How to store Ethereum safely: wallets, L2s and staking

Storing Ethereum (ETH) follows the same basic rules as any crypto: whoever controls the private keys controls the coins. But Ethereum adds a few traps of its own that Bitcoin holders never meet: one address that works on many networks, tokens that need ETH for fees, smart contracts that can be given permission to move your funds, and staked ETH that comes in several forms. This guide covers where to keep ETH and how to avoid the Ethereum-specific mistakes. If you are new to the network, start with what is Ethereum.

Your four options

Exchange (custodial). Easiest: you log in, the exchange keeps the keys. It suits small balances and active trading, but you depend on the company staying solvent and not freezing withdrawals. Turn on app-based two-factor authentication and a withdrawal address allowlist.

Software wallet (hot). Apps such as MetaMask, Rabby or Coinbase Wallet keep keys on your device. You get direct access to DeFi, NFTs and layer-2 networks, but the keys live on an internet-connected machine, so malware and fake sites are the main threat.

Hardware wallet (cold). A small device such as a Ledger or Trezor keeps keys offline and asks you to confirm each transaction on its own screen. You can still use it with MetaMask or Rabby for DeFi. Our hardware wallet explainer covers how they work and how to buy one safely.

Smart-contract multisig. On Ethereum, a contract wallet such as Safe can require, say, two of three keys to approve a transfer. It removes the single point of failure, which is why many companies and DAOs use it, but it is more complex to set up and recover.

Ethereum-specific risks to understand

One address, many networks

An Ethereum address (starting with 0x) works on Ethereum mainnet and on compatible networks such as Arbitrum, Base, Optimism and Polygon. The same seed phrase controls all of them, but balances are separate: ETH on Base is not visible on mainnet. Most "lost" ETH is simply sitting on another network. Before you withdraw from an exchange, check which network it will send on and that your wallet supports it. Moving between networks usually means a bridge, which adds its own risk.

You need ETH to move tokens

Every Ethereum transaction pays a gas fee in ETH (or the network's native gas token on some layer 2s). If you hold USDC or other ERC-20 tokens but no ETH on that network, you cannot move them. Keep a small ETH balance for fees on each network you use.

Token approvals

To use a DEX or lending app you often sign an approval that lets a smart contract spend a token from your wallet, sometimes in unlimited amounts. If that contract is malicious or later hacked, it can drain the approved token without any further signature from you. Review and revoke old approvals regularly with your wallet's built-in tool or a token-approval checker such as the one on Etherscan, and prefer exact-amount approvals.

Signing messages, not just transactions

Phishing sites increasingly ask you to sign an off-chain "permit" or other typed message instead of a normal transaction. These signatures can authorise transfers too. If your wallet shows a message you do not understand, or the device asks you to enable "blind signing", stop. Our guide to spotting crypto scams shows common lures.

Address poisoning

Scammers send tiny or zero-value transfers from addresses that look like ones you use, hoping you copy the wrong one from your history. Always copy addresses from a saved contact or the recipient's original source, and check more than the first and last few characters.

Storing staked ETH

Staking ETH earns rewards for helping secure the network, and it comes in three main forms:

• Exchange staking: simplest, but the exchange holds your ETH and takes a cut.
• Liquid staking tokens such as Lido's stETH or Rocket Pool's rETH: you receive a token that represents staked ETH. Store it like any ERC-20 token, ideally on a hardware wallet, and remember it carries smart-contract risk and can trade slightly away from ETH's price.
• Solo staking: running your own validator needs 32 ETH, reliable hardware and careful key management. The withdrawal address you set controls where your ETH ends up, so point it to a wallet you fully control, such as a hardware wallet or multisig.

For background on why Ethereum uses staking at all, see proof of work vs proof of stake.

A simple setup that works for most people

1. Keep trading money on a reputable exchange with strong 2FA.
2. Use a hot wallet with a small balance for DeFi and experiments.
3. Keep savings on a hardware wallet bought directly from the maker, with a new seed phrase written on paper or metal and stored offline. Read what is a seed phrase before you set it up.
4. Send a small test transaction before any large transfer, and double-check the network.
5. Once a quarter, review token approvals and remove what you no longer use.