Keep your ENSv2 .eth name on a cold wallet, and give your everyday hot wallet the roles to edit its records. The cold wallet, which you keep offline, is then the only one that can transfer the name or lock the hot wallet out of the records if it is compromised.
This is for ENSv2 names. For a name not yet upgraded, see Protect your name from wallet theft (v1 names).
How to set it up
Open the Ownership tab. Go to explorer.ens.domains, connect the wallet that holds the name, search for it and open Ownership. The buttons there depend on your name; follow the prompts.
Put the name on your cold wallet. If it's on your hot wallet, select Transfer, enter your cold wallet's address and check it.
Turn off Detach the resolver, so the name keeps its records.
Select Transfer name and approve. If it's already on your cold wallet, skip this step.
Give your hot wallet(s) the roles to edit records. If it registered or upgraded the name, it usually holds them already, and keeps them after the transfer.
The name's Roles tab shows which wallets do. If not, give it the roles it needs, such as Set Address and Set Text: see Grant resolver 'roles' to edit name records.
If no wallet you hold can give them, connect the cold wallet and point the name at a fresh resolver first.
Check the result. Ownership shows the cold wallet. Make sure the ETH address points at your hot wallet; if not, set it on the Records tab from the hot wallet.
 |
Common questions
What does this protect, and what not?
A hot wallet connects to apps every day, so it's the one most likely to be tricked into signing. A thief with it can change records or redirect payments sent to the name, but can't take the name: only the wallet that holds it can. From the cold wallet you can point the name at a fresh resolver, then fix your records.
My hot wallet has been compromised. What should I do?
Stay calm and check what changed. If the hot wallet still holds the name, transfer the name to a new wallet. After you safeguard the name, you can look at other roles and records. See Recover a .eth name from a compromised wallet.