Don't Get Drained: A Practical Guide to Staying Safe in Web3

Introduction

Web3 is exciting. It's also a minefield.

Every week, someone loses thousands of dollars not because they were careless by nature, but because they didn't know what to look for. Phishing links disguised as official announcements. Fake airdrop sites that drain your wallet the moment you sign. "Support agents" in Discord who ask for your seed phrase. These aren't rare edge cases. They are the daily reality of operating onchain.

The good news? Most of these attacks are avoidable. Not with advanced technical knowledge but just with a clear mental framework and a few practical habits. This guide will give you both.

1. The Core Mindset: Verify, Don't Trust

In traditional finance, there are layers of protection between you and a mistake — banks can reverse transactions, customer support can freeze cards, chargebacks exist. In Web3, none of that exists. Transactions are irreversible. If you sign something malicious, the funds are gone. There is no undo.

This means the entire responsibility for your security sits with you.

The phrase you'll hear in every serious Web3 community is: "Don't trust, verify." It means never assume something is safe because it looks official, comes from a familiar name, or is shared widely. Always check the primary source yourself.

That one mindset shift — from trusting appearances to verifying facts — is worth more than any security tool.

2. Hot Wallets, Cold Wallets, and Burner Wallets: Know the Difference

Before we get into specific threats, it helps to understand the different types of wallets and when to use each.

Hot Wallets

A hot wallet (MetaMask, Phantom, Rainbow) is connected to the internet. It's convenient and great for everyday DeFi interactions — but because it's always online, it's the most exposed to attacks. Think of it like the cash in your pocket: fine for small amounts, not where you keep your savings.

Cold Wallets

A cold wallet (Ledger, Trezor) is a hardware device that stores your private keys offline. It only connects to the internet when you physically plug it in to sign a transaction. For anything significant — NFTs worth real money, large crypto holdings — a cold wallet is essential. It's your vault.

Burner Wallets

A burner wallet is a fresh, empty wallet you create specifically for one interaction you're not sure about. If the site turns out to be malicious, only the burner wallet is exposed. Your main wallet is safe.

The rule of thumb:

• Store long-term holdings → cold wallet
• Active DeFi use → hot wallet with limited funds
• Interacting with anything new or unverified → burner wallet

3. How to Create a Burner Wallet (Step by Step)

Creating a burner is simple and takes under two minutes using MetaMask. Here's how:

Step 1: Open MetaMask and click your account avatar at the top right.

Step 2: Select "Add account or hardware wallet" → "Add a new account."

Step 3: Name it clearly — "Burner" or "Test Wallet" — so you never confuse it with your main wallet.

Step 4: Before using it, make sure you're viewing this new account (not your main one) in MetaMask. Check the address — it should be different from your usual one.

Step 5: Send only the minimum amount of ETH/SOL/BNB you need for gas fees to this wallet. Nothing more.

Step 6: Use it to interact with the new dApp or site. If nothing bad happens, you can consider moving to your main wallet next time. If something feels off or a transaction request looks strange, you've lost nothing.

Important: A burner wallet's seed phrase is just as sensitive as your main wallet's. If the wallet holds funds, protect its seed phrase the same way.

4. Before You Connect Your Wallet: A Checklist

Every time you're about to connect your wallet to a site or sign a transaction, ask yourself these five questions:

a. Am I on the right URL? Always type the URL directly or use a saved bookmark. Never click a link from a tweet reply, Discord DM, or Google ad. Scammers buy ads for fake versions of popular protocols — "uniswap-app.io" is not Uniswap.

b. Did I find this link from the official source? The only reliable link is one from the project's official, verified Twitter/X account (blue or golden checkmark with a long history), their official docs, or their GitHub. Cross-reference all three.

c. What is the transaction actually asking me to do? Before clicking "confirm," read what the transaction says. More on this in Section 6.

d. Is this site asking for my seed phrase? If yes: close the tab immediately. No legitimate dApp, protocol, or support agent ever needs your seed phrase. Ever.

e. Have I checked the contract address? For token interactions, make sure the contract address matches what's published on the project's official docs or a trusted explorer like Etherscan or Solscan.

5. How to Check If a Project Is Legitimate

Not sure if a project is real? Here's how to verify before you interact.

