Staying safe: phishing, approvals, scams

In a system built on self-custody, you are the security perimeter. There's no fraud department, no chargeback, no reversal — a confirmed transaction is final. That makes security the discipline the space runs on. The good news: most losses come from a small number of well-understood attacks.

Phishing is the number-one threat

And it rarely looks like "hacking" — it's deception. Fake websites mirroring a real protocol (often promoted through paid search ads above the real link), fake wallet popups, fake "support" agents in your DMs, fake airdrop and giveaway pages. The goal is always one of two things: trick you into typing your seed phrase (never enter it into any website, ever), or trick you into signing a malicious transaction.

The subtle, modern killer: the token approval

To let a DeFi app move your tokens, you grant it an approval — on-chain permission to spend a given token from your wallet. This is normal and necessary, but many apps request unlimited approval by default, and a malicious or compromised contract holding an unlimited approval can drain that token at any future moment, with no further action from you. You signed once; the door stays open. Vast sums have been stolen this way — not by cracking keys, but by getting people to willingly sign a permission they didn't understand.

Your defensive toolkit

• Never share your seed phrase. No website, app, or person needs it.
• Read what you sign. If a "claim free tokens" page asks to approve spending of an unrelated token, stop.
• Bookmark real sites and use the bookmarks instead of search ads or DM links. Verify URLs character by character.
• Use a hardware wallet for meaningful holdings — it forces a physical confirmation per signature.
• Use a "burner" wallet with limited funds for minting and unfamiliar apps, kept separate from savings.
• Revoke old approvals periodically with a reputable tool, and prefer exact-amount approvals over unlimited.
• Slow down. Urgency ("limited time," "claim now") is the scammer's primary weapon; real opportunities survive a five-minute pause.
• Assume unsolicited contact is hostile. Real support never DMs first, and free money is bait.

Why it matters. Self-custody hands you a power genuinely new in history — money no one can freeze, seize, or reverse. But power without responsibility is a fantasy, and the responsibility lands here with full weight. The cypherpunks never promised a safe world; they promised a free one, and freedom means the consequences of your choices are truly yours. Navigating this safely isn't bureaucratic caution — it's the practical discipline of sovereignty.