Before You Tap 'Create Wallet': 10 Rookie Moves That Could Cost You Your HBAR
Photo: Ollyquinn, CC0, via Wikimedia Commons
Setting up your first crypto wallet feels a bit like getting a driver's license — everyone assumes you know the rules, but nobody actually sits you down and explains them. HashPack is one of the friendliest wallets in the Hedera ecosystem, but friendly doesn't mean foolproof. Here are the ten mistakes we see new users make over and over, and what to do instead.
1. Blowing Off the Seed Phrase Backup
This is the big one. During setup, HashPack hands you a 12- or 24-word recovery phrase, and some folks screenshot it, save it in a Google Doc, or — worst of all — just click through and promise themselves they'll do it later.
Do this instead: Write your phrase on paper (or stamp it into metal if you're the belt-and-suspenders type) and store it somewhere only you can access. No cloud storage, no email drafts, no photos. If your phone takes a swim at Lake Michigan, that phrase is the only way back in.
2. Downloading a Fake Version of HashPack
Scammers are good at SEO. Search "HashPack download" and you might land on a lookalike site or a sketchy browser extension designed to harvest your keys.
Do this instead: Go straight to the official HashPack website or grab the extension directly from the Chrome Web Store or the app store on your phone. Bookmark the real URL and use the bookmark from then on. Treat it like your bank's login page — you don't Google that either.
3. Sharing Your Recovery Phrase With "Support"
Real support teams never, ever ask for your seed phrase. Anyone DMing you on Discord or Telegram offering to "help recover your wallet" is running a con, plain and simple.
Do this instead: If you need help, use official channels linked from the real HashPack site. And repeat after us: no legitimate person will ever need those 12 words.
4. Keeping Everything in One Basket
Dropping your entire HBAR stack into a single wallet you also use for minting NFTs and poking around dApps is like carrying your 401(k) in cash to a yard sale.
Do this instead: HashPack makes it easy to create multiple accounts. Set up a "vault" wallet that never touches sketchy smart contracts, and keep a smaller "daily driver" for transactions and experimenting.
5. Ignoring Account Creation Fees and Minimums
Hedera isn't Ethereum, but it's not free either. New accounts require a small amount of HBAR to cover creation costs, and transaction fees — while tiny — still add up if you're unprepared.
Do this instead: Fund your wallet with a little extra HBAR beyond what you plan to hold. Think of it like keeping a few dollars in your checking account so nothing bounces.
6. Signing Transactions Without Reading Them
That pop-up asking for approval? It might be a simple transfer, or it might be granting a dApp broad permission to move your tokens. Speed-clicking through approvals is how people wake up to empty wallets.
Do this instead: Read what you're signing. If a request looks odd — a transfer you didn't initiate, an approval for an unfamiliar contract — hit reject and investigate.
7. Falling for Imposter NFT Mints and Airdrops
Free NFTs sound great until the "free mint" website drains your wallet. These scams flood Hedera communities constantly, often mimicking real projects with near-identical names.
Do this instead: Verify project links through official Discords and X accounts. If an airdrop requires you to connect your wallet and sign something to "claim," assume it's a trap until proven otherwise.
8. Sending Tokens to the Wrong Network or Address
Copying an address from an old email or sending HBAR to an exchange that doesn't support it yet — these mistakes are often irreversible. Blockchain transactions don't have a customer service line.
Do this instead: Always send a small test amount first when dealing with a new address. Double-check the first and last few characters of the destination, since clipboard malware loves to swap addresses mid-paste.
9. Skipping the Wallet Password (Or Making It "password123")
Your seed phrase recovers your wallet, but your local password protects it day to day. A weak one undermines everything else you've done right.
Do this instead: Use a strong, unique password you don't reuse anywhere. A password manager makes this painless.
10. Assuming You'll Remember How All This Works in Six Months
Future-you is a stranger. Whether it's which wallet is the vault, where the seed phrase is stored, or which dApps you approved, memory fades fast.
Do this instead: Keep a simple, private record — stored securely offline — of your setup. Even a note that says "vault wallet phrase is in the fireproof box" can save you a world of trouble.
The Bottom Line
None of this requires a cybersecurity degree. It comes down to a handful of habits: back up your phrase, verify your downloads, read what you sign, and never trust anyone who asks for your keys. HashPack gives you solid tools — the rest is on you. Set things up right the first time, and your Hedera journey will be a lot less stressful.