NOTE

If you remember nothing else, remember these three rules:

1. Never share your seed phrase - with anyone, ever, for any reason
2. Verify everything twice - addresses, URLs, smart contract approvals
3. Use a hardware wallet for significant holdings

Your 12 or 24-word seed phrase is the master key to all your wallets and funds. Treat it accordingly.

• Write it on paper or stamp it on metal (fireproof)
• Store multiple copies in different physical locations
• Keep it completely offline - never type it into any device
• Use a passphrase (25th word) for an extra security layer

• Store it in cloud storage (Google Drive, iCloud, Dropbox)
• Take a screenshot or photo
• Enter it into any website or "wallet verification" prompt
• Share it with anyone claiming to be "support"

NOTE

Warning: Anyone asking for your seed phrase is trying to steal from you. Support teams will never ask for it. There are no "wallet validations" that require your seed phrase.

A hardware wallet stores your private keys offline on a dedicated device. Even if your computer is compromised, your funds remain safe.

| Wallet | Price | Best For | |---|---|---| | Ledger Nano X | ~$149 | Bluetooth, mobile support | | Trezor Model T | ~$219 | Touchscreen, open-source | | Ledger Nano S Plus | ~$79 | Budget, solid security | | Trezor Safe 3 | ~$79 | Entry-level, secure |

When to use a hardware wallet: Any time your holdings exceed an amount you would be devastated to lose. For most people, that threshold is around $1,000-$5,000.

Fake websites that look identical to real dApps. You connect your wallet, sign a transaction, and your funds are drained.

Protection:

• Bookmark official URLs - never Google-search for dApp links
• Check the URL character by character (uniswap.org vs uniswop.org)
• Use wallet security features like Blockaid (MetaMask) or Rabby's transaction preview

You receive unexpected tokens in your wallet. Attempting to sell or interact with them triggers a malicious contract that drains your assets.

Protection:

• Never interact with tokens you did not expect to receive
• Research any unknown token before attempting to move it
• Use a separate "burner wallet" for claiming airdrops

Accounts pretending to be Vitalik Buterin, Elon Musk, or major projects offering "send 1 ETH, get 2 back" giveaways.

Protection:

• No one is giving away free crypto for deposits. Ever.
• Verify accounts through official project websites
• Look for verified checkmarks and follower counts

"Support" agents DM you about wallet issues or offer "exclusive" presales.

Protection:

• Disable DMs from server members you do not know
• Legitimate projects will never DM you first
• All official communication happens in public channels

Long-con romance or investment scams where scammers build trust over weeks or months before convincing victims to invest in fake platforms.

Protection:

• Be extremely skeptical of investment advice from online acquaintances
• Verify platforms independently through multiple sources
• If returns sound too good to be true, they are

| Wallet Type | Purpose | |---|---| | Cold wallet (hardware) | Long-term holdings | | Hot wallet (MetaMask) | Daily DeFi interaction | | Burner wallet | Airdrops, test dApps, risky interactions |

When you interact with a dApp, you often grant it permission to spend your tokens. These approvals remain indefinitely.

Use Revoke.cash or Etherscan Token Approvals to:

• Review all active approvals
• Revoke permissions for protocols you no longer use
• Limit spending allowances

Before interacting with any token or dApp, verify the contract address on:

• Etherscan (Ethereum)
• Solscan (Solana)
• BscScan (BNB Chain)
• Polygonscan (Polygon)

Check for verified source code, holder distribution, and community trust.

Centralised exchanges (Coinbase, Binance, Kraken) hold your funds - but they can be hacked or freeze your account.

Best practices:

• Enable 2FA using an authenticator app (not SMS - SIM swaps are real)
• Use a unique, strong password via a password manager
• Enable whitelisting for withdrawal addresses
• Withdraw to your own wallet regularly - "not your keys, not your coins"
• Enable anti-phishing codes if the exchange supports them

Plan for the unexpected. Your loved ones should know:

1. That you own crypto (without revealing amounts)
2. Where to find your hardware wallet
3. Where to find your seed phrase
4. Basic instructions (or who to trust for help)

Services like Safe{Wallet} allow you to set up recovery mechanisms where:

• You designate trusted guardians
• If you are inactive for a set period, guardians can recover access
• No single guardian can act alone

• [ ] Seed phrase stored offline, never digital
• [ ] Hardware wallet for long-term holdings
• [ ] 2FA enabled on all exchange accounts (authenticator app, not SMS)
• [ ] Unique passwords via password manager
• [ ] Token approvals reviewed and revoked regularly
• [ ] URLs bookmarked, never Googled
• [ ] Separate burner wallet for risky interactions
• [ ] Recovery plan shared with trusted family

NOTE

Security is not a one-time task - it is a habit. Review your setup every few months.