# Don't Get Wrecked: A Real Guide to Staying Safe in Web3 - Author: Aly (https://wurk.fun/user/Aly) - Published: 2026-06-11 - Canonical (HTML): https://wurk.fun/blog/don-t-get-wrecked-a-real-guide-to-staying-safe-in-web3-2 - Cover image: https://ik.imagekit.io/wurk/1001170904_I5Xs-Cz-B.png --- Every week someone loses thousands of dollars in crypto because they clicked the wrong link, signed the wrong transaction, or trusted a project that looked real but wasn't. The worst part is that most of these losses were completely preventable. Web3 moves fast and the ecosystem doesn't hold your hand. If you make a mistake onchain, there is no customer support to call and no chargeback to file. The money is just gone. This guide is not going to scare you away from crypto. It's going to give you the actual mental model and practical habits that protect you while you're in it. Whether you're a beginner who just set up their first wallet or someone who has been active in DeFi for years, there's something useful here for you. ***The Core Mindset: Verify, Don't Trust*** Before anything else, you need to understand the single most important principle in Web3 security. In traditional finance, there are systems built around trust. Banks verify your identity. Exchanges have compliance teams. There are regulators watching. In Web3, none of that exists by default. The blockchain itself is trustless in the technical sense, but the ecosystem around it is full of humans, and humans lie. The phrase you'll hear is "don't trust, verify." It means that no matter how legitimate something looks, no matter who shared the link, no matter how many people in a Telegram group are talking about it, you verify for yourself before you interact. You check the contract address against the official documentation. You look up the wallet address you're sending to before you send. You read what a transaction is asking before you sign it. ***KEY PRINCIPLE*** Assume every link, every DM, and every "official" message you receive is potentially fake until you have verified it yourself through trusted, primary sources. This is not paranoia. This is how people stay safe. Hot Wallets, Cold Wallets, and Burner Wallets Understanding the different types of wallets is foundational. Each one has a purpose, and using the right wallet for the right situation is one of the simplest ways to ![limit your exposure to risk.](https://ik.imagekit.io/wurk/1001170905_UUWkTX1ez.png) ![limit your exposure to risk.](https://ik.imagekit.io/wurk/1001170906_EtKsPJgN7.png) ![limit your exposure to risk.](https://ik.imagekit.io/wurk/1001170907_o9EL7Rppt.png) Think of it this way. Your cold wallet is your bank vault. Your hot wallet is your everyday wallet you carry around. Your burner wallet is the prepaid card you use when you don't want to hand your real card to an untrusted vendor. ***How to Create a Burner Wallet Step by Step***A burner wallet is just a fresh wallet address you haven't connected anywhere before. Creating one takes about two minutes. 1 Install a second browser profile or use a separate browser This prevents your main wallet extension from auto-connecting to sites. Chrome and Firefox both support multiple profiles. 2 Install a fresh wallet extension in that profile MetaMask, Rabby, or Phantom depending on which chain you're using. Do not import any existing seed phrase. 3 Create a new wallet and write down the seed phrase Even for a burner, store the seed phrase somewhere safe. You might need to access it later if you receive something valuable. 4 Send only what you need for the interaction If you're minting an NFT that costs 0.05 ETH, send 0.07 ETH to cover the mint plus gas. Nothing more. 5 Connect and interact, then move any assets out immediately After you've minted or claimed what you came for, send the assets back to your main wallet before doing anything else with the burner. Why This Works Even if a site you connected to is malicious, your main wallet is completely isolated. The worst that can happen is you lose what was in the burner wallet. Your real holdings are untouched. ***Before You Connect Your Wallet to Anything*** This is where most people skip steps. A site looks legitimate, the Discord is active, influencers are posting about it, so they connect their main wallet and sign whatever pops up. This is exactly how drainer attacks work. Here is what to check before you connect to any dApp or website. Verify the URL First The number one phishing vector in Web3 is a fake website with a domain that looks almost identical to the real one. Attackers will register uniswap-app.io or opensea.io.exchange.com and make it look pixel-perfect. Always go to the official project website by clicking their verified