CRYPTO SELF-CUSTODY GUIDE

Crypto Safety Scam Wall

Not your keys, not your coins.

Scam Wall

02 Robbed? 04 Checklist 05 Stolen! 06 Self-Check

Community blacklist. Search before you send.

Reports are community-sourced. DYOR.

Safety Handbook

Cold/hot wallets · how scams work · seed phrase rules · checklist · emergency response.

01

Cold vs Hot Wallet

Wallets don't store coins — they store keys. Choosing where to keep your keys is the first security decision.

COLD · OFFLINE

Cold Wallet

Keys never touch the internet. Like a bank vault.

Hardware (Ledger, Trezor, Keystone) · paper wallet · offline-only phone.

HOT · ONLINE

Hot Wallet

Keys are online. Like your pocket wallet — convenient but exposed.

Exchange accounts · MetaMask · Trust Wallet · browser extensions.

LayerWhere% of fundsPurpose
Long-termHardware wallet + offline backup70–90%Hold, never move
ActiveHot wallet / exchange5–20%Trading, DeFi
ExperimentsSeparate throw-away address≤5%NFTs, airdrops
02

How You Get Robbed

Over 90% of losses are user-side mistakes, not blockchain hacks.

Phishing Sites

Fake exchange/wallet sites that look identical. Enter your seed phrase, funds vanish.

Fake Apps

Counterfeit Ledger Live, MetaMask on app stores. Import seed = instant drain.

Unlimited Approvals

"Connect wallet" sites asking for unlimited approval can drain you anytime.

Social Engineering

"Support" on Telegram/Discord asks for seed phrase or "verification transfers".

Clipboard Hijack

Malware swaps your copied address mid-transfer. Always check first/last chars.

Exchange Failure

Exchange hacks, insolvency (FTX), frozen withdrawals. Funds on exchange aren't yours.

Rug Pulls

Contract backdoors, liquidity drains, abandoned projects. Tokens go to zero.

Recovery Scams

After a hack, "recovery experts" DM you asking for upfront fees. Second scam.

03

Seed Phrase Rules

1

Write it on paper/metal only

Never screenshots, notes apps, cloud, WeChat, email. Phones die, clouds get hacked.

2

Generate offline

Airplane mode on. Hardware wallets are already offline.

3

Verify word order twice

One wrong word = wrong address = lost forever.

4

Two backups, two locations

Fire, flood, theft. Never in the same drawer.

5

Steel plate for large sums

Paper burns. Steel survives fire/water.

6

Tell no one

Real support never asks for your seed phrase.

7

Test with a tiny transfer first

Send $1, confirm you can send it out, then send the big amount.

Watch-only: On your online phone, import only the public address (not seed phrase) to view balances. Signing always happens on the hardware device.

04

Daily Checklist

Before connecting a wallet

Run through this every time

Check the URL spellingBookmark real sites. Extra letters, hyphens, weird TLDs = phishing.
SSL cert & domain ageClick the lock icon; newly-registered domains need extra caution.
Search project reputationTwitter/Discord/Reddit: project name + "scam / rug / phishing".
Use a separate wallet addressNever connect your main holding address to any dApp. Use a throw-away one.
Custom approval limitNever "Unlimited". Revoke at revoke.cash after use.

Before sending

On-chain transfers are irreversible — double check

Verify first 4 & last 6 charsClipboard hacks only change the middle;首尾 characters must match.
Confirm the networkUSDT exists on ETH/TRON/BSC — wrong network = lost forever.
Test with a tiny amount firstSend $1, confirm arrival, then send the rest.
Read on hardware screenDon't blind-confirm. Check address, amount, chain on the device screen.
05

If You Get Robbed

1

Stop immediately

Don't click anything else. Disconnect from the internet.

2

Check exposure

Look up your address on the block explorer. Any token = all exposed.

3

Move what's left

From a clean device, generate a new hardware wallet address, drain remaining funds.

4

Revoke everything

Revoke all approvals, change all passwords, log out all sessions.

5

Preserve evidence

Save TxHash, attacker address, screenshots. File a police report.

Beware recovery scams: After a hack, "recovery experts" DM you asking for upfront fees. They are almost always a second scam.

Bottom line: Convenience and security are trade-offs. Slow down. One hasty click can erase years of savings.

06

Quarterly Self-Check

Run through this list every quarter. Unchecked items = your risk exposure.

Wallet & Asset Structure

Long-term funds in hardware wallet, not exchange or hot wallet
Hot wallet / exchange holds only short-term funds
DeFi/NFT use separate address, isolated from holdings

Seed Phrase Backup

Seed phrase on paper/metal only, no digital copy
At least two backups in different physical locations
Large sums backed up on steel plate
Never shared seed phrase with anyone, including "support"

Accounts & Devices

Exchange and email have 2FA (not SMS)
Email uses unique strong password
OS and antivirus up to date
Unfamiliar browser extensions removed

Operating Habits

Real sites bookmarked, not from search/chat links
Verify address first/last chars and network before sending
Small test before large transfers
Read transaction on hardware screen, no blind confirm
Revoked old approvals monthly