On this page
Growing interest in cryptocurrency creates opportunities for both new users and scammers. Protecting your account starts with understanding the requests you receive and keeping control of your keys.
This guide explains everyday wallet precautions and patterns to recognise before you send funds, connect a wallet or sign a transaction.
Crypto security 101
Level up your knowledge
Start with the basics of accounts, wallets and transaction signing. Understanding what you are approving is more useful than relying on a familiar logo or an urgent message. Take time to learn how your wallet works before moving valuable assets.
Learn the fundamentals ↗Understand Ethereum wallets ↗Wallet security
Never share your recovery phrase
Your recovery phrase can restore control of your wallet. Anyone who has it may be able to access the associated accounts. Keep it private and offline. A support agent, giveaway organiser or website should never need your phrase to help you.
Learn about wallet recovery ↗Don’t take screenshots of your seed phrase/private keys
A screenshot can be copied into a photo backup, synced to another device or exposed by an app with access to your library. Record recovery information using an offline method and store it where only you or an authorised person can access it.
Use a hardware wallet
A hardware wallet keeps signing keys on a dedicated device. Review the destination and transaction details on that device’s screen before approving. Buying a device does not remove the need to protect its recovery phrase or understand the action being signed.
Try a hardware wallet
Compare device compatibility, recovery procedures and the assets you need to manage. Obtain devices from a trustworthy source and follow the manufacturer’s setup instructions. Never use a device that arrives with a prewritten recovery phrase.
Continue reading by opening the full article on a new page, or expand it here.
Choose how you would like to read the complete article.Double check transactions before sending
Check the recipient address, network, asset and amount before signing. Clipboard replacement and lookalike addresses can redirect a transfer. For an unfamiliar destination, consider a small test transfer and confirm receipt through a trusted channel.
Set smart contract spend limits
An approval may allow a contract to move a particular token from your account. Read the requested permission and consider limiting it to what you need. Review old approvals periodically, and do not confuse disconnecting a site with revoking an on-chain allowance.
Common scams
Twitter ad phishing
A sponsored post or familiar profile image does not prove that a link is safe. Impersonators can copy branding and advertise a fake claim or token offer. Use a previously verified address or bookmark rather than following an unexpected promotional link.
Giveaway scam
Be wary of an offer that asks you to send cryptocurrency before receiving a larger reward. A polished page, countdown or set of enthusiastic replies can all be fabricated. Confirm announcements through independently verified sources.
Celebrity giveaway
Scammers reuse interviews, public talks and familiar faces to suggest an endorsement. A live-looking video or large viewer count is not evidence that a giveaway is legitimate. Do not transfer funds in response to a promise that they will be doubled.
Support scams
Unsolicited helpers may approach you after you ask a public question. They might direct you to a fake troubleshooting page or ask you to synchronise, validate or recover your wallet. Do not disclose a recovery phrase, install remote-control software or sign an unexplained transaction.
“Get rich” token scam
A token can have an impressive website and an active community while still being unsafe. Check who controls the contract, whether selling is restricted and what permissions are being requested. Promises of guaranteed returns are a reason to pause, not to hurry.
Phishing scams
A phishing site imitates a service you recognise to obtain credentials or a harmful signature. Check the full hostname and watch for altered spelling. HTTPS encrypts a connection; it does not establish that the site operator is trustworthy.
- Open services from your own verified bookmarks.
- Read wallet prompts before you approve them.
- Stop if a site asks for a recovery phrase.
Crypto trading broker scams
An apparent broker may show invented profits and then demand another payment to unlock withdrawals. Do not assume an account dashboard represents money you can recover. Verify the company independently before sending funds or identity documents.
Crypto mining pool scams
An invitation to a high-yield mining or liquidity programme may conceal a token approval. Read what the wallet actually asks you to authorise. A small initial payout does not prove a service is legitimate, and extra payments may not recover lost funds.
Social media hacks
A real account can be compromised. If a normally trustworthy person suddenly posts an investment offer or asks for a transfer, verify the request using another established communication channel. Account badges are not a substitute for checking the request itself.