For a team that holds crypto, the basics are the ones ethereum.org lists: never share recovery phrases, avoid unlimited token approvals, verify every address and transaction before signing, and keep keys on hardware devices. Add a team layer on top: separate roles, no single key, and written procedures.
Recovery phrases and keys
The ethereum.org security page is blunt: never, for any reason, share your recovery phrase or private keys. It also says not to photograph or screenshot them, since cloud syncing can expose them.
For teams, that means no phrase in a chat, a ticket, a password manager shared with everyone, or a repository. If your developers handle deployer keys, scan repositories for secrets and block commits that contain them. See what private key hooks catch.
Token approvals
Approvals let a contract move your tokens. The page advises avoiding unlimited spend approvals, because they could let a contract drain a wallet. Set approvals to the amount a transaction needs, use wallet limit protection if available, and revoke access you no longer need.
A team habit that works: review approvals on treasury wallets on a schedule and after any contract interaction that was meant to be one time.
Phishing and fake support
Check the domain every time you click, since link previews can be spoofed. Ignore unsolicited support contacts, because official staff do not reach out through private channels. Do not open links or attachments from unknown senders.
Hardware wallets
ethereum.org describes a hardware wallet as keeping private keys offline, calling it the most secure storage option for them. For a team, give each signer their own device and record who holds which.
Signing carefully
A transaction on Ethereum is irreversible. Verify the recipient address exactly and read the transaction details before signing, especially with a contract. Where several people must approve, each should check the details independently on the device screen, not only on a shared interface. The Bybit analysis shows why a trusted screen matters.
Team layer
- Use a multisig for treasury, with signers on different devices and networks.
- Separate daily operating wallets from holding wallets and cap balances on the former.
- Write down who can approve what and review it when staff change.
- Rehearse key loss and signer departure before it happens.
Safeguard can scan repositories for exposed secrets and inventory dependencies. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is a screenshot of a recovery phrase acceptable as a backup?
No. The guidance says not to photograph or screenshot them, because cloud sync can expose the image.
Why avoid unlimited approvals?
A contract with unlimited spend rights could drain the wallet if the contract is malicious or compromised.
Sources
Last reviewed: 19 October 2026.
