Setting Up Your First Wallet, and the Three Screens Where the Money Is Decided

You set up a wallet by installing the app, creating a new wallet, and writing down the words it shows you. That takes two minutes. Almost nobody loses money there. The losses happen on three screens.

Most guides walk you through the buttons. The buttons are not the hard part, and the app already labels them clearly.

What nobody explains is that three particular screens appear during and just after setup. Each one asks for something different, and only one of them can move your money. People reliably guard the wrong one.

What actually happens when you make a wallet

A wallet app does not hold your coins. Your coins sit on a public network that anybody in the world can read. The app holds the key that proves those coins are yours and lets you move them.

When you tap create, the app builds that key and then hands you a list of ordinary words. Those words are the same key, written in a form a person can copy onto paper.

Think of a hotel safe you install yourself. The safe is bolted into the room and everyone can see it. What you carry away is the combination. Lose it and the safe stays shut forever. Hand it to someone and the room is no longer yours.

That is the whole of the setup. Everything expensive that follows comes from what you do with those words, and from two prompts you meet the first time you visit a site.

The app is a window onto the network. The words are what you actually own.

Screen one: the words nobody can reset

The first screen shows a list of words and asks you to write them down. Wallet apps commonly give twelve of them, and some give twenty-four.

Solana Mobile’s own wallet help describes the restore step as typing “your 12 or 24-word seed phrase”, which is that same list read back in the other direction.

This list is called a recovery phrase, or a seed phrase, and it is not a password. A password protects one account on one service, and somebody can reset it for you. Nobody can reset this. No company is holding a spare copy.

Anyone who reads those words has your money. Not access to your account, not a way to request a transfer. They have it, from anywhere, straight away.

That single fact is why every honest wallet company says the same thing. One of the larger Solana wallet makers tells users never to share the phrase with anyone. That includes a friend, and it includes somebody claiming to be a support agent. The company adds that its own support “will never ask for your Secret Recovery Phrase. Ever.”

The setup guidance adds the part people skip. Write the words down somewhere private, or as Solana Mobile phrases it, “use a secure environment (e.g., private location) to avoid exposing your seed phrase.”

Paper is fine. A photograph is not, because photographs sync. The moment those words sit inside an account that can be broken into, they inherit every weakness that account has.

A close candlelit view of two brown tabby cat paws lowering a small blank cream card into a heavy open iron strongbox with thick hinges and a burnished gold lock plate, a single candle burning at the edge of the frame, and a switched-off phone lying face down and forgotten in the dark background — Paper does not sync, does not back itself up, and cannot be read from another country.

Screen two: connecting is not the same as spending

The first time you visit a site that does anything with your coins, a box appears asking to connect your wallet. This is the screen newcomers fear most, and it is the least dangerous of the three.

Connecting hands the site your public address. That is the part of your wallet anybody can already look up, rather like the name printed on a bank card. It also opens a session, which lets the site ask you to approve things.

Solana Mobile’s developer documentation sets out what comes back when you approve a connection. The wallet returns the authorised accounts along with a session token, and from then on, “signing requests are available in the session”.

Read that last part slowly, because it is the entire distinction. Approving the connection makes requests possible. It does not approve any of them. Every real movement of money needs its own screen and its own tap from you.

So connecting to a bad site does not empty your wallet by itself. What it does is put you in front of the screen that can.

Being choosy is still sensible. Reach sites by typing the address yourself rather than following a link from a message or a comment, because the connect box on a copied site looks exactly like the real one.

Newcomers hesitate over the box on the left and wave through the one on the right.

Screen three: the prompt that actually moves money

The third screen is the approval. It appears when a site wants you to do something, and it is the only one of the three that can cost you anything.

Most approvals are ordinary. You are trading one token for another, and the box is asking you to confirm that trade.

Some approvals do something quite different. They grant another party standing permission to move a set amount of your tokens later, without asking you again. The official documentation for Solana’s token program puts it plainly: “Delegated authorities may transfer or burn up to the amount they’ve been delegated.”

That kind of permission is useful and entirely normal. Trading sites rely on it. The difficulty is that the box granting it can look almost identical to the box confirming a trade, and it is the one a fake site wants you to tap.

The same documentation also gives you the way out. That permission “may be revoked by the Account’s owner”, which in a wallet app means a settings page listing everything you have approved and a button to take it back.

Wallet security guidance recommends reviewing and revoking those permissions from time to time. It takes a minute, and it is the most useful piece of housekeeping a new holder can do.

The screen	What it asks	What it actually grants	Cost if you get it wrong
The words	Write these down	Nothing, at the moment it appears	Everything, whenever they leak
Connect	May this site see your wallet	Your public address and the right to ask	Little on its own
Approve	Confirm this action	The movement, or permission to move later	The amount, or the standing permission

People guard the wrong screen

Put the three side by side and a pattern appears that explains most of the losses.

Screen one cannot hurt you at the moment it appears. It hurts you months later, when the photograph you took of it is sitting in a cloud account behind a reused password.

Screen two is the one people hesitate over, and on its own it is close to harmless.

Screen three is the one that moves the money, and it is the one people tap fastest. By the time it appears they are three clicks into something they want, and the box is in the way.

The attention is almost exactly inverted. A newcomer will spend a minute deciding whether to connect, then approve the next prompt in under a second without reading a word of it.

Slowing down on the third screen costs you nothing at all. If your wallet shows a preview of what is about to happen, that preview is the entire point of the screen, and a warning on it is not a formality.

A few seconds of hesitation on the last screen is worth more than an hour of caution on the first two.

None of this takes expertise. It takes reading one box you were about to wave through.

Inside a dark stone fortress hall, two tabby cats in burnished gold armor stand rigidly at attention guarding an enormous bolted and chained iron gate, while a few feet away on the same wall a small plain wooden side door hangs wide open and unguarded, spilling warm orange light into the hall with muddy footprints leading out through it — The gate everyone watches is bolted anyway. The money leaves through the door nobody is looking at.

The first ten minutes, in order

If you are making a wallet today, this is the order that avoids the common mistakes.

Install the app from the official store listing rather than from a link somebody sent you. Fake wallet apps exist and they are convincing.

Write the words on paper as they appear, in order, and check the spelling. Put the paper where you would keep a passport.

Do not photograph it, do not type it into a notes app, and do not read it aloud on a call.

Send a small amount in first, and confirm it arrives, before you send anything you would miss.

Then visit one site, connect, and read the next box slowly. The habit you build on your first approval is the one you keep.

Nobody legitimate will ever ask you for the words. Not a support agent, not a moderator who messages you first, not a helpful person in a group chat offering to fix a stuck transaction. That request is the scam itself, every single time.

If you remember one thing

The setup is not where the money is decided. The words are, and the third screen is.

Write the words down by hand and keep them offline. Treat connecting as low risk and approving as the real decision. Read the box before you tap it.

If you want the detail behind that third screen, how wallets actually get drained takes the mechanics apart properly. If the words themselves are still the confusing part, what a seed phrase actually is starts there and assumes nothing. And once you are holding something worth protecting, moving it to a second wallet is the step after this one.