Protect the secret material first
Seed phrases and private keys control wallet signing authority and should remain under the user’s control. They are not required for routine support, DApp login, transaction cancellation, or promotions.
Keep backups separate from everyday online activity and avoid casual screenshots, chats, or cloud copies.
Reduce transfer risk to three checks
Before sending, verify destination address, network, and amount. Similar-looking addresses, clipboard replacement, and wrong-chain transfers are practical failure modes.
For an important destination, a small test transfer can add an extra verification step.
Review signatures and approvals independently
A connected DApp is not automatically entitled to every later request. Check signatures, transactions, and token approvals one by one, including site, account, chain, contract, and permission scope.
Unused allowances can be reviewed separately from connection sessions.
Device context affects wallet safety
Shared computers, unknown browser extensions, remote-control tools, and public networks can make it harder to trust what appears on screen.
Use a device you control for important asset actions and stop if clipboard or prompt behavior looks abnormal.
Recognize social engineering patterns
Scams often use urgency, fake support, fake airdrops, account-freeze claims, or recovery promises to bypass normal checks.
Official staff do not need a seed phrase, private key, or verification code, and should not ask to control your wallet remotely.
The most effective checks happen before confirmation.
Build a repeatable security routine
Use the same sequence every time: keep recovery material offline, verify transfer details, validate DApp domains, read each wallet prompt, and clean up unused permissions afterward.
What to do when something looks wrong
For high-value or unfamiliar actions, add a second review or small test. The purpose is to create more opportunities to catch a mismatch before confirmation.
If you suspect exposure, stop creating new transactions, preserve public transaction details, and assess device, approvals, and asset state without sharing secret material.
- Keep recovery material private and offline
- Verify address, network, and amount before sending
- Review each signature and approval separately
- Avoid important wallet actions on uncontrolled devices