How to store NFTs safely: a complete guide

How to store NFTs safely: Storing an NFT safely means protecting two separate things: the ownership record on the blockchain and the media file that gives the token its meaning. Most collectors focus only on the wallet and miss the second half entirely. This guide explains both layers, breaks down every storage method from custodial platforms to air-gapped hardware devices, and walks through the practical steps that determine whether an NFT collection survives a phishing attack, a hardware failure, or a marketplace shutting down. Whether you hold one piece or hundreds, the principles here apply across Ethereum, Solana, and any other chain that supports non-fungible token standards.

What does it mean to “store” an NFT?

Storing an NFT safely requires understanding what an NFT actually is at the technical level: not a file, but a token. The token is a record on a blockchain — typically a token ID tied to a contract address — that proves ownership. The image, video, or audio associated with it is a separate object, usually stored off-chain and linked to the token through a metadata JSON file.

The two-layer structure every collector should understand

Every NFT consists of at least two distinct components.

The first is the on-chain token record. This is what lives on the blockchain itself: a unique token ID, the contract that issued it, and the wallet address that holds it. This record is what you are actually securing when you manage your private keys. It cannot be duplicated, deleted, or altered — that is what the blockchain guarantees.

The second is the off-chain media and metadata. Most NFTs point to a JSON file (the metadata) that describes the token’s name, traits, and the URL of the actual image or video. Because blockchains are expensive for storing large files, that JSON and the media it references almost always live somewhere else: a centralized server, IPFS, or a permanent storage network like Arweave.

Why the distinction matters for storage

Controlling your private key protects the token record. It does not protect the file that gives the token meaning.

If the metadata JSON is hosted on a company’s server and that company closes, the image can become unretrievable — even though your wallet still holds the token. This is not theoretical. Projects have disappeared, servers have gone offline, and collectors have been left holding tokens that display broken links on every marketplace.

The table below maps the main metadata storage types and their durability:

Storage type	How it works	Persistence risk
Centralized server (HTTP)	Company hosts the file; contract points to a URL	High — disappears if company closes or stops paying
IPFS (unpinned)	Content-addressed file; CID is stable but availability depends on active pinning	Medium — file becomes unavailable if no node pins it
IPFS + pinning service	Same as above, but a dedicated service keeps the file live	Low — depends on the pinning service staying solvent
Arweave / permanent storage	One-time fee buys perpetual hosting via an endowment mechanism	Very low — designed for long-term availability
Fully on-chain	Metadata and/or image encoded directly into the smart contract	Negligible — survives as long as the blockchain exists

Before acquiring a high-value NFT, checking which category its metadata falls into is a basic research step.

What are the main ways to store NFTs?

The core question in NFT storage is who controls the private key that proves ownership of the token. Every method is essentially a different answer to that question.

Custodial storage: platforms hold the key

A custodial arrangement means a third party — typically an exchange or an NFT marketplace — holds the private key on your behalf. You log in with a username and password; the platform manages the underlying wallet. This is the default setup when an NFT is purchased on a centralized exchange or left in a marketplace account.

The practical risk is the same as leaving funds on an exchange: if the platform is hacked, becomes insolvent, or freezes withdrawals, access to the NFT is at the discretion of that company. The phrase “not your keys, not your coins” applies equally to tokens.

Custodial wallets are appropriate for small-value NFTs that are actively being traded or listed for sale, where convenience outweighs the added risk. They are a poor choice for long-term holding of anything with significant value.

Software wallets (hot wallets): self-custody with connectivity

A software wallet — browser extensions like MetaMask, mobile apps, and desktop clients — gives the holder direct control of the private key. The keys are generated and stored on the user’s device. No third party has access to them.

The limitation is online exposure. Because a software wallet runs on an internet-connected device, it is within reach of malware, phishing attacks, and malicious smart contract approvals. A user who approves the wrong transaction in MetaMask can have NFTs drained within seconds; the signature is valid even if the destination is fraudulent.

Software wallets serve well as the active interface for day-to-day interaction with marketplaces and protocols. They are not the right destination for long-term storage of valuable tokens.

Hardware wallets (cold wallets): self-custody offline

A hardware wallet is a physical device that generates and stores the private key in an isolated chip that never exposes the key to the internet. When a transaction needs signing, the hardware device performs the signature internally and passes only the signed output to the connected computer — the raw key never leaves the device.

The practical setup for NFTs typically looks like this: the hardware wallet provides the account address, and a software interface (MetaMask, for example, connected to the hardware device) handles the display and interaction. Transactions are confirmed on the hardware device’s screen before broadcasting. If the connected computer is compromised, the attacker cannot sign transactions without physical access to the device and its PIN.

This is the approach that most security-focused collectors use for NFTs they intend to hold long term.

Multi-signature wallets: shared authorization

A multi-signature (multisig) setup requires approval from more than one private key before a transaction executes. A common configuration is 2-of-3, meaning any two of three keys must sign. No single key can move the NFT alone.

