Skip to main content
This page is for anyone holding or staking ATOM. It needs no setup. Each section names one way people lose funds and the habit that closes it.

​
What a delegator key is

The key behind your address is a wallet key: a secp256k1 key derived from a recovery phrase of 12 or 24 words. It signs transfers, delegations, reward withdrawals, and votes. It is not a validator key. Validators hold two more keys: a consensus key that signs blocks and an operator key that is their validator’s permanent identity. Neither has anything to do with delegating. See Validator security for those. Everything below is about protecting the wallet key. On the Hub, no one can reset or recover that key if the phrase is lost or leaked.

​
Social engineering

Almost every stolen ATOM is stolen by asking for it. Phishing arrives wherever you have an inbox: email, Discord, Telegram, X direct messages, forum messages, and SMS. The messages impersonate validators, wallet teams, “support”, the Cosmos Hub team, or the Interchain Foundation. They ask you to connect a wallet, “validate” or “synchronize” it, claim an airdrop, or confirm your recovery phrase.
  • No one from the Cosmos Hub, a validator, or a wallet team will ever ask for your recovery phrase or private key. Any request for it is theft.
  • No team sells ATOM or runs giveaways by direct message. Offers that need you to act now are scams.
  • Open wallets and explorers by typing the address or using a bookmark you made, not from a link in a message. Check the domain carefully. Look-alike domains are the usual trick.
  • Treat unexpected attachments and “wallet update” downloads as hostile.
If a message looks official, go to the official site or channel on your own and verify there before doing anything.

​
Key management

Keep the recovery phrase offline, written on paper or metal, in two places, with at least one protected from fire and flood. Do not photograph it. Do not store it in cloud notes, a password manager that syncs, or an email draft. For balances that matter, keep the key on a hardware wallet (Ledger) so the phrase never touches an internet connected machine. The gaiad binary supports Ledger directly with --ledger. So do the browser wallets listed on Delegate and stake. Delegating, voting, and claiming rewards never require sharing a key. Custodians and exchanges that stake on your behalf hold their own keys. You give them ATOM, not your phrase. If you keep a gaiad keyring on a machine, use the os or file backend, not test. The test backend stores keys unencrypted and exists for devnets. See Keyring.

​
Software

Install wallets from the vendor’s own site or the browser’s official extension store. Install gaiad from the gaia releases page, and check the SHA-256 sums published with each release (Reproducible builds). Update when a security advisory is published. Advisories appear on the releases page and in the validator announcement channels, never as an emailed attachment. Keep the operating system and browser updated too. A compromised laptop can replace the address on your clipboard.

​
Verify transactions

Read every transaction before signing. A wallet or gaiad shows the message type, the amount, and the destination. A delegate message names a cosmosvaloper address, and a send names a cosmos address. Compare the first and last several characters against the address you intended. Compare the middle too for anything larger than you would be comfortable losing. On a hardware wallet, compare what the device screen shows, not what the browser shows. With gaiad, build with --generate-only, inspect the JSON, then sign. The sequence is in the CLI guide. Do not run commands pasted by strangers in chat. Be aware of what a signed message can authorize. An authz grant lets another address act for you until it expires or is revoked. A liquid staking tokenization moves staked ATOM into a transferable share. Neither is dangerous on its own. Both are exactly what a scam asks you to sign.

​
Account security

Attackers move sideways from your email, your exchange account, your GitHub, and your forum login. Use a code generator or a hardware security key (U2F or FIDO2) as the second factor everywhere that supports it. Remove SMS as a recovery method, because phone numbers get ported away. Email first, since it resets everything else.

​
Supply chain

Buy hardware wallets from the manufacturer or an authorized reseller, never second hand or from a marketplace listing. A device that arrives with a pre-filled recovery card is compromised. A genuine device makes you generate the phrase yourself during setup.

​
Lock staked ATOM against tokenization

The liquid staking module lets staked ATOM be tokenized and transferred without the 21 day unbonding wait. That removes a protection delegators used to have. A thief with your key had to wait 21 days to move staked funds, which left time to notice. If you do not use liquid staking, lock your account:
Re-enabling takes the full unbonding period. A thief who re-enables it therefore still has to wait. Details are on Liquid staking module.

​
If the key is exposed

Move first, investigate later. From a clean machine, create a new address, then send the liquid balance and withdrawn rewards to it. Staked ATOM cannot be moved without a 21 day unbonding (or tokenization, if you did not lock it). Start the unbonding from the compromised address. Move each tranche to the new address the moment it unlocks, before the thief can. Revoke any authz grants:
If the compromised key was on a hardware wallet, the phrase, not the device, is what leaked. A new device restored from the same phrase is still compromised.

​
Next