Keep the Owner of your v1 .eth name on a cold wallet, and its Manager and ETH Address on your everyday hot wallet. The cold wallet, which you keep offline, is then the only one that can transfer the name or take the Manager back if the hot wallet is compromised.
This is for v1 .eth names that show an Owner and a Manager on the Ownership tab in ENS Explorer. For a name on ENSv2, see Protect your name from wallet theft (v2 names).
How to set it up
Open the Ownership tab. Go to explorer.ens.domains, connect the wallet that holds the name, search for it and open Ownership. The buttons there depend on your name; follow the prompts.
Put each role on its wallet. To move only the Owner, select Transfer, enter your cold wallet's address and check it. Turn off Transfer the manager role too and Detach the resolver, so the Manager stays put and the name keeps working. If the Owner is already on your cold wallet, use Change manager to put the Manager on your hot wallet.
Check the result. Ownership shows the cold wallet as Owner and the hot wallet as Manager. Make sure the ETH address still points at your hot wallet; if not, edit the name's records.
 |
Common questions
What does this protect, and what not?
A hot wallet connects to apps every day, so it's the one most likely to be tricked into signing. A thief with it can change records or redirect payments sent to the name, but can't take the name: only the Owner can. From the cold wallet you can take the Manager back, then fix your records.
Why is there no Manager on my name?
Your name may be wrapped in the Name Wrapper. A wrapped name has no separate Manager, so this setup won't work for it. On the name's page in ENS Explorer, Unwrap and upgrade takes you to the ENS App's upgrade page.
My hot wallet has been compromised. What should I do?
Stay calm and check what changed. If the hot wallet is still the Owner, transfer the name's Owner to a new wallet. After you safeguard the Owner, you can look at other roles and records. See Recover a .eth name from a compromised wallet.