Multisig wallets protect against both individual key compromise and single points of failure. They are used by institutions, DAOs, and collectors holding very high-value assets. The tradeoff is operational complexity: recovering access after losing one key requires careful coordination with the remaining keys.

How to store NFTs safely on a hardware wallet

Moving an NFT from a software wallet or exchange to hardware-secured cold storage is a straightforward process once the concepts are clear. The steps below apply to Ethereum-standard NFTs (ERC-721 and ERC-1155 tokens).

1. Set up the hardware device. Initialize the device following the manufacturer’s instructions. Write down the 12- or 24-word seed phrase on paper immediately. Do not photograph it or type it anywhere.
2. Back up the seed phrase to a durable medium. Paper degrades. A metal backup plate — stainless steel or titanium with stamped or engraved characters — survives fire, water, and physical damage that would destroy paper. Store this backup in a secure location separate from the device.
3. Get the wallet’s Ethereum address. The hardware device generates an address from the private key. This address is where the NFT will be sent. Verify it on the device’s own screen — never trust only the address shown on a connected computer.
4. Connect the hardware wallet to MetaMask (or equivalent). MetaMask supports hardware wallet integration. When connected this way, MetaMask displays the hardware wallet’s address as the active account, but all transaction signatures are completed on the physical device.
5. Transfer the NFT from its current location. From the source wallet or platform, initiate a transfer to the hardware wallet address. On Ethereum, this requires paying a gas fee. Confirm the transaction details on the hardware device’s screen before approving.
6. Confirm receipt. After the transaction confirms on-chain, the NFT is now under hardware-secured custody. Verify its presence through a blockchain explorer or an NFT platform connected to the hardware wallet address.
7. Disconnect the hardware wallet when not in active use. A hardware wallet’s security model only holds if it is not constantly connected to a potentially compromised machine.

Seed phrase security: the critical dependency

The seed phrase — typically 12 or 24 words generated according to the BIP-39 standard — is the master backup for a non-custodial wallet. It can regenerate every private key the wallet ever generated, on any compatible software, without the original device.

This means it must be protected with the same seriousness as the private key itself.

What never to do with a seed phrase

The following actions expose a seed phrase to theft, often invisibly:

• Typing it into any website, even one that appears legitimate
• Storing it in a cloud notes service (Google Keep, iCloud Notes, Notion)
• Photographing it and keeping the photo on a phone
• Emailing it to yourself or anyone else
• Entering it into a wallet application that requests it unprompted — legitimate wallets request seed phrases only during recovery, never during normal use

Phishing attacks frequently mimic wallet interfaces and claim a “sync error” or “verification required” that requires seed phrase entry. There is no legitimate scenario where routine wallet use requires the seed phrase.

What to do instead

Write the phrase on paper immediately during wallet setup. Transfer it to a metal backup plate as soon as possible. Store the metal backup in a physically secure location: a fireproof safe, a safety deposit box, or a secure location that is geographically separate from where the hardware device is kept. If one location is compromised, the other should remain intact.

Some collectors split a seed phrase across two locations using a memorized partial word, though this introduces complexity in recovery. The simplest resilient setup is a single complete backup stored in a single secure physical location with restricted access.

Wallet approval hygiene: the attack surface most collectors underestimate

Controlling the private key and seed phrase protects ownership of an NFT at rest. The attack surface expands the moment a wallet connects to a website or signs a transaction.

How wallet drainer attacks work

A wallet drainer is a malicious smart contract embedded in a fraudulent website. The site prompts the user to connect their wallet and approve a transaction — often disguised as a routine minting action, a claim form, or a login signature. When the user approves, the signed transaction grants the drainer’s contract permission to transfer assets from the wallet. The transfer executes automatically, often within seconds.

Modern drainers can scan a wallet’s contents and prioritize high-value assets. They have been deployed through compromised Discord and X (Twitter) accounts, fake airdrop pages, search engine ads pointing to cloned marketplace domains, and fraudulent NFT minting sites that mimic legitimate projects.

Practical approval hygiene

The following practices significantly reduce exposure:

• Use a separate wallet for active interaction. Keep high-value NFTs in a cold storage address that is never connected to websites. Interact with marketplaces and new projects from a secondary “hot” wallet that holds only what is needed for near-term activity.
• Review and revoke token approvals periodically. Tools like Revoke.cash allow a wallet holder to audit every active approval and revoke the ones that are no longer needed. An approval granted to a protocol six months ago may still be live.
• Verify transaction data before signing. When a hardware wallet requests confirmation, read the on-screen data carefully. Legitimate NFT listings display the token ID and recipient clearly. Vague or unfamiliar contract interactions warrant suspicion.
• Type marketplace URLs directly rather than clicking links. Search engine results and Discord messages are common vectors for phishing pages that mimic OpenSea, Blur, or other platforms at near-identical domains.
• Check contract addresses on a blockchain explorer before interacting. A legitimate project’s contract address is published on its official site. Verifying it takes thirty seconds.

