# Verify, Don't Trust — A Real Web3 Security Guide

- Author: John_ (https://wurk.fun/user/John_)
- Published: 2026-06-13
- Canonical (HTML): https://wurk.fun/blog/verify-don-t-trust-a-real-web3-security-guide
- Cover image: https://ik.imagekit.io/wurk/1000898928_rYqTX0H_M.png

---

I used to think security incidents happened to other people. The ones who weren't paying attention. The ones who were greedy or naive. Then one afternoon I was about to claim what looked like a legitimate airdrop — proper branding, official-looking domain, everything. I paused for no particular reason and looked at the URL again. One letter was off. A lowercase "l" where there should have been an "i." That was it. That was the whole attack.
Web3 moves fast and scammers move faster. There are no chargebacks here, no fraud departments, no one to call. When your funds leave your wallet to the wrong address, they are gone. Permanently. This guide exists so that doesn't happen to you.

**The Core Mindset: Verify, Don't Trust**

Traditional finance has institutions doing the verification work for you. Web3 doesn't. You are the institution. No one else is checking whether that contract is safe, whether that site is real, or whether that signature is about to empty your wallet.
Before every onchain interaction, ask yourself three questions:

**Do I know exactly what this transaction will do?
Did I find this site from an official, verified source?
Am I being pressured to act fast?**

If you can't answer yes to all three — stop. The opportunity will either still be there in 20 minutes after you've checked, or it wasn't real to begin with.
The most powerful thing a scammer can do is make you feel like you're running out of time. "Only 2 hours left." "Limited spots." "Your wallet is at risk — act now." That urgency is a weapon. Every legitimate protocol in existence will still be there after you've done your research.

**What You're Actually Signing**

When a dApp asks you to "sign" something, not all signatures are equal. This distinction has cost people real money.

![1000898895](https://ik.imagekit.io/wurk/1000898895_2boeLFxlQ.jpg)

**Message signatures (off-chain):** Free,no gas required. Usually used to prove you own a wallet — like logging in. Generally safe, but malicious actors use them to authorize token transfers through EIP-712 permit functions. Just because there's no gas fee doesn't mean it's harmless. Read the full prompt.

**Transaction signatures (on-chain):** These write to the blockchain. They can move funds, grant spending approvals, or interact with smart contracts. Never approve a transaction you don't understand — and if the approval says "Unlimited," ask yourself whether that's actually necessary for what you're doing.
A tool like Rabby Wallet or Pocket Universe will show you a plain-language preview of what a transaction will do before you sign it. Use them. The 10 seconds it takes to read the preview is worth it.

**Before You Connect Your Wallet**

Never connect your main wallet to a new site impulsively. Before every new interaction, run through this:

![1000898904](https://ik.imagekit.io/wurk/1000898904_F8RKQVDmC.jpg)

**Verify the URL manually.** Type it yourself or use a saved bookmark. Never click links from Twitter replies, Discord DMs, or Telegram messages — ever. Watch closely for lookalike characters: uniswap.org vs uniswaр.org (that second "р" is Cyrillic, not Latin). They are visually identical and point to completely different servers.

**Find official links from verified sources.** Start from the project's official Twitter/X account with a verifiable history. Cross-reference with their docs or GitHub. CoinGecko and DefiLlama both maintain manually reviewed official links you can use to double-check.

**Check the domain's age.** Go to whois.domaintools.com and look up the domain. A "long-established DeFi protocol" with a domain registered three days ago is not long-established. Fresh domains claiming legacy credibility are one of the clearest scam signals there is.

**Burner Wallets: Your Best Friend in Web3**

A burner wallet is a separate, disposable wallet you use for anything you're not 100% certain about. Minting NFTs from new projects, testing unfamiliar protocols, claiming airdrops, exploring experimental dApps — all of this belongs on a burner, not your main wallet.
The logic is simple: if the site is malicious and drains the wallet, only what you loaded onto that burner is gone. Your real holdings are completely untouched. It's like carrying a separate card with $20 in it when traveling through an unfamiliar area. Even a worst-case outcome is contained.

![1000898908](https://ik.imagekit.io/wurk/1000898908_WzbcEbfDp.jpg)

**Burner wallet** — For risky interactions, minting, and testing. Fund only what you need for the specific action.
**Hot wallet** (Phantom, MetaMask) — For daily use and smaller amounts. Always connected to the internet.
**Cold wallet** (Ledger, Trezor) — For long-term storage and significant holdings. Keys never touch the internet.

**How to create a burner wallet on Solana (step by step)**

![1000898908](https://ik.imagekit.io/wurk/1000898908_Kio9r-wOz.jpg)

Open Phantom and tap the account icon in the top-right corner.
Select Add / Connect Wallet → Create a new wallet.
Name it clearly — "Burner" or "Mint Wallet" — so you never confuse it with your main account.
Save the seed phrase somewhere physical even for a burner. If it grows in value you'll need it.
Fund it with only what the interaction requires, plus a little extra for fees. Nothing more.
After the interaction, move any trusted assets back to your main wallet. Don't let value sit in a burner passively.

Create a fresh burner for every major new protocol you're unsure about. Wallets are free. Your peace of mind isn't.

**Red Flags of Scam Projects**

No single flag guarantees a project is a scam. But the more of these that appear, the more you should slow down.

**Anonymous teams with no verifiable track record** — Pseudonymity is fine on its own. But no GitHub history, no past projects, no presence in the space beyond a recently created Twitter account? That's a problem. There's no accountability if things go wrong.

**Copied or near-identical websites** — Scammers clone legitimate projects down to the pixel, then swap the contract address. If something feels familiar, Google a distinctive phrase from their About page. You might find the original.