link from their official Twitter or documentation. Never use a link from a DM, a reply, or a search ad. Watch Out Google search results can show sponsored (paid) ads at the top that lead to fake phishing sites. Scammers pay for these ads deliberately. Scroll past ads to the organic results, or better yet, bookmark official sites once you've verified them. Check the Contract Address Before you interact with any token or protocol, find the official contract address from the project's own documentation or their official GitHub. Then search that address on Etherscan, Solscan, or the relevant block explorer and confirm it matches. If you can't find an officially published contract address, that's a major warning sign. Read What the Transaction Is Actually Asking When MetaMask or any wallet pops up a transaction confirmation, people almost always just hit confirm without reading it. This is dangerous. There are two types of confirmations you'll see. The first is a simple ETH or token transfer, where you can clearly see the amount being sent and the receiving address. The second is a contract interaction, which shows a function name and often some encoded data. This second type is where you need to pay attention. A legitimate NFT mint will show something like mint() or publicMint(). A malicious transaction might show setApprovalForAll, which would give a contract unlimited access to all your NFTs in a collection. Use a transaction simulator like Rabby's built-in preview or Fire (a browser extension) to see a human-readable breakdown of exactly what a transaction will do before you approve it. Red Flags of Scam Projects After spending time in this space, you start to develop pattern recognition for what legitimate projects look and feel like versus what scams look like. Here are the most consistent red flags. 👥 Anonymous Team, No Track Record Not all anon teams are scammers, but a team with no verifiable history, no prior projects, and no names is a higher risk. Look for doxxed founders or at least a team with a reputation that can be verified. ⚡ Fake Urgency "Mint closes in 2 hours." "Only 50 spots left." Scammers use urgency to stop you from doing due diligence. Legitimate projects don't pressure you like this. 💸 Returns That Don't Make Sense 10% APY daily. Guaranteed returns. If the yield being promised doesn't have a clear, logical source, someone is paying it with other people's deposits and it will collapse. 📋 Copied Website or Whitepaper Paste any suspicious whitepaper text into Google. Many scam projects copy and lightly edit existing documents. Same with UI, often just reskinned from a template. 🔒 No Audit or Fake Audit Any serious DeFi protocol gets audited by a reputable firm. If they claim an audit, click through and verify the audit report exists on the auditor's actual website. 📣 Heavy Influencer Promotion, No Substance If every post is hype and no post explains the actual product, that's a signal. Legitimate projects have documentation, GitHub activity, and real team communication. Common Scam Types You Need to Know Phishing Links A fake link that looks like a real site, sent via DM, reply, or even search ads. You connect your wallet and approve a transaction that drains it. Always verify URLs manually. Fake Airdrops You receive random tokens in your wallet. The token's description or metadata tells you to visit a site to claim more. That site is a drainer. Never interact with unsolicited tokens. Address Poisoning Attackers send tiny transactions from a wallet address that looks nearly identical to an address you've transacted with before. If you copy your transaction history instead of your saved addresses, you send funds to the scammer. Always verify full wallet addresses, not just the first and last four characters. Drainer Sites Sites that look legitimate but contain malicious contract calls. When you approve what looks like a mint, you're actually signing a transaction that transfers your assets to the attacker's wallet. Fake Support DMs You post in a Discord or Telegram about an issue and within seconds you get a DM from someone claiming to be from the support team. No legitimate protocol team will DM you first. The DM will lead you to a site where you're asked to "connect your wallet to verify." Seed Phrase Safety: The Absolute Basics Your seed phrase is the master key to your wallet. Anyone who has it has complete, permanent, irrecoverable access to everything in that wallet. There is no exception to this rule and there is no way to undo it. Never Do This Never type your seed phrase into any website, any app, any form, or any chat. Never store it in your email drafts, Google Docs, Apple Notes, or any cloud service. Never take a photo of it. Never share it with anyone, ever, for any reason. No legitimate project, no real support team, and no actual protocol will ever ask you for it. Write your seed phrase on paper and keep it somewhere physically secure. Some people make multiple copies and store them in different locations. If you're holding significant value, a fireproof safe is not overkill. Metal seed phrase storage products exist specifically for this and they're worth considering for anything you can't afford to lose. How to Verify a Project is Legitimate Before you put any money into a project, here's a repeatable checklist you can run through. 