imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

Security Center

Device Security

The goal of Device Security is to build repeatable security habits rather than create fear. Seed phrases and private keys remain under the user’s control, and legitimate support should never ask for them. Every signature, approval, transfer and unfamiliar link should be evaluated by source, scope and likely on-chain effect.

Understanding system and app updates

System and app updates deserves its own verification step when working with Device Security. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Device Security workflow, system and app updates should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

How public networks affects the workflow

Public networks deserves its own verification step when working with Device Security. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Device Security workflow, public networks should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

  • Confirm that the action matches your goal for public networks
  • Verify the address, network and amount before a transfer
  • Review the target and permission scope before signing or approving
  • Check transaction history and on-chain status after completion

Working with shared computers

Shared computers deserves its own verification step when working with Device Security. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Device Security workflow, shared computers should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

Remote-control risks and risk checks

Remote-control risks deserves its own verification step when working with Device Security. Do not rely only on a familiar label or a default selection in the interface. Consider the active network, the destination or contract, the current on-chain state and the result you actually expect. For transfers, signatures or approvals, review the address, network, amount, gas information, contract or permission scope before confirmation. Afterward, use the transaction record or an appropriate block explorer to verify what happened. On-chain transactions generally cannot be reversed unilaterally by a wallet, so prevention matters more than recovery.

In a real Device Security workflow, remote-control risks should not be treated as an isolated field. Read it together with the active network, the source of the asset, the destination, the party initiating the request and the expected on-chain result. If any part differs from what you intended, stop before confirming and verify the source and parameters instead of trying repeated approvals.

Keep verifiable on-chain references such as transaction hashes, contract addresses and network names when they are relevant. A web page that asks for a seed phrase, private key or verification code should be treated as a serious warning sign. Legitimate support should not request those secrets, and a wallet cannot reset or recover a private key on behalf of the user.

  • Confirm that the action matches your goal for remote-control risks
  • Verify the address, network and amount before a transfer
  • Review the target and permission scope before signing or approving
  • Check transaction history and on-chain status after completion