**Fake urgency and artificial scarcity** — "Only 100 spots left." "Claim by midnight." These are psychological pressure tactics designed to make you act before you think. Real opportunities don't vanish while you do 15 minutes of research.

**Returns that make no economic sense** — 3,000% APY. Guaranteed 5x. In DeFi, yield comes from somewhere real. If you can't identify where the yield is generated, there's a strong chance you are the yield source.
**Unsolicited DMs offering something** — No legitimate project will cold-DM you first. Ever. If someone found you specifically to offer an exclusive opportunity, they researched your public wallet activity first. This is targeted social engineering, not luck.

**Unverified or freshly deployed contracts** — Check the contract address on Solscan or Etherscan. If it was deployed two days ago, if the code isn't verified, if there's no audit — these are meaningful signals, not minor details.

**Seed Phrase Safety**

Your seed phrase — those 12 or 24 words — is the master key to your wallet. Whoever has those words has full, permanent control of everything inside it. No recovery, no override, no support ticket.

![1000898910](https://ik.imagekit.io/wurk/1000898910_5ej_--2zH.jpg)

**Store it:**

Written on paper, kept in a fireproof safe or safety deposit box
On a metal backup (Cryptosteel and similar) — paper burns and degrades
Multiple physical copies in separate secure locations
Never store it:
In a notes app (Apple Notes, Notion, Google Keep)
As a screenshot or photo — cloud-synced photos are accessible to anyone who gets into your account
In an email draft or sent message
In a plain text file on your computer — malware specifically searches for seed phrase patterns in files

The absolute rule: no legitimate project, dApp, support agent, or human being will ever ask for your seed phrase. Not in a DM. Not in a support form. Not in a "wallet verification" flow. If anyone asks, it is a scam. End the conversation completely.

**Revoking Old Wallet Approvals**

Every time you approve a dApp to spend your tokens, that permission stays active indefinitely — unless you manually revoke it. A protocol you used once two years ago for a single swap may still have full permission to move your tokens today. If that protocol gets exploited later, the approval can be used against you.

Revoking old approvals regularly is one of the highest-impact security habits you can build. It costs a small gas fee per revocation and takes about five minutes.
How to revoke (using Revoke.cash)

![1000898912](https://ik.imagekit.io/wurk/1000898912_EVvHpdh7t.jpg)

Go to revoke.cash and enter your wallet address. You don't need to connect your wallet to review — searching by address is safer for the audit step.
Switch between networks (Ethereum, Base, Polygon, etc.) to see approvals on each chain.
Review the list. Pay attention to anything showing "Unlimited" allowance, anything from a protocol you no longer use, and anything you don't recognize.
Click Revoke next to each approval you want to remove. Confirm the transaction in your wallet.
Repeat across every chain you've been active on.
Do this every one to three months as routine hygiene, immediately after any interaction you're uncertain about, and before moving your main holdings to a new wallet.

**Tools Worth Using**

![1000898914](https://ik.imagekit.io/wurk/1000898914_3ZihTY_Xc.jpg)

**Revoke.cash** — Audit and revoke all EVM token approvals from one dashboard.

**Rabby Wallet** — Shows a transaction simulation and risk summary before you sign.

**Pocket Universe** — Browser extension that flags dangerous transactions in real time.

**Wallet Guard** — Identifies phishing sites and scam contracts before you connect.

**ScamSniffer** — Blocklist extension that cross-checks URLs against known phishing databases.

**Tenderly** — Simulate transactions before executing to see exactly what will happen.

**DefiLlama** — Use the verified protocol links here to confirm official URLs before interacting.

One important note: don't install every extension at once. Browser extensions have significant permissions by default, and a compromised extension is itself an attack vector. Pick one or two well-reviewed tools and stick with them.

**If You Think Your Wallet Is Compromised**

Speed matters more than anything else here. Act in this order.

Don't panic-click anything. Rushed actions in this moment tend to make things worse, not better. Take three seconds to breathe before you do anything.
Go to Revoke.cash immediately and revoke all active approvals on the affected wallet. Even if assets have already been moved, open approvals can be used against any future deposits.
Transfer remaining assets to a brand new wallet — one that has never been touched, on a separate device if possible. Do not send to another existing hot wallet on the same machine.
Identify how it happened. Phishing site? Malicious approval? Compromised extension? Leaked seed phrase? Understanding the vector is the only way to prevent it from happening again on your new wallet.
Rotate everything connected to that device. Change passwords on email, Discord, and any crypto-related accounts. Enable 2FA on a clean device. Assume the entire environment is compromised, not just the wallet.
**Report and document. **Report the scam URL to Wallet Guard, ScamSniffer, and the real project team if an impersonator was involved. Save transaction hashes for your records.

What you cannot do is recover funds that have already been sent. The blockchain is immutable. Anyone who contacts you claiming they can recover your stolen assets for a fee is running a second scam targeting people who just lost funds. Do not engage.

**Security Is a Practice, Not a Setting**

The people who stay safe in Web3 long-term aren't necessarily the most technically sophisticated. They're the ones who built a few non-negotiable habits and stuck to them: verify before signing, isolate risk with burner wallets, revoke old approvals regularly, protect the seed phrase like a vault, and treat urgency as a warning sign rather than a call to action.

You don't need to be a smart contract auditor to protect yourself. You just need to slow down at the right moments and ask the right questions. Most attacks succeed not because the victim was reckless, but because they were in a hurry.

The blockchain will wait for you. And so will the real opportunities.
Stay safe out there — and if this helped, share it with someone who's just getting started. They'll thank you later.
Tags: #Web3Security #WalletSafety #DeFi #Solana #ScamPrevention