Self-custody checklist before your first DEX trade — what each wallet prompt really authorises, and the $20 test that proves the route
Key takeaways
- On Hyperliquid, 4 of the 5 wallet prompts that can cost you money need no gas. Only the deposit is a paid transaction; a withdrawal is a signature with “no Arbitrum transaction” behind it.
- The documented 5 USDC minimum is the worst test you can run: the $1 withdrawal fee eats 20% of it, and it is below the $10 order minimum at 1x. A $20 test covers the whole route for about 5.04%.
- Size the trading wallet to one mistake, not to your savings. In our $10,000 example that is $2,500 — a drained trading wallet then costs a quarter of the stack, not all of it.
- Disconnecting a site is not revoking an approval. The first hides your balance; only the second stops a contract moving your tokens, and it costs gas.
What changes the moment you trade from your own wallet?
Every safety feature you relied on at an exchange is gone, and you become the replacement for all of them at once. That is the whole trade-off of self-custody in one sentence: nobody can freeze your money, and nobody can rescue it either.
It helps to see the list, because most people moving from a centralised exchange have never noticed how many jobs its security desk was quietly doing.
| The job | On a centralised exchange | In self-custody |
|---|---|---|
| Recovering access if you lose your login | Password reset, ID check, support ticket | Your seed phrase. Nothing else exists. |
| Stopping a withdrawal to a new address | Whitelist, cooling-off period, email confirmation | Nothing. A valid signature is final. |
| Second factor before money leaves | Authenticator app or passkey | Only whatever your wallet or hardware device enforces. |
| Telling you a message is fake | Anti-phishing code in genuine emails | You, reading the prompt. |
| Reversing a mistake | Sometimes, if you ask fast enough | Never. |
| Watching your leverage after you open | Margin calls, warning emails | Checked only when the position opens (Hyperliquid’s Margining page). |
Two rows in that table do most of the damage. The withdrawal row, because on a centralised exchange there are several places a theft can be stopped — a whitelist, a cooling-off period, a confirmation email — while in self-custody a valid signature is simply final. And the last row, which is specific to perpetual venues: Hyperliquid’s Margining page states that leverage is checked only when a position opens and that monitoring it afterwards is the user’s responsibility. We covered the exchange-side versions of these protections in how to secure an exchange account; if you have never set those up, you have also never practised the habits this checklist depends on.
Step 1 — where should the seed phrase live?
On paper, in two separate places, and nowhere that is connected to the internet. The seed phrase — MetaMask calls it the Secret Recovery Phrase — is a list of randomly generated words that gives access to every account inside the wallet. MetaMask’s own help page calls it your single point of failure, and says plainly that its support team cannot recover it for you.
The same page gives the rule that stops most theft: there are only two legitimate moments to type a seed phrase — when you create the wallet and have to confirm a few words, and when you restore the wallet on a device or reset its password. A website, a “support agent”, a form to “verify” or “sync” your wallet, an airdrop claim: none of them is on that list, ever.
Three details the usual advice leaves out:
- If you set the wallet up with a Google or Apple login, MetaMask says the phrase is encrypted and split across five nodes that only that account can reassemble. Your points of failure are then that Google or Apple account and its password — so the password must be unique, and MetaMask still recommends keeping the phrase itself.
- If you log in to Hyperliquid with an email address, there is still a key; it is simply managed for you. The docs describe an “Export Email Wallet” option that hands you the private key. Anyone who controls that inbox is one code away from your account, so it deserves the protection a seed phrase gets.
- Photographs and cloud notes are internet-connected by design. A phrase that has ever been in a screenshot should be treated as exposed.
MetaMask’s advice for large balances is a hardware wallet, which keeps the key off the internet and requires the device itself to approve every signature. Hyperliquid additionally supports native multi-sig at the account level, where several keys must sign each action — an advanced feature, but worth knowing exists before an account grows large.
Step 2 — why a separate trading wallet, and how much goes in it?
Because the wallet that signs things for websites is the one that will eventually sign something it should not, and you want that wallet to be small. The rule between the two is simple: the trading wallet holds what one mistake could cost you; everything else lives in a wallet that never connects to anything.