Common misconceptions about NFT storage

“The NFT is stored in my wallet”

The wallet does not store the NFT file. It stores — or more precisely, controls access to — the private key that proves ownership of the token record on the blockchain. The visual asset lives elsewhere.

“IPFS storage guarantees the file will always be there”

IPFS uses content addressing: each file has a unique identifier (CID) derived from its content. This guarantees integrity — if you retrieve the file, you can verify it matches the original. It does not guarantee availability. If no node on the network is actively pinning (hosting) the file, it becomes unretrievable even though the CID is stable and valid.

“Moving an NFT to cold storage makes it safe from all threats”

Cold storage eliminates remote attack vectors for the private key. It does not protect against physical loss of the hardware device, fire or water damage to the seed phrase backup, or metadata becoming unavailable if the project’s storage infrastructure fails.

“A legitimate project will never ask for my seed phrase”

Correct — and worth stating plainly. No NFT platform, wallet application, or support team has a legitimate reason to request a seed phrase during normal operation. Any such request is either a phishing attempt or a compromised account.

Choosing the right approach based on your situation

Holder type	Recommended approach
Casual collector, low-value NFTs	Software wallet with approval hygiene and periodic revoke audits
Active trader who buys and sells regularly	Hot wallet for trading activity + cold wallet address for anything held beyond a week
Long-term collector, high-value holdings	Hardware wallet for storage; separate hot wallet for active interaction
Institutional or high-net-worth collector	Multisig setup; consider geographically distributed backups

The division between “active” and “storage” wallets is one of the most effective structural safeguards. It limits the surface area that any single phishing event or malicious approval can reach.

FAQs

What is the safest way to store NFTs? A hardware wallet combined with a securely stored metal seed phrase backup provides the strongest protection for long-term holdings. The private key stays offline; transactions require physical confirmation on the device. For anything held beyond a few days, this setup is the standard used by security-conscious collectors.

Can NFTs be stolen even with a hardware wallet? The private key itself cannot be extracted from a properly functioning hardware wallet without the PIN and physical access to the device. However, an owner who approves a malicious transaction while the hardware wallet is connected — without reading the details carefully — can still authorize a transfer. The hardware wallet secures the key; reading what you sign secures the approval.

Does IPFS guarantee my NFT’s image will always be available? No. IPFS guarantees that if the file is available, it is the correct file (content addressing verifies this). Availability depends on someone actively pinning the file. Unpinned files on IPFS can become unretrievable over time even when the token on-chain remains intact.

What happens if I lose my hardware wallet? The hardware device can be replaced. What cannot be replaced without the seed phrase is access to the wallet. If the seed phrase backup is intact and secure, restoring the wallet to a new device restores access to all assets at that address. If the seed phrase is also lost, the assets at that address are permanently inaccessible.

Should I store all my NFTs in one wallet? Concentrating all assets in one address concentrates risk. A practical approach is to keep high-value NFTs in a dedicated cold wallet address that is never used for interacting with websites, and to maintain a separate active wallet for trading, minting, and platform interaction.

What is a wallet drainer and how does it work? A wallet drainer is malicious contract code embedded in a fraudulent site. When a user connects their wallet and signs the prompted transaction, the drainer’s contract receives approval to transfer specific assets — and executes the transfer immediately. The attack exploits the token approval mechanism built into ERC-20, ERC-721, and related standards. The signed transaction is technically valid; the blockchain cannot distinguish a tricked user from an intentional one.

Is a paper backup of my seed phrase acceptable? Paper is better than digital storage but carries its own physical risks: fire, water damage, deterioration over years, or discovery by others. Metal backup plates stamped or engraved with the seed phrase are significantly more durable and represent a meaningful upgrade for anyone holding assets of meaningful value.

Does using a hardware wallet with MetaMask reduce security? When set up correctly, the hardware wallet integration in MetaMask keeps the private key on the physical device throughout. MetaMask handles the interface; the hardware device handles all signing. The risk is the same as with any hot software interface: approving a malicious transaction. The hardware wallet does not prevent that approval — it requires physical confirmation of it, which is why reading what the device displays before confirming matters.

Disclaimer

This article is written for educational purposes and is intended to explain how NFT storage mechanisms work. It does not constitute financial advice, investment guidance, or a recommendation to buy, hold, or sell any digital asset. NFTs carry significant risks, including total loss of value and permanent loss of access if private keys and seed phrases are not managed carefully. Readers should conduct their own research and, where appropriate, consult qualified professionals before making decisions involving digital assets.

Storing NFTs safely comes down to understanding what you actually control. The on-chain token record is protected by the private key — and the private key is only as secure as the wallet that holds it and the seed phrase that can restore it. The off-chain media is a separate consideration that deserves attention when evaluating any project. Getting both right, maintaining clean approval hygiene, and separating active from long-term storage addresses most of the practical risk that NFT holders face.

Every idea here is worth your attention—explore our hand-approved content picks.