Stay safe: seed phrases, phishing, approvals

Most people who lose crypto lose it the same handful of ways. Read this once and you'll be ahead of 90 percent of the market.

Your seed phrase, again

Because it's worth repeating:

• Paper only. Two copies, two locations.
• Never in a photo, cloud note, password manager, email, or chat.
• No one legitimate ever asks for it. Not support. Not a "sync tool." Not the airdrop page. No one.
• If you ever type it into anything that isn't a fresh install of your own wallet during a restore, assume compromise and move funds now.

Phishing, the modern flavor

The greatest hits:

• Google/Bing ads for wallet names. The top result is a paid ad, and it's often a lookalike domain. Type the URL yourself or bookmark it.
• Telegram or Discord DMs from "support." Real support does not DM first. Any DM offering to help is an attack.
• Airdrop landing pages. You didn't earn a free $500 in tokens. Signing to claim it hands over approval to drain everything else in the wallet.
• Fake browser extensions. Always install from the wallet's official website, following the link they publish, not from search results.
• "Recovery services" for lost funds. Nobody can recover crypto. Anyone claiming they can is running a second scam on top of the first one.

Token approvals: the silent killer

On Ethereum and every EVM chain, when a site wants to move a token on your behalf, you sign an approval. Many sites ask for an unlimited approval by default, because it's convenient. Convenient for them, and for anyone who later compromises the site.

Habits that fix this:

• Use a wallet that shows approvals in human language. Rabby is very good at this.
• Set custom approval amounts (just the amount you're actually swapping) when the wallet lets you.
• Every couple of months, visit revoke.cash and clear out old approvals you don't use.

Split your wallets

Three wallets is a good baseline:

• Vault: hardware wallet, only receives. Never connects to any site. This is where the bag lives.
• Hot spending wallet: small balance for paying vendors and daily use. If it gets drained, you lose lunch money.
• Degen wallet: the one you connect to random dapps, mint pages, and airdrop sites. Assume it will get drained one day. Keep it near-empty.

Two-factor auth on exchanges

If you use exchanges at all, put an authenticator app on them (Aegis on Android, Raivo or 2FAS on iOS, or Yubikey if you're serious). SMS 2FA is worse than nothing. SIM swaps are a real thing and they specifically target people with crypto.

That's the crypto chapter for now. If there's something specific you want covered next, drop it in the chat or open a thread in site feedback.