Here is what each kind of compromise actually costs, which is the table you need to size it.
| If this leaks or is signed for the wrong site | What can be taken | What you can do afterwards |
|---|---|---|
| Your seed phrase | Every account in that wallet, on every chain, now and later. | Nothing. Move what is left to a new wallet immediately. |
| One account’s private key | Everything that account holds, on every chain. | Same — this is why an exported email-wallet key must be treated like a seed phrase. |
| An unlimited token approval | All of that token on that chain, including tokens you receive later. | Revoke it. That costs gas, and works only if you are faster than the attacker. |
| A permit signature | Up to the value in the message, until its deadline. | Very little once it has been used. |
| A withdrawal signature | The amount in the message, sent to its destination. | Nothing. It is final. |
| The trading (API) key in your browser | Orders on your account. The one transfer it can sign must go to your own address. | Approve a new key; the old unnamed one is deregistered. |
The first two rows are why the split works. A leaked seed phrase takes every account in that wallet, so a separate trading wallet has to be a separate seed phrase, not just a second account under the same one.
A worked example on the site’s standard numbers. Say you have $10,000 in crypto and your plan is one $10,000 BTC position at 5x. That position needs $2,000 of margin. Add a $500 reserve for fees and a top-up, and the trading wallet holds $2,500. If a bad signature empties it, you have lost 25% of your stack — painful, recoverable. If you had traded from the wallet holding all $10,000, the same click would have cost all of it. Nothing about the trade changed; only the blast radius did.
When a trade goes well, move the profit back to the cold wallet on a schedule rather than letting the trading wallet grow. A trading wallet that has quietly become your savings account is the most common way this rule gets broken.
Step 3 — what is each wallet prompt actually asking for?
This is the step almost every checklist gets wrong, because it still teaches the rule from Ethereum’s early days: approvals cost gas, and gas is a moment to stop and think. MetaMask’s help page on token approvals describes exactly that — an approval is recorded on-chain, so you pay for it. On a venue built as its own chain, the costly things are mostly free.
We went through Hyperliquid’s onboarding, bridge and API documentation and listed every prompt a first session can put in front of you:
| Prompt | What kind | Gas? | Can it cost you money? | What it actually authorises |
|---|---|---|---|---|
| Connect | Permission request | No | No | The site sees your address and balances. Nothing is signed and nothing can move. |
| Enable Trading | Signature (gas-free) | No | Yes | Approves an “API wallet” key that signs orders on your account from then on — which is why later orders need no wallet pop-up. |
| Deposit USDC | Transaction (Arbitrum) | Yes | Yes | Sends USDC to the bridge contract, credited to the address that sent it. Paid for in ETH gas. |
| Permit | Signature (gas-free) | No | Yes | Lets a named spender move up to a stated value of your USDC until a deadline. No gas, yet it is a spending approval. |
| Approve builder fee | Signature (gas-free) | No | Yes | Lets a third-party app add its own fee to your fills — up to 0.1% on perps and 1% on spot. Must be signed by your main wallet. |
| Withdraw | Signature (gas-free) | No | Yes | Moves USDC out of Hyperliquid to the destination in the message. “No Arbitrum transaction” — validators do the rest. |
| Place order | No wallet pop-up | No | Yes | Signed by the key you approved at Enable Trading; the app’s own Confirm box is the only prompt. |
Count the rows that can cost you money and that your wallet actually shows you: 5. Count how many of those are gas-free: 4. The only one that costs gas is the deposit — the prompt people are least likely to be tricked with, because they started it themselves.
The withdrawal row is the one to sit with. Hyperliquid’s bridge documentation says the withdrawal flow “requires a user wallet signature on Hyperliquid only, and no Arbitrum transaction”; validators send it on, and the funds arrive in three to four minutes. It is a genuinely convenient design. It also means that a gas-free “Sign” button on the wrong website is enough to send your balance to someone else’s address, with no gas estimate to make you pause.
Two more rows deserve a sentence each. Permit appears in Hyperliquid’s own docs as a way to deposit on someone’s behalf, and its fields are the whole warning: an owner, a spender, a value and a deadline. It is a spending approval that costs nothing to sign — which is why drainer sites prefer it to the old on-chain approval. Approve builder fee only appears if you trade through a third-party front end; it lets that app add up to 0.1% to every perpetual fill, more than double the 0.045% base taker fee, and the docs say it must be signed by your main wallet.
And one honest gap. The documentation says an API wallet signs “on behalf of” your account, and that the one asset transfer it may sign must go to the same address it came from. We could not find a single sentence stating flatly that an API wallet can never withdraw, so we have not written one. Treat the key behind Enable Trading as what it certainly is: a key that can trade your account.
