# Verify, Don't Trust: The Practical Web3 Security Guide to Protecting Your Wallet and Avoiding Onchain Scams - Author: GodOfRaw (https://wurk.fun/user/GodOfRaw) - Published: 2026-06-11 - Canonical (HTML): https://wurk.fun/blog/verify-don-t-trust-the-practical-web3-security-guide-to-protecting-your-wallet-a - Cover image: https://ik.imagekit.io/wurk/fOnMq_eBc9RlLqh.jpg --- In Web3, you are your own bank, your own security team, and your own last line of defense. There is no customer support hotline to reverse a transaction. One careless click, one rushed signature, or one copied address can empty a wallet in seconds. This guide is built for people who actually use Web3; whether you're farming opportunities on Solana, testing new dApps, or simply holding assets. We'll go beyond generic tips and break down exactly what to check, why it matters, and how to build habits that actually protect you. The core principle is simple: **Verify, don't trust.** **1. The Web3 Mindset: Why "Verify, Don't Trust" Is Non-Negotiable** Traditional finance has layers of protection and recourse. Web3 has code and cryptography. That trade-off gives you sovereignty but also full responsibility. Every time you connect a wallet, you're not just "logging in" - you're authorizing a smart contract (or program on Solana) to potentially move your assets. Every signature is a permanent onchain action. Scammers exploit the gap between what you think you're doing and what you're actually authorizing. The people who last in this space treat every interaction with healthy skepticism. They don't click links from DMs or replies. They don't assume a slick website or big promises mean safety. They verify. **2. Before You Connect or Sign: The Pre-Flight Checklist Never connect your wallet on impulse. Run this quick mental checklist first:** **Verify the official source** Go directly to the project's verified X account (check the bio and pinned post for the real link). Cross-check the website URL character-by-character. Typosquatting is extremely common. Never click links from Discord replies, Telegram DMs, or random X replies, even if they look like they're from the official account. **Assess the project itself** Is the team anonymous? Some early protocols succeeded this way, but it dramatically increases risk. Look for verifiable past work or public identities. Are contracts verified on Solscan (for Solana) or Etherscan? Is the source code clean and audited by reputable firms (e.g., Ottersec, Trail of Bits, or well-known Solana auditors)? Check tokenomics and liquidity: Is liquidity locked or burned? Are there obvious red flags in holder distribution? Read the docs. Real projects have clear, detailed documentation. Vague or missing docs are a warning sign. Red flags that should make you pause (or walk away): Anonymous team + unrealistic promises "Guaranteed 10x" or "risk-free yields" are almost always unsustainable or outright scams. Copied or low-effort websites - Identical design to a popular project with slight URL changes. Fake urgency / FOMO timers - Countdowns that reset, "last chance" language, or pressure to act immediately. Too-good-to-be-true rewards - Especially airdrop claims that require connecting your main wallet or approving large amounts. Poor community quality - Mostly shill bots, deleted criticism, or mods who attack anyone asking questions. **3. Reading What You're Actually Signing This is where most drains happen. When a dApp asks you to sign, slow down and read the details.** **Key things to check:** Spender / Program ID: Is this the legitimate contract for the dApp you're using? (Cross-check on Solscan or the project's docs.) Amount / Permissions: Is it asking for infinite approval? Many legitimate dApps only need a specific amount. Infinite approvals are convenient but dangerous; if that contract is ever compromised later, it can drain you without another signature. What the transaction actually does: Some wallets show raw data. Better ones (or simulator extensions) translate it into plain English: "This will allow Contract X to transfer up to Y of your USDC." Pro move: Use a transaction simulator extension like Pocket Universe, Blowfish, or similar tools. They intercept the signature request and show you exactly what will happen in human-readable terms before you approve. This single habit stops the vast majority of drainer attacks. **4. Burner Wallets: Your Disposable Safety Layer A burner wallet is a secondary wallet you use specifically for higher-risk or experimental interactions. It holds only the small amount of SOL (or other tokens) needed for that session.** **Why people use them:** Testing new or unverified dApps without risking main holdings. Claiming airdrops or interacting with experimental contracts. Maintaining some operational privacