# Staying Safe in Web3: Everything you actually need to know before going Onchain - Author: Dee (https://wurk.fun/user/Dee) - Published: 2026-06-13 - Canonical (HTML): https://wurk.fun/blog/staying-safe-in-web3-everything-you-actually-need-to-know-before-going-onchain - Cover image: https://ik.imagekit.io/wurk/1001098807_6g3G7xg0sh.png --- Web3 gives you real ownership and freedom. But there's no customer support, no fraud department, and no undo button. One wrong click and your funds are gone, permanently.The people who last in this space aren't the luckiest, they're just the most careful This guide covers everything: wallets, scams, red flags, verification tools, seed phrase storage, approval revocation, and what to actually do if things go wrong. Whether you're brand new or you've been around a few cycles, there's something here worth knowing. **➢ The Most Important Mindset Shift:** Verify, Don't Trust, this is the one principle that changes everything: trust nothing by default, Verify everything. In traditional finance. Banks are regulated, platforms are audited, and fraud protections exist. In Web3, none of that applies. The chain doesn't care if you were tricked. A drainer contract doesn't ask for permission twice. "Verify, don't trust" means you confirm official links before clicking them. **Know Your Wallets: Hot, Cold, and Burner Wallets** Not all wallets are the same, and using the right type for the right purpose is one of the simplest security upgrades you can make. **➢ Hot wallets** are browser extensions or mobile apps connected to the internet E.g Phantom, MetaMask, Backpack, etc. Convenient for daily activity, but because they're always online, they're more exposed. Don't keep your life savings in it. **➢ Cold wallets** are hardware devices, Ledger and Trezor are the most common that store your private keys offline. Transactions have to be physically approved on the device, which means your funds stay safe. It's essential if you're holding anything long term **➢ Burner Wallets: Your Best Defense for Risky Interactions** A fresh wallet you create just for risky interactions. New project? Unknown dApp? Use a burner. Fund it with only what you need. If it gets drained, your main wallet stays untouched. **Why People Use Them** 1. Testing new dApps and protocols without risking real assets 2. Claiming airdrops from unknown projects 3. Minting NFTs on new collections 4. Participating in early-stage launches 5. Interacting with unfamiliar smart contracts on-chain **➢ Creating and Using a Burner Wallet (Step-by-Step)** ![1001094334](https://ik.imagekit.io/wurk/1001094334_LgMVuOhmv.png) 1. **Download a fresh wallet, Use Phantom for Solana, or MetaMask for EVM chains.** Create a new browser profile entirely so the wallets stay separate. 2. **Create a new wallet.** Choose "Create New Wallet" not "Import" This generates a brand-new seed phrase. 3. **Write down the seed phrase.** Even for a burner, write it down. 4. **Do not import this wallet into your main browser profile.** Keep it isolated. 5. **Fund it minimally.** Send only what you need for the specific interaction, gas fees plus whatever you're spending, 6. **Use it, Then review approvals.** After interacting with anything new, check and revoke approvals immediately **➢ Before You Connect: What to Check First** **1. Is the URL correct?** Scammers create near-identical domains. magiceden.io and magiceden-nft.io are not the same site. Always check the full domain. **2. Is there a HTTPS padlock?** if it's HTTP, leave immediately **3. Does the site ask for anything unusual before you even connect?** Legitimate dApps don't ask you to **verify your wallet** or **restore access** by entering your seed phrase, ever, If a site does this, it's a drainer. Close the tab. **➢ Reading Transaction Prompts** ![1001094466](https://ik.imagekit.io/wurk/1001094466_8GV9w_twT-.png) Connecting your wallet is harmless. Signing a transaction is where money moves. Read every prompt before you click approve **1. What contract is being called?** If there's a contract address, you can look it up on block explorer (Solscan for Solana, Etherscan for Ethereum). Is it verified? Does it have a name? Has it been audited? **2. What's being approved?** "Approve" transactions often set a spending limit. Unlimited approvals mean a contract can pull tokens from your wallet any time in the future even after you've left the site. **3. Does this match what I expected to do?** If you're minting an NFT and the prompt says "transfer 500 USDC to [unknown address]," that's not a mint, that's theft. When in doubt, reject. You can always re-examine and try again. You can't undo a signed transaction. **➢ Common Scams You'll Actually Encounter** **1. Phishing links** : Usually come through Telegram, X, or Discord, The site looks real. The URL is slightly off. You connect, sign something, and your wallet is empty **2. Fake Airdrops** : "Claim your tokens!" If claiming requires approving a spending limit, it's a drain. Real airdrops don't work like that. **3. Addresses Poisoning** : Scammers send dust transactions from addresses that look like yours. You copy-paste the wrong one next time you send. Always verify the full address. **➢ How to Verify a Legitimate Project** ![1001095611](https://ik.imagekit.io/wurk/1001095611_1roMuTe05.png) **1. Find the project's official X (Twitter) account** preferably one with a verified checkmark and established follower history **2.Click the website link in their bio.** That's the official website **3. Cross-check against their documentation** Usually Github Notion or their own docs portal **4. Look in official Discord/Telegram channels** for pinned messages with official links. Never trust a Google Ad at the top of search results. Scammers buy ads for popular protocol names constantly. **➢ Security Tools Worth Bookmarking** These are genuinely useful tools to keep **Approval checkers :** revoke.cash for (EVM) & sol-incinerator.com for (SOLANA) let you see and revoke any token approvals you've previously granted. Free and invaluable. **Scam detection:** Browser extensions like Pocket Universe or Fire (EVM-focused) intercept transactions and warn you if a site is flagged as malicious. **➢ Common Scam Red Flags Of Scam Projects:** These patterns repeat across thousands of scams. Once you see them, you see them everywhere. **1. Fake urgency:** "You have 30 minutes to claim or you lose your allocation." Urgency is made to stop you from thinking clearly. **2. Unrealistic Rewards:** "Stake and earn 800% APY." Sustainable yields don't look like that. If it sounds too good, it's extracting from someone, maybe you 👀 **3. Poor or missing documentation:** Real teams invest in their docs. Scams don't bother. **4. "Support" reaching out to you:** No legitimate protocol has support staff who message users first. **➢ Revoking Wallet Approvals** Every time you approve a dApp, you give its smart contract access to your tokens and those permissions don't expire automatically. If the protocol is exploited months later, any unused approvals can still be abused **How to revoke (EVM):** ![1001098425](https://ik.imagekit.io/wurk/1001098425_X7UJlanz8.png) 1. Go to revoke.cash 2. Connect your wallet (read-only is fine or connect fully to revoke) 3. Review the list of active approvals 4. Click "Revoke" on anything you no longer use or don't recognize **For Solana:** ![1001098441](https://ik.imagekit.io/wurk/1001098441_tzmD6ciYW.png) Use sol-incinerator.com or your wallet's built-in token account management. Make reviewing your approvals a monthly habit. It takes ten minutes and has saved countless wallets. **Security Is a Habit, Not a One-Time Thing** The ability to own your assets, earn onchain, and participate in decentralized communities without asking permission that's something genuinely new and worth showing up for. The projects, the communities, the opportunities they're not going anywhere. ![1001098644](https://ik.imagekit.io/wurk/1001098644_p-1Wn926n.png) Take the time to stay safe while you explore them. Your keys. Your assets. Your responsibility