Step 4 — how do you run a test transaction that actually tests something?
Push a small amount through the entire route — deposit, one order in and out, withdrawal back to your wallet — before any real money moves. A test that only checks the deposit proves you can put money in; the mistake that costs people is usually on the way out.
The obvious test size is the minimum, and it is the wrong one. The bridge documentation sets a 5 USDC deposit minimum (below it, a wallet deposit is “lost forever”). The Exchange endpoint page charges $1 per withdrawal. The support FAQ puts the minimum order at $10. Put those together:
| Test deposit | Can you test an order without leverage? | Fixed cost of the cycle | Cost as a share of the test |
|---|---|---|---|
| $5 | No — below the $10 order minimum at 1x | $1 | 20.0% |
| $12 | Yes | $1.01 | 8.41% |
| $20 | Yes | $1.01 | 5.04% |
| $50 | Yes | $1.01 | 2.02% |
| $100 | Yes | $1.01 | 1.01% |
A $5 test costs a fifth of itself and cannot test an order at all without adding leverage. We would test with $20: it clears the $10 order minimum with room for fees, and the full cycle costs about $1.01, or 5.04%, plus whatever Arbitrum gas your wallet quotes for the deposit. Above $50 the percentage stops mattering; the network and address risks the test exists to catch do not shrink with size.
What the test is really checking, in the order it can go wrong:
- The network. Deposits from a connected wallet are accepted only as USDC on Arbitrum. The email login accepts USDC on Arbitrum, Base, Ethereum or Polygon through Across; below 5 USDC it redirects the funds to your email wallet, and below 1 USDC they are lost.
- The amount that arrives, not the amount you send. If you send from an exchange that takes its fee out of the withdrawal, exactly 5 USDC will not arrive as 5. Never test at the minimum.
- Where the withdrawal lands. The support FAQ has a whole page for people who withdrew USDC on Arbitrum to a wallet that does not display Arbitrum and thought it was gone. It was not — but a test is where you want to discover that, not with the full balance. Our guide to checking a transaction on a block explorer shows how to confirm it yourself.
- The timing. The bridge page says deposits credit in under a minute and withdrawals arrive in three to four; the Exchange endpoint page says roughly five. If yours takes far longer, find out why while the amount at stake is $20.
The same logic, for exchange withdrawals rather than DEX deposits, is in how to withdraw crypto safely. And if reading this far has convinced you that a venue with no support desk is not where you want your first account, that is a legitimate conclusion: compare the regulated exchanges and come back when the list above feels routine.
WHEN STEPS ONE TO THREE ARE DONE
Affiliate disclosure first: the button below is a referral link. The venue pays us a share of its trading fees at no extra cost to you, and its published referral rules give you a 4% fee discount on your first $25M of volume. It changes nothing on this page — see our disclosure policy.
If the seed phrase is on paper, the trading wallet is a separate phrase, and you know which prompts you will see, the $20 test is the next thing to do — and it happens on the venue. Two sentences before you go: you hold the keys there, so a lost seed phrase is lost money and there is nobody to appeal to; and the venue checks your leverage only when a position opens, never again afterwards. Open it from this link once, then bookmark it and use the bookmark from then on.
Referral link — we may be paid if you sign up through it. Not offered to US persons, and readers in the UK see no venue links on this site at all. Education only; most retail traders lose money.
Step 5 — what should you check before you sign anything?
Five things, every time, in this order. It takes about ten seconds once it is a habit, and it is the only protection a signature has.
- How did you get to this page? From your own bookmark: carry on. From a search advert, a direct message, a reply under a post or an “airdrop” announcement: close the tab. The referral link above is the one exception we would ever suggest, and only for the first visit.
- Is it a transaction or a signature? If you expected neither — you only came to look — reject it.
- What is the message type? Wallets that display typed data show a name. Withdraw, Permit, an approve-agent or approve-builder-fee message: each has one job, and it should be the job you just asked for.
- Whose address is in it? A withdrawal’s destination should be your own address. A permit’s spender should be the contract you meant to use. Compare the first and last several characters against a copy you trust.
- How much, and for how long? A permit’s value and deadline; a builder fee’s maximum rate; a token approval’s spending cap. MetaMask’s advice on caps applies everywhere: even allowing 10% instead of unlimited is a far better outcome if the site turns out to be a scam.
