Key custody comes first
Seed phrases and private keys represent wallet control and should remain under the user’s custody, preferably offline. Legitimate support will not ask for seed phrases, private keys or verification codes, and these secrets should not be sent through chat, email or web forms. The practical goal of key custody comes first is to separate on-chain facts from interface presentation; if the two disagree, verify public blockchain state first.
Domains and social-engineering cues
Phishing often starts with lookalike domains, fake support, fake airdrops and urgent language. A page that pressures immediate action, remote control or recovery information should be closed and re-verified from a trusted entry point. Because blockchain actions can create persistent or irreversible state, understanding domains and social-engineering cues should come before signing, approving or submitting.
Review signatures and approvals individually
Connecting a DApp does not make later requests trustworthy. Review message signatures, transaction signatures and token approvals separately, with particular attention to the network, contract, amount, spender and permission scope. Reviewing review signatures and approvals individually never requires giving anyone a seed phrase or private key; public state can be checked with addresses, transaction hashes and contract information.
Device and network hygiene
Wallet operations are best performed on a device you control, with software kept up to date and without untrusted extensions or unnecessary remote-control tools. Public Wi-Fi is not a reason to skip domain and transaction verification. Before moving on, make sure the fields related to device and network hygiene match the intended task. If an important field cannot be explained, stop and verify the source.
Three essential transfer checks
Before submitting a transfer, verify the address, network and amount, then inspect the token, gas and contract data where relevant. On-chain transactions are usually not reversible by a wallet provider, making the final review essential. If the interface does not match expectations, record the network, address or transaction hash and troubleshoot three essential transfer checks one variable at a time.
Contain risk before taking more actions
If phishing, a malicious approval or device compromise is suspected, stop new signatures and transfers, disconnect suspicious sessions, review on-chain activity and approvals, and assess from a trusted device whether assets should be migrated. In practice, place “contain risk before taking more actions” back into the context of the active account, network and intended target instead of judging the action from interface styling or button labels alone.
Use this list as a final review before you submit a transaction, signature or approval related to this topic.
- Keep seed phrases and private keys offline
- Verify domains from trusted entry points
- Review every signature and approval
- Check address, network and amount before transfers
- Stop and inspect on-chain state when something looks wrong
Never share a seed phrase, private key or verification code. A wallet provider generally cannot reverse a confirmed on-chain transaction, and third-party DApps or smart contracts can carry independent risk.