Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
Threat model and wallet purpose
Mobile wallets depend on the OS, distribution channel, lock, physical control, and wallet implementation. Define whether the device serves everyday spending, experimentation, or reserves. Separate accounts or devices can reduce shared exposure but cannot remove malware, phishing, or backup leakage. Review screen, notification, and accessibility permissions. Biometric unlocking does not automatically protect every signature request, cloud copy, or recovery route to the same standard.
Backups, sync, and secret locations
Cloud backup, encryption, migration, and key handling vary by wallet and version. Do not assume system backup is either complete or suitably protected. Photos, clipboards, chats, and ordinary notes can spread secrets. Separate login recovery, device restore, and asset recovery. If backup access depends on the lost phone's only authenticator, the route may fail exactly when needed. Maintain an independently protected and usable fallback.
Updates and signing review
Install through verified channels and review publisher, release changes, and permissions. A small screen is no reason to skip chain, account, recipient, amount, and action details. Simulation can help but has limits and cannot authenticate an application by itself. Jailbroken, obsolete, or uncertain devices deserve reassessment. Reinstalling a wallet does not revoke a leaked seed, existing signatures, or valid on-chain approvals.
Rehearse loss and recovery
Test recovery with a dedicated test wallet, checking addresses and parameters without exposing real seeds in recordings or tickets. After theft, secure related accounts and communications, record timing, and assess possible prior access. Remote wiping cannot prove that nothing was copied earlier. Review contacts, backup location, and tool availability. Instructions should be understandable to a trusted helper without concentrating every secret on paper carried with the phone.
