Five parts in, you know why ETH has no hard cap, how the EVM treats accounts, where gas actually goes, what staking costs and pays, and how rollups compress mainnet data. This part is the assembly. It is the shortest in the series because the hard work is done — what remains is turning the theory into the handful of daily moves that protect your coins.
Holding ETH is the mirror image of holding BTC. One account covers what UTXOs spread across many outputs, so coin selection disappears. In its place, a different risk surface: token approvals, signed messages, and addresses that look almost right. The job is to internalize those and make them cheap to check.
Your ETH address in Zelcore
For a seed phrase account, Zelcore derives your Ethereum address at the BIP-44 path m/44'/60'/0'/0/0. Coin type 60 is the SLIP-0044 registration for Ether (SLIP-0044 registry). Wallets that use the same path and account index, such as MetaMask, therefore generate the same 0x address from the same 12, 18 or 24 words, as long as no extra BIP-39 passphrase is involved. Zelcore restores standard BIP-39 phrases but doesn't support an extra BIP-39 passphrase (Zelcore import guide), so a phrase protected by one can't be restored here. Not every wallet uses that path or the first account, so after restoring a phrase anywhere, check that the address matches the one holding your funds before you move anything. Legacy username and password accounts, which Zelcore still supports but is phasing out, are different: their wallets come from those credentials, not from a seed phrase (Zelcore account types).
Because of the EVM account model covered in Part 2, that one address covers native ETH, every ERC-20 you hold, every NFT, and every dApp you connect. There are no UTXOs, no change addresses, no per-transaction churn. Zelcore shows the same 0x across Ethereum mainnet and most of the EVM-compatible chains it supports — Polygon, BNB, Avalanche, Base — because they all derive from the same secp256k1 key.
The trade-off is visibility. One address means one on-chain history that anyone can read. Confirm the first-derived address against a block explorer on receipt, paste it into your address book, and check that entry against the original again before you share it.
Gas hygiene: reading the fee UI
Every Ethereum fee is base fee plus priority tip, expressed in gwei, multiplied by the gas units the transaction actually consumes. Base fee floats with block fullness; the tip is your bribe to the proposer. Part 3 covered the mechanics in full — how EIP-1559 base fee and priority tip actually work (Part 3) is the reference page to re-read when a fee spike surprises you.
Three transaction shapes cover almost everything you will do:
- Native ETH send to an ordinary account: a standard ETH transfer requires 21,000 units of gas (ethereum.org gas guide). Sending ETH to a contract, or to an account with an EIP-7702 delegation, can run code and cost more, so go by the estimate Zelcore shows.
- ERC-20 transfer: roughly 40,000–65,000 gas, at the higher end when the recipient's balance of that token starts at zero: a storage write whose original value is 0 is charged the set cost rather than the lower reset cost (EIP-2200). More than a native send because the token contract has to update two balance entries.
- Contract call: a token approval usually costs about as much gas as a token transfer, while swaps and mints vary widely and often cost much more. Always read the estimate before confirming.
Zelcore's fee UI exposes Economy, Normal, and Fast tiers, which set a max priority fee and a max fee cap. You pay base plus tip on inclusion; any headroom between that and your max fee is refunded. Two rules cover most days. Size the tip to what you actually need — if you are not racing an NFT mint, Economy is fine. And before you bridge to an L2 to save on fees, compare the actual L1 fee with the full bridge round trip covered below: when mainnet fees are low, staying on L1 can cost less and avoids bridge risk.
If a transaction gets stuck pending, resubmit with the same nonce and raise both the max fee and the tip; Geth, a widely used Ethereum client, rejects a replacement unless both rise by its price-bump threshold (go-ethereum transaction pool code). It is the ETH equivalent of Bitcoin's replace-by-fee.
Approvals and drainers: the EVM-specific attack surface
Before a dApp moves your ERC-20 tokens it needs an allowance — a state change that writes allowance[you][spender] on the token contract. Many dApps default to approve(max), the unlimited option. Convenient, and catastrophic if the contract is exploited or upgraded by a compromised multisig.
