: Crypto Phishing Losses Fall 83% to $84 Million, published January 2026, and by recent standards that was a good year, down 83% from the $494 million the same researchers recorded for 2024.

The approvals on that wallet were later zeroed out, and the balances were already at zero, so there was nothing left to pull.

Who is actually on the other side

Drainer-as-a-service is the answer, and it describes a business where one crew writes and hosts the draining contracts while affiliates are paid a commission for bringing victims to them. That is what the 80/20 split in our member's transaction turned out to be. The 20% wallet is shared across many campaigns, the 80% goes to whichever affiliate supplied the audience, and neither of them needs to know anything about the community being hit.

The scale only becomes visible once you follow those collection wallets. Tracing them across six chains, the platform's fee wallet had received $202,884.90 in stablecoins from 406 separate addresses in the month between 23 July and 22 August 2026. The operator wallet had roughly 1,960 outgoing transactions, spread across Base, Ethereum, BSC, Arbitrum, Polygon and Optimism, and the largest single victim in that set lost $82,502 on Arbitrum, with no connection to us at all. Judging by the 20% share, the whole service moved somewhere near a million dollars in stablecoins during those four weeks, though I'd treat that as an estimate rather than a measurement.

And the affiliate who pointed it at us? That wallet had collected $278.30 in total, ever, from 37 addresses.

Our finding at Syndicate, August 2026: the campaign that hijacked our 12,948-member Discord was run by an affiliate whose lifetime earnings across all targets were $278.30, against the drainer platform's own $202,884.90 for that month. Nobody attacked us because we were valuable. They attacked us because attacking us was nearly free.

Being too small to be worth attacking is the assumption I'd most like a beginner to drop, because the economics of an affiliate model retire it completely: the marginal cost of aiming somebody else's drainer at one more community is close to nothing. In 2025, impersonation scams grew more than 1400% year over year with average payment sizes up over 600%, according to Chainalysis in its 2026 Crypto Crime Report, and copying a role name or adding a full stop to the end of a handle is about as cheap as impersonation gets.

The six ways it actually reaches you

Every loss I've watched came through one of these, and none of them required anybody to guess a password.

• A signature you approved, which is the most common and the least understood. The approve, permit and setApprovalForAll functions all grant a contract standing permission over your tokens, and the drain can arrive minutes or weeks after you sign. Read what your wallet says it's about to authorise, and if the screen mentions unlimited spending on a token you care about, stop there.
• A domain one letter off, like sndcte.xyz against our sndct.app, or capLcha.bot against captcha.bot. Reach official sites through a bookmark you made yourself, and treat any link that arrived unsolicited as the wrong way in.
• A channel you already trust, whether that's a push notification, an in-app message, or a post in a server you've been in for months. Where a message appears is not evidence of who sent it, and "it came from the app" is how our own members described being caught.
• A fake bot or verification step, since no real verification ever needs your credentials or your recovery words. A bot asking for either is just a form wearing a costume.
• An impersonated person, like our real admin's handle with a full stop added to the end, or a fake role carrying the name of the real one. Check the account ID rather than the display name, and remember that nobody from a team DMs you first about money.
• A warning you talked yourself out of. Your wallet or browser calling a site dangerous is a fact about the site rather than a glitch in the wallet. We have had a member ask the chat about exactly such a warning, get told his wallet was probably playing up, open the same link in a second wallet, and lose that one instead. Two people in our community lost money in a single day that way, which I wrote about in what airdrop farming actually pays now.

How to revoke token approvals every couple of weeks

Approvals don't expire, and they survive you closing the tab and forgetting the site existed, which means a contract you authorised in March can empty a wallet in September. Clearing them takes about five minutes.

1. Open a revocation tool, typing the address yourself. revoke.cash and etherscan.io/tokenapprovalchecker are the usual two, and Etherscan has per-chain equivalents.
2. Connect the wallet you want to clean. Connecting is read-only until you sign something.
3. Sort by what the approval can reach, and revoke anything unlimited, anything you don't recognise, and anything from a site you no longer use.
4. Each revocation is a transaction and costs a little gas.
5. Repeat every couple of weeks, or immediately after connecting to anything new.

Your wallet checklist

Seven lines. If you can tick all seven, the common ways to lose a wallet are closed to you.

• My recovery words exist on paper and in no other place, with no photo and no notes-app copy.
• My wallet app came from a site address I typed myself.
• I keep spending money in a hot wallet and savings somewhere else, ideally on hardware.
• I use a burner for minting, testnets, and anything unfamiliar.
• I read the first four and last four characters of every address I paste, against the source.
• I revoke old token approvals every couple of weeks.
• I treat every unsolicited DM about a drop, an unlock, compensation, or a verification as a scam, without exception.

The honest read

Creating the wallet is the easy part and it genuinely does take ten minutes. What costs people money is that the whole system inverts the habits a bank spent your whole life teaching you: that an alert is a prompt to act quickly, that support can undo your mistakes, and that a message inside an official app can be trusted because of where it appeared. On-chain, each of those gets you robbed, and the last one is what caught our members.

Our own month was a run through that list. The fake administrator role survived because it was named after a bot nobody looks at twice, the verification barrier stopped meaning anything once 5,410 people were handed it, and the one mechanism our members had for raising an alarm had been rewired to mute them for a week if they used it. The money itself left through a permission somebody signed rather than a password anybody stole, and the whole campaign was rented by an affiliate with $278.30 to his name from a service he didn't build and probably couldn't.

If you take one habit from this page, make it the boring one from step 5, where the words go on paper and never anywhere else. Everything else here limits how much a bad afternoon can cost you, while that one decides whether you actually own the wallet at all.

Where I track this

I'm the community manager at Syndicate, an airdrop and ecosystem tracker. The incident, the sweep numbers, and the payout figures in this article all come from programs we run. If you're about to start farming with a fresh wallet, track the drops through Syndicate rather than a spreadsheet and a hope.

Farming more than one of these? I keep every airdrop guide I've written in one table, with status, cost and difficulty side by side.

Sources

First-party, from incidents and programs we run (not published anywhere else): the 67-second entry window, the fake "Dyno" administrator role and its 60 hours unnoticed, the AutoMod rule that muted members for tagging admins and its six firings, the 5,410 accounts granted Verified, the 58% to 99.9% coverage change, the sndcte.xyz and capLcha.bot domains, the $18.75 loss and its on-chain breakdown, the $202,884.90 across 406 addresses and the $278.30 affiliate wallet, the shared-burner and Tether-contract findings from our sybil sweeps, and the held-payout counts all come from Syndicate's August 2026 Discord incident, its on-chain forensics, and our own Farming Season and Inner Circle programs in 2026. They describe what happened to us, and they are not a claim about anyone else's systems.

Two limits stated plainly. How the admin account came under someone else's control is not established, because Discord's audit log records actions and not sessions or logins. The push-notification delivery path rests on what members said in chat that night, not on a log finding, since it happened outside Discord entirely. The victim count is a floor rather than a total, because the method only sees victims of that one deployment and only one member ever gave us an address.

Public sources: Chainalysis, 2026 Crypto Crime Report: Scams, published 13 January 2026, retrieved 2026-09-17, https://www.chainalysis.com/blog/crypto-scams-2026/ (the $17 billion estimate, $14 billion received on-chain in 2025, and impersonation growth above 1400%). Scam Sniffer, Scam Sniffer 2025: Crypto Phishing Losses Fall 83% to $84 Million, published 3 January 2026, retrieved 2026-09-17, https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/ (the $83.85 million across 106,106 victims in 2025, against $494 million in 2024).

None of this is financial advice.