Start here: crypto safety in 10 rules
The ten habits that stop nearly every common crypto theft, from seed phrase leaks to wallet drainers. Read this first.
On this page
- 1. Your seed phrase never goes into a website
- 2. Keep savings and experiments apart
- 3. Get links from the source, never from replies or DMs
- 4. Read what you sign
- 5. Nobody legitimate DMs you first
- 6. Use a hardware wallet for anything you cannot afford to lose
- 7. Lock down the accounts around your crypto
- 8. Revoke approvals you no longer need
- 9. Slow down when there is urgency
- 10. If something goes wrong, act fast and in the right order
Most crypto losses do not come from clever hacks of blockchains. They come from people being tricked into giving away a seed phrase, signing a malicious transaction, or installing fake software. The good news is that a short list of habits blocks almost all of it.
1. Your seed phrase never goes into a website
The 12 or 24 recovery words control everything in your wallet. The only place they should ever be typed is the wallet app or hardware wallet itself, when you are restoring it. No airdrop, support agent, "wallet validation", "sync" or "rectification" page legitimately needs them. Anyone who asks is stealing.
2. Keep savings and experiments apart
Use at least two wallets: a vault that holds most of your funds and almost never connects to anything, and a daily or farming wallet that connects to new sites and holds only what you are willing to lose. See wallet separation.
3. Get links from the source, never from replies or DMs
Fake claim pages are spread through reply threads, sponsored search results, DMs and hacked Discord announcements. Bookmark the official site once, from the project's own website or verified account, and use the bookmark.
4. Read what you sign
A signature can be as dangerous as a transaction. Requests named Permit, setApprovalForAll, increaseAllowance or an unreadable blob of text can hand over your tokens without any visible transfer. If you do not understand what a signature does, reject it. See signature drainers.
5. Nobody legitimate DMs you first
Real support teams do not open conversations with you on Telegram, Discord or X. Real projects do not send you private claim links. Treat any unsolicited message about your wallet, account or "eligibility" as a scam until proven otherwise.
6. Use a hardware wallet for anything you cannot afford to lose
A hardware wallet keeps your keys off your computer and shows transaction details on its own screen. It does not protect you from signing something bad, but it does protect you from malware that steals keys. See hot vs cold wallets.
7. Lock down the accounts around your crypto
Your email, phone number and exchange accounts are part of your security. Use a password manager, unique passwords and an authenticator app or security key instead of SMS codes. See two-factor authentication.
8. Revoke approvals you no longer need
Every "Approve" you clicked in DeFi may still let that contract move your tokens. Review and revoke old approvals regularly. See token approvals.
9. Slow down when there is urgency
"Claim ends in 2 hours", "your wallet is compromised, act now", "only 50 spots left". Urgency is the scammer's main tool, because it stops you from checking. A real airdrop does not disappear because you took ten minutes to verify it.
10. If something goes wrong, act fast and in the right order
Move remaining funds from a clean device to a new wallet, revoke approvals, and secure your accounts. Then report. And ignore anyone who offers to "recover" your stolen crypto for a fee: that is a second scam. See I've been hacked.
Warning: This site never asks you to connect a wallet, sign a message or enter a seed phrase. There is nothing to claim here. If someone sends you a link to an "Airdrop Safety" claim page, it is fake.