Check the official links

Start with the project's official Twitter/X. Look at:

• Account age — was it created last week?
• Post history — does it have consistent activity going back months?
• Verification — is it verified, and does the checkmark match the project type?

Then find the official website from the Twitter bio (not from a Google search, which can surface sponsored fake sites). Cross-check that URL against what's in their pinned tweet and their GitHub repository.

Check the team

Anonymous teams are not automatically a red flag — Bitcoin was built by a pseudonymous developer. But complete anonymity combined with unrealistic promises is a red flag. Look for:

Doxxed founders or a track record under a pseudonym Verifiable GitHub contributions A history of shipping what they promised

Check the contract on Etherscan / Solscan

Before interacting with any new token or protocol:

Look up the contract address on Etherscan (or Solscan for Solana) Check how long ago it was deployed Look at transaction history — is there unusual behavior? Check if the contract is verified (source code publicly viewable) or unverified (hidden code is always suspicious)

Use token checker tools

Token Sniffer (tokensniffer.com) — audits ERC-20 tokens for common scam patterns

De.Fi Shield — scans smart contracts for known vulnerabilities

GoPlus Security — checks if a token has honeypot behavior (you can buy but not sell)

6. Reading What a Transaction Is Actually Asking You to Sign

This is the skill most people skip, and it's the one that matters most.

When a dApp asks you to confirm something in MetaMask, you'll see a transaction preview. Here's what to understand:

Token Approvals (ERC-20)

If the pop-up says "Approve [Token] spending", you are not transferring tokens — you're giving the contract permission to transfer your tokens. Some approvals are unlimited ("unlimited allowance"), meaning the contract can take as many tokens as it wants, at any time, forever.

Legitimate DeFi protocols do request approvals — it's how they work. But you should:

• Check which contract you're approving (is it verified? does the address match what you expect?)
• Consider setting a custom spending limit instead of unlimited
• Revoke approvals when you're done with a protocol (see Section 8)

"setApprovalForAll" (NFTs)

This is the most dangerous approval you can sign. It gives a contract permission to move all NFTs in your wallet. Drainer sites specifically target this — they pose as NFT marketplaces or claim to let you "verify" your wallet, then get you to sign this.

If you see

setApprovalForAll

from a site you don't fully trust: do not sign it.

Signature Requests (off-chain)

Some requests don't cost gas and don't appear as blockchain transactions — they're off-chain signatures. These are used legitimately (logging into OpenSea, proving wallet ownership) but are also used by sophisticated drainers. If a site asks you to sign a message and it contains:

• Contract interaction data
• Token transfer data
• Anything that looks like a Permit signature

...treat it with the same caution as an on-chain transaction.

Use a Transaction Simulator

Before signing anything uncertain, use Tenderly or the Fire extension to simulate the transaction and see exactly what will happen before you approve it. Fire works directly in MetaMask and shows you "this transaction will send X tokens to Y address" in plain language.

7. Common Scam Types You'll Encounter

Phishing Links

The most common attack. You receive a message — Twitter DM, Discord, email — with a link to what looks like a real protocol. The URL is slightly different (uniswap-finance.com instead of uniswap.org). You connect your wallet, sign something, and it drains you.

Protection: Never click links from DMs. Always navigate to sites directly.

Fake Airdrops

A "free airdrop" appears in your wallet — tokens you didn't buy. The token description or metadata links to a site where you can "claim" more. That site will ask you to sign a transaction or approval that drains your actual assets.

Protection: Ignore unknown tokens in your wallet. Never interact with airdropped tokens from unknown sources.

Address Poisoning

A scammer sends a tiny transaction from a wallet address that looks almost identical to one you regularly send to — same first and last few characters, different middle. When you later copy your transaction history to find an address, you accidentally copy theirs.

Protection: Never copy addresses from your transaction history. Always paste from a verified source or your address book.

Drainer Sites

Sites that look exactly like real protocols — identical design, similar URL — but are designed to get you to sign a malicious transaction. Often spread via compromised Twitter accounts or paid ads.

Protection: Use the checklist in Section 4. Use a burner wallet for new interactions.

Fake Support DMs

Someone messages you privately, claiming to be from the support team of a protocol you just asked a question about. They offer to help. Eventually they ask for your seed phrase "to verify your wallet" or ask you to visit a link.