1 Find their official channels from a trusted source Go to their official verified X (Twitter) account and click through to their website and documentation from there. Don't trust links in DMs or replies. 2 Check their GitHub activity A legitimate protocol building real software has commits, pull requests, and an active development history. A repo with one commit or no recent activity is a warning sign. 3 Look up the contract on a block explorer Check when it was deployed, how many transactions it has, and whether the code is verified and readable. An unverified contract source is a major red flag. 4 Search for the project name plus "scam" or "rug" Not scientific, but often revealing. Real community concerns surface quickly on Twitter and Reddit. If you find multiple credible reports, walk away. 5 Check if liquidity is locked For DeFi tokens, check whether the liquidity pool is locked using a service like Team Finance or Unicrypt. Unlocked liquidity means the team can pull it at any time. Tools That Actually Help Rabby Wallet Shows transaction previews before you sign, displays risk warnings, and lets you set custom spending limits. A much safer default than MetaMask for active DeFi users. revoke.cash Multi-chain approval revocation tool. Check and revoke every token approval your wallet has ever given, across Ethereum, Polygon, BNB Chain, and more. Fire Extension Browser extension that intercepts wallet popups and shows you in plain language what a transaction is actually going to do before you sign it. Pocket Universe Transaction simulator that predicts the outcome of a transaction before execution, including what assets you'll lose and what you'll receive. Debank Portfolio tracker with a multi-chain approval checker. Also useful for seeing your complete DeFi position across every protocol and chain. Etherscan / Solscan Block explorers for reading contracts, checking transaction history, and verifying contract ownership and code. What To Do If Your Wallet Is Compromised If you think your wallet has been compromised, either because you signed something suspicious, entered your seed phrase somewhere, or you see transactions you didn't authorize, act immediately. Speed is everything at this point. 1 Stop what you're doing and assess If you still have assets in the wallet, move them to a new, clean wallet address right now. Transfer tokens and NFTs before the attacker can drain them. Set up the new wallet on a device that wasn't involved in the breach. 2 Do not "rescue" assets with the compromised wallet If the seed phrase is exposed, assume the attacker has it too. Anything you send back to that wallet can be taken again. Move everything to a new wallet. 3 Revoke all remaining approvals from the compromised wallet Even if you've moved your assets, the compromised wallet may still have approvals that could be exploited. Revoke them using revoke.cash. 4 Treat the wallet as permanently burned Never use a compromised wallet address again, even if the assets are gone. A compromised seed phrase means that wallet is never safe again. Final Thought Web3 is genuinely exciting. The ability to move value permissionlessly, to interact with protocols that no single company controls, to own your assets in a way that was never possible before. But that freedom comes with a cost. There is no safety net. No fraud department. No dispute resolution. What you have instead is knowledge. Every habit in this guide exists because someone learned it the hard way. Use a burner wallet for anything unfamiliar. Verify before you connect. Read what you're signing. Revoke old approvals. Keep your seed phrase offline and private. Never trust, always verify. The people who stay safe in Web3 for years are not lucky. They are deliberate. They slow down when everyone else is rushing. They check one more time when something feels slightly off. They know that a five-minute due diligence check is worth infinitely more than a lesson learned after losing real money. Take your time. Verify everything. Protect your keys. The chain doesn't forget and neither will your wallet balance if you don't.