Permit2, Uniswap's universal approval contract, raises the stakes. Before an app can request your tokens through Permit2, you must approve the Permit2 contract through the specific token contract (Uniswap Permit2 repository). Apps often suggest an unlimited amount; approve only what you plan to spend. After that, Permit2 works through signatures of two kinds. The AllowanceTransfer contract gives a spender permission over a specified amount for a specified duration of time, while the SignatureTransfer contract moves tokens directly to the signed spender, bypassing setting any allowance, so that signature leaves no spender sub-approval behind (Uniswap Permit2 repository). Your token's own approval to the Permit2 contract stays in place either way: Revoke.cash recommends revoking that regular approval to the Permit2 contract itself when you are not using it anymore, and the revoke.cash web app below can do it. The messages are gasless, which is lovely ergonomics until you sign a malicious one on a homograph domain. A single bad signature can move the tokens it covers.
A widely used audit tool is the revoke.cash web app, which lists the token allowances and Permit2 approvals it finds for your address across many chains and lets you revoke them. It cannot list a permit signature that has not been used on-chain yet. If you suspect you signed one on a scam site, you may be able to cancel it before the scammer activates it, and once activated it shows up as an approval you can revoke (Revoke.cash on permit signatures). If you think you signed a bad Permit2 message, revoke that token's approval to the Permit2 contract right away, then check your recent transfers and your other tokens' Permit2 approvals. Make a review a quarterly habit: set a calendar reminder, open the web app, and clear anything you do not actively use.
Two rules that pay for themselves. First, before you sign a Permit2 message, check the site's domain against a bookmark or another source you trust and read exactly what the request grants: which token, which spender, how much and until when. Typing the URL helps, but it does not prove a site is genuine. Second, do not assume your ETH is out of reach when a drainer fires. Native ETH can leave through a transaction you sign, through a malicious EIP-7702 delegation on your account, or through a leaked seed phrase or key. Phishing sites trick users into signing a direct transfer of an asset to the attacker's wallet, often disguised as a function named "Claim" or "Security Update" (Revoke.cash scam recovery guide). So if ETH goes missing, check your recent transactions and whether a delegation is set on your account, not only whether your key leaked. If ETH is taken again right after each new deposit, suspect a leaked seed phrase first, but a malicious delegation, covered above, can also move ETH, so check both before you decide what to do. If key compromise looks likely, act quickly: once you are confident your computer is clean, create a new wallet and transfer any remaining assets to it (Revoke.cash scam recovery guide). If the evidence points to an approval or a delegation instead, revoke the approval or clear the delegation. Limiting approvals to what you are spending, not max, contains the blast radius of a bad approval.
Address poisoning and other hygiene
Address poisoning weaponizes copy-paste. An attacker generates a vanity address whose first and last characters match a counterparty you transact with often, then pushes a tiny transfer to your wallet so the fake appears next to the real one in history. The next time you copy from transaction history instead of from a trusted address book, you send to the wrong address.
Defense is simple and disciplined. Never copy from transaction history. Copy from your Zelcore address book or from an address you have confirmed with the recipient through a channel you already trust, and verify the full string — not just the first and last four characters. A saved entry is not trustworthy forever: Kraken says deposit addresses on your account may expire, and deposits made to an expired address may be permanently lost. Before paying an exchange or anyone you have not paid recently, reconfirm their current address through a trusted channel, even when it is already in your Contacts. A signature alone proves nothing: an attacker can sign a message naming their own address. Clipboard malware works the same family of tricks at the paste step, silently swapping a 0x you copied for the attacker's. Always eyeball the destination after pasting.
For any poisoning dust that lands in your wallet, do not interact with it — hide the token in Zelcore and move on. The danger is usually where it points, not the asset itself: airdropped NFTs try to send you to a website, where they phish for your Secret Recovery Phrase or ask you to sign a fraudulent transaction (MetaMask NFT airdrop guidance).
When to reach for an L2
Before you move funds to an L2 or another EVM chain, compare the full round trip: the bridge fee, gas on both sides, and what it will cost to bring the funds back. Confirm that the receiving network is one your destination actually supports. Bridges carry their own risks, smart contract risk among them (ethereum.org on bridges).
Zelcore supports Ethereum rollups such as Base, Arbitrum and Optimism, as well as separate EVM chains such as Polygon PoS, BNB Smart Chain and Avalanche C-Chain. They are not the same thing. A sidechain is a separate blockchain that runs independently of Ethereum, connected to it by a two-way bridge; unlike layer 2 rollups, sidechains do not post state changes and transaction data back to Ethereum Mainnet and do not inherit Ethereum's security properties (ethereum.org on sidechains). BNB Smart Chain and Avalanche are independent networks with their own validators. WalletConnect v2 lets the same keys drive a dApp's own interface on the chains Zelcore supports without exposing them (a dApp that requires a chain Zelcore does not support is rejected).