Protection: Real support is never private. Real support is never first. If you asked a question in a Discord server and immediately got a DM, it's a scammer who monitors public channels. Report and block.

8. How to Revoke Old Wallet Approvals

Every time you've approved a contract to spend your tokens, that approval stays active forever — unless you revoke it. Old approvals from protocols you no longer use are attack surface. If that protocol gets hacked, the contract could still drain you.

You should audit and revoke approvals regularly — at minimum every few months.

How to revoke on Ethereum/EVM chains:

Option 1: Revoke.cash (free, the standard tool)

Go to revoke.cash Connect your wallet (view-only mode is available if you prefer) You'll see a list of all active approvals — the token, the amount approved, and the contract that has permission Click "Revoke" next to anything you don't recognise or no longer use Confirm the transaction in your wallet (there's a small gas fee per revoke)

Option 2: Etherscan Token Approval Checker

Go to etherscan.io/tokenapprovalchecker Connect your wallet Revoke from the list shown

What to prioritise revoking:

• Unlimited approvals to contracts you don't recognise
• Approvals to old or deprecated protocols
• Any

  setApprovalForAll

  for NFTs from sites you no longer use

On Solana: The concept is slightly different — use the Phantom wallet's built-in token account management, or tools like SolanaFM to review and close unused token accounts.

9. Seed Phrase Safety: The Absolute Rules

Your seed phrase (12 or 24 words) is your wallet. Anyone who has it has everything in it, immediately and irreversibly.

Where to store it:

• Written on paper, stored somewhere physically secure (a safe, a locked drawer, a fireproof box)
• Optionally stamped on metal for fire resistance if your holdings are significant
• In your memory — though relying on this alone is risky

Where to NEVER store it:

• In a photo on your phone
• In your email drafts or sent folder
• In a notes app (Apple Notes, Google Keep, Notion, Evernote)
• In a screenshot saved to cloud storage
• In a text message to yourself
• In a password manager (seed phrases are not passwords — they require different security thinking)
• Typed into any website or app that asks for it

The rule:

No legitimate project, protocol, support agent, or person will ever ask for your seed phrase. If someone asks, it is a scam. Full stop, no exceptions.

10. What to Do If You Think Your Wallet Is Compromised

If you suspect your wallet has been compromised — unusual transactions, approvals you didn't give, assets moved without your action — move fast.

Step 1: Stop. Don't sign anything else from this wallet.

Step 2: Create a new wallet immediately. Generate a fresh wallet, write down the seed phrase on paper, and do not use the old wallet for anything.

Step 3: Move what you can. If you still have assets in the compromised wallet, move them to your new wallet as fast as possible. Be aware: if a drainer script is active, it may front-run your transfer. Move small amounts first to test.

Step 4: Revoke all approvals on the compromised wallet, if you haven't already.

Step 5: Understand what happened. Did you sign something? Click a link? Which app or site did you use? This helps you avoid repeating it and helps warn others.

Step 6: Assume the seed phrase is exposed. If the wallet is drained through a seed phrase leak rather than a bad approval, the wallet is permanently compromised. Never use it again. Move on.

Conclusion: Security Is a Habit, Not a Feature

Web3 security isn't complicated — it's consistent. The people who stay safe aren't necessarily more technical. They're just more deliberate. They pause before signing. They verify before clicking. They use burner wallets. They revoke approvals. They never share their seed phrase.

The scams in this space are sophisticated and constantly evolving, but they almost always rely on one thing: making you act fast. Fake urgency — "claim in the next 10 minutes," "exclusive whitelist ending now" — is the mechanic behind most successful attacks. The moment you feel rushed, that's the moment to slow down.

One final check to add to your mental model: if something feels too good to be true in Web3, it almost certainly is. High APYs with no explanation, guaranteed returns, free tokens that need you to "activate" them — these are the hallmarks of a trap.

Build the habits. Use the tools. Verify, don't trust.

Your wallet is your responsibility — and that's also what makes it truly yours.

Tools referenced in this guide:

• Revoke.cash — revoke token approvals
• Token Sniffer — audit ERC-20 contracts
• GoPlus Security — honeypot detection
• Tenderly — transaction simulation
• Fire browser extension — plain-language transaction previews
• De.Fi Shield — smart contract scanning
• Etherscan / Solscan — blockchain explorers for contract verification