Handing it over yourself is more common than being hacked. The failures that actually happen.
Creating a personal wallet gives you a recovery phrase of twelve to twenty-four words. That phrase is not a password; it is the wallet. Anyone who knows it can restore the wallet anywhere and take what is in it. Lose it, and there is nobody who can return it to you.
Most losses come not from sophisticated attacks but from users entering their recovery phrase into a fake site or application. Prompts such as 'your wallet needs resynchronising' or 'verify to claim your airdrop' are typical. Outside a legitimate wallet restore, there is essentially no reason to enter the phrase anywhere.
Mistyping an address, or sending over an unsupported network, simply loses the funds. There is no bank to cancel or trace it. For large amounts, people send a very small test transfer first, confirm arrival, then send the rest. Copy addresses rather than transcribing them, and check the first and last few characters in case the pasted value was altered.
Connecting a wallet to a service grants that service permission to move your assets. A granted permission does not expire on its own, so if the service is later compromised, that standing permission can be used to drain funds. Revoking approvals for connections you no longer use is the safer habit.
Keeping everything in one wallet means a single incident ends it. Splitting a small everyday wallet from long-term storage, and keeping the latter on something not connected to the internet, is widely practised. Writing the recovery phrase on offline media such as paper or metal and keeping copies in separate places covers both loss and fire.
Wallets fall broadly into exchange wallets, software wallets and hardware wallets. Exchange wallets are convenient because the exchange manages the keys, but you have to trust the exchange. Software wallets — phone apps or browser extensions — let you hold the keys, but become risky if the device is infected with malware. Hardware wallets keep the keys inside a device separated from the internet and connect only to sign, so they resist remote attacks; but if you lose the device and the recovery phrase, recovery is just as hard. Buy hardware wallets only through the manufacturer's official channels, never second-hand or from unclear sellers.
Following a few rules when you create a wallet avoids most common accidents. Install the app via the link on the official website or by its exact name in an official app store, not through search ads. When the recovery phrase first appears, write it on paper by hand; don't photograph it or save it in a notes app or messenger. Then use the wallet's confirmation step to verify you wrote it correctly. Next, try one small deposit and withdrawal, and if possible, practise restoring the wallet on another device from the phrase, so you won't panic when you actually need to.
If you think you've entered your recovery phrase somewhere, or you see a withdrawal you didn't make, time is everything. Move the remaining assets to a newly created wallet immediately and stop using the old one. Create the new wallet on a different device, not the one you suspect is compromised. If an approval you granted to a service seems to be the cause, revoke it first. If the assets have moved to an exchange, report it to that exchange and the police right away. People or firms offering to recover your funds are mostly running a second scam; never pay upfront or hand over a recovery phrase.