Picking an L2 is mostly about where liquidity lives, which is the full subject of the optimistic-vs-ZK rollup comparison in Part 5. Base, Arbitrum, and Optimism carry the deepest DeFi pools; zkSync Era appeals to advanced users who want validity proofs over fraud proofs. Bridge via canonical bridges where you can, and plan for the withdrawal delay back to Ethereum, which varies by rollup and route: since the Beryl upgrade, Base's finalization window is 5 days for a single-proof dispute game and 1 day on the dual-proof fast path. A fast-bridge operator can front the funds sooner for a fee, using its own liquidity.
One subtle point that catches beginners: ETH on mainnet is not the same asset as ETH on Arbitrum. Same 0x address, separate balances on separate chains. Confirm which chain Zelcore is pointed at before you paste.
Staking, Pectra, and Fusaka
The full staking trade-off matrix from Part 4 lays out the four branches. In capsule form:
- Solo (32+ ETH, operational control, all yield and slashing risk)
- Delegated or pooled (an operator runs the validator; with non-custodial staking as a service you keep your withdrawal keys and hand over only the validator's signing keys, while fully custodial services hold both (ethereum.org on delegated staking); pools follow their own model, and fees vary by provider)
- LST like stETH or rETH (tokenized, DeFi-useable claim, smart-contract and peg risk)
- Just hold (zero yield, no validator slashing risk, simplest)
Pectra activated on May 7, 2025, and it changed staking mechanics materially (Ethereum Foundation Pectra announcement). EIP-7251 raised the maximum balance a validator earns on from 32 to 2048 ETH, so large operators can consolidate into fewer, bigger validators. EIP-7002 lets withdrawal credentials trigger exits without needing the validator key online — useful when a staking service fails and you still want your ETH back. And EIP-7702 lets an EOA delegate execution to contract code by writing a delegation indicator of the form 0xef0100 || address to the account; the delegation persists until it is changed or cleared, and while it is in place the delegated code runs whenever the account is called (EIP-7702). That unlocks gas sponsorship, batching, and session keys in ordinary wallets, and it also means a malicious delegation can move the account's ETH and tokens. We explain the EIP-7702 delegation phishing risk in a separate guide. Set a delegation only through your wallet's own upgrade flow, never because a website asks you to sign an authorization, and learn how your wallet clears a delegation before you set one.
Fusaka followed on December 3, 2025 (Ethereum Foundation Fusaka announcement). Its headline is EIP-7594, PeerDAS, where a regular node downloads about one-eighth of the original blob data instead of all of it (ethereum.org on PeerDAS). Fusaka also introduced Blob Parameter Only (BPO) forks to increase blob throughput after PeerDAS. BPO1 activated on December 9, 2025, raising the per-block blob target and maximum to 10 and 15, and BPO2 activated on January 7, 2026, raising them to 14 and 21 (Ethereum Foundation Fusaka announcement; EIP-8135, the BPO2 hardfork record). Any further increases depend on new scheduling. More blob capacity can lower the cost rollups pay to post data, but what you pay on an L2 still depends on demand and on each rollup's own pricing.
In Zelcore: holding ETH day to day
- After any restore, check your ETH address before moving funds. Open ETH in Zelcore, tap Receive, and compare the address with the one your balance sits at on a block explorer.
- Save the addresses you pay as Contacts in Zelcore and send from there, comparing the full address on the send screen every time. Reconfirm a saved address with the recipient before a new payment, since exchange deposit addresses can change or expire.
- Choose the fee under Select Speed when you send ETH or an ERC-20: Economy for anything that is not urgent, Fast only when timing matters.
- Hide poisoning dust under Manage Assets instead of sending, swapping or approving it.
- Review your approvals each quarter for your 0x address on the revoke.cash web app and revoke any you no longer use.
- Before you bridge, confirm the network in Zelcore (Ethereum, Base, Arbitrum, Polygon and so on) matches the one your destination supports.
That is the full arc: from why ETH has no hard cap to where your coins should actually live. The chain changes every year — Pectra in May 2025, then Fusaka and its two Blob Parameter Only forks over the following winter. The reasoning in these six parts should compound.
