Your wallet and security
How your account and in-game wallet work, what the server can and can't see, and how to keep your recovery phrase safe.
Chain Tycoon doesn't use a browser extension like MetaMask or Phantom. When you create an account, the game creates a wallet for you, on your device.
What happens when you sign up
- Your browser creates a 12-word recovery phrase. From it come one EVM address (the same on Base, Arbitrum, BNB Chain and Avalanche) and one Solana address.
- Your password is stretched on your device (PBKDF2-SHA256, 600,000 rounds) and split into two keys: one proves it's you to the server, the other locks your phrase with AES-256-GCM.
- The server stores only the locked phrase and a hash of the first key. It can't open your wallet and can't move your tokens.
- You write the 12 words down and pass a quick check before you can play.
When you sign in on another device, the locked phrase is sent to that device and opened there with your password.
Your recovery phrase
The 12 words are the only way back into your wallet if you forget your password.
- Write them on paper and keep it somewhere safe. Don't keep a photo or screenshot of them.
- Anyone who has the words can take everything in the wallet.
- Chain Tycoon will never ask for your phrase or password: not in chat, not in DMs, not on X. Anyone who asks is trying to rob you.
- The in-game chat refuses to send anything that looks like a recovery phrase or a private key.
Forgot your password
On the sign-in screen, choose Forgot password?, then enter your email, your 12 words and a new password. Your wallet stays the same.
If you lose both your password and your 12 words, nobody can recover the wallet, including us.
Signing
Your wallet signs only what it has checked itself. Before you join a paid table it rebuilds the request from the amount you agreed to; on Solana it reads every instruction and refuses anything unexpected. You don't pay network fees: the game's relayer pays them (see Tables, stakes and payouts).
Good habits
- Use a password you don't use anywhere else, at least 10 characters.
- Sign in only at the game's own address. Bookmark it.
- Lock your phone and computer. Anyone with your unlocked device and your session can play as you.