If you find you are hurrying — a countdown, a “last chance”, a claim that expires tonight — MetaMask lists urgency as the first of its warning signs. Nothing legitimate on an exchange you already use needs you to sign within the next five minutes.
Step 6 — what do you clean up afterwards?
Three things, and they are different enough that people routinely do one and think they have done all three.
- Revoke token approvals you no longer need. The MetaMask Help Center lists the block explorers’ approval checkers and tools such as Revoke. Revoking is on-chain, so it costs gas; MetaMask suggests checking monthly.
- Disconnect sites. This stops a site seeing your address and balances. MetaMask stresses it is not the same as revoking — a disconnected site with an old approval can still move the approved token.
- Review venue-side permissions. On Hyperliquid, builder-fee approvals can be revoked at any time, and approving a new unnamed API wallet deregisters the old one. If you ever typed your trading wallet into a site you now doubt, the fix is a new wallet, not a clean-up.
Then do the thing Step 2 promised: sweep profits back to the cold wallet. If you want the whole routine on one page, here it is in order.
When it is done, the next pages are practical rather than defensive: what trading on the venue costs, and how to set a stop-loss there — the one alarm a self-custody venue will never install for you.
Anyone who cannot say, without looking it up, what happens if they lose the seed phrase. The answer is “the money is gone, permanently”, and if that is not already an instinct, a centralised exchange with account recovery is the better first home. Our DEX versus CEX comparison lays out that choice.
Anyone planning to move savings rather than trading capital. The whole design of this checklist is that the trading wallet is small; if the plan is to put everything in one hot wallet, fix the plan first.
Anyone in the United States: Hyperliquid’s interface is not offered to US persons, and our referral link will not send you there. Readers in the UK see no venue links on this site at all, by design.
Common mistakes
- Treating “no gas” as “no risk”. On Hyperliquid a withdrawal, a permit and a builder-fee approval are all gas-free signatures. Read the fields, not the fee.
- Testing with exactly the minimum. 5 USDC loses 20% to the withdrawal fee, cannot test an order at 1x, and falls below the minimum the moment an exchange deducts its own fee.
- Making the trading wallet a second account under the same seed phrase. One leaked phrase then takes both. A separate trading wallet means a separate phrase.
- Sending USDC on the wrong network. A connected wallet deposits only on Arbitrum. The test exists to catch exactly this with $20 instead of your full balance.
- Disconnecting a site and assuming the approval went with it. Disconnecting hides your balances; only a revoke transaction removes the approval.
- Reaching the venue through a search result or a link in a message. Bookmark the real address on the first visit and use nothing else.
- Letting the trading wallet grow into the savings wallet. Sweep profits out on a schedule, or the blast radius quietly returns to 100%.
Frequently asked questions
Is it safe to connect my wallet to a DEX?
Connecting on its own only lets the site see your address and balances; nothing moves. The risk starts with what you sign afterwards. On Hyperliquid, four of the five prompts that can cost you money — Enable Trading, a permit, a builder-fee approval and a withdrawal — are gas-free signatures, so read what each one authorises rather than whether it costs gas.
What does “Enable Trading” on Hyperliquid actually sign?
A gas-free message that approves an API wallet (the docs also call it an agent wallet) to sign on behalf of your account. That is why later orders do not open a wallet pop-up. The one transfer an agent may sign in the API docs requires the destination to match the source address. Approving a new unnamed API wallet deregisters the previous one.
How much should my first test deposit be?
On Hyperliquid we would use $20. The documented minimum is 5 USDC, but a $5 test loses 20% to the $1 withdrawal fee and is too small to place the $10 minimum order without leverage. At $20 the full cycle — deposit, a $10 order in and out, withdrawal — costs about $1.01, roughly 5%, plus Arbitrum gas.
Is disconnecting a site the same as revoking an approval?
No. The MetaMask Help Center is explicit: disconnecting stops a site seeing your address and balances; revoking an approval stops a contract moving your tokens. Revoking is an on-chain transaction and costs gas. Check your approvals regularly and revoke the ones you no longer use.
What happens if I lose my seed phrase?
You lose access to every account in that wallet, and nobody can restore it. MetaMask’s own documentation says its support team cannot recover a Secret Recovery Phrase. There is no account to reset, because there was never an account — only a key.
Keep going: all our DEX guides, the Hyperliquid profile, and the step-by-step account walkthrough once this checklist is done.