Keeping a crypto wallet safe while travelling

A self-custody wallet such as MetaMask generates a secret recovery phrase when it is set up, and the accounts that hold your tokens are derived from it. In the standard setup, the password that opens the app only unlocks the wallet on that one device; the phrase is what restores it on a new one. MetaMask spells out the consequence: whoever controls the phrase controls the wallet, and because MetaMask cannot recover a wallet for you, losing access to the phrase means the funds cannot be recovered.

Hardware wallet makers describe the same arrangement from the other side. Trezor notes that a lost or stolen Trezor is highly unlikely to be opened without its PIN, but that anyone who steals the wallet backup — its term for the recovery phrase — can reach the coins using a different device or wallet. That sets the priority for a trip. A lock protects the wallet on one device; the phrase protects, or gives away, all of it.

The tempting shortcut before a trip is a photo of the phrase, a note on the phone or a draft email to yourself, so the words are always to hand. It is exactly what the wallet makers tell you not to do. Trezor's guidance is to keep no digital copies at all, naming screenshots, photographs, emails, cloud storage such as Dropbox and even encrypted folders, and MetaMask lists a cloud-saved document or an email among the easily hacked places to avoid.

A phrase written on paper, as MetaMask puts it, cannot be stolen online. Once written down it belongs somewhere secure and offline that only you can reach, kept safe from theft and damage, and the simplest way to keep it safe on a trip is for it not to come on the trip. A written phrase in a suitcase can be lost, stolen or read along with everything else in the bag.

Hotel and airport Wi-Fi is less dangerous than its reputation. The FTC's guidance is that because most websites now encrypt the data they exchange, connecting through a public network is usually safe, and a lock symbol or https in the address bar shows that the connection is encrypted. What encryption cannot tell you is who is at the other end: the FTC also warns that scammers create fake websites and encrypt them too, so your details are protected all the way to the scammer.

For a wallet, what a fake page wants is the phrase. Trezor warns of phishing through fake websites and emails aimed at wallet backups and PINs, and of scammers posing as its support staff on social media and chat forums; both Trezor and MetaMask say they will never ask for the phrase, even through their own support. Whatever the pretext, a request for those words is the giveaway. Open the wallet only from the app you installed before you left, and never type the phrase into a website or read it out to anyone.

This is where the earlier choices pay off. If the phrase is written down and safe at home, the funds have not gone anywhere: they are held on the blockchain, and the phrase can restore the wallet on a new device, which is what MetaMask and Trezor both say it is for. In the meantime the wallet on the missing phone is protected by the screen lock and the app's own password, so set both to something a stranger could not guess before you travel.

If the phrase was ever on that phone, as a photo, a note, a screenshot or an unsent email, the position is different. The safe assumption is that someone else may now have it, and anyone with the phrase can reach the funds from their own device. The response is to create a new wallet with a new phrase on a device you trust, and move the funds into it as soon as you can.

It is also worth deciding before departure whether the wallet on your phone needs to hold more than the trip requires. A separate wallet for travel spending, with its own phrase, limits what a lost phone or a phished phrase can cost. Everything else can stay in a wallet whose phrase never leaves home, or on a hardware wallet, which keeps its keys offline and needs the device in hand to sign a transaction.

Check the rules for each country you are entering; the United States, for one, publishes a detailed account of its own. US Customs and Border Protection says that everyone arriving in or leaving the country is subject to inspection regardless of citizenship, baggage included, and that a basic search means an officer reviewing a device's contents by hand. It also says that less than 0.01 per cent of the arriving international travellers it encountered at ports of entry in its 2025 fiscal year had their devices searched, and that travellers are obliged to present devices in a condition that allows them to be examined.

A wallet app is simply part of what is on the phone, and a written phrase in a bag is part of the baggage. None of that is a reason to hide anything; it is a reason to carry only what the journey needs. A travel wallet holding travel money, a phone with no copy of the phrase on it, and no written phrase in the luggage mean that an inspection, like a theft, finds nothing that could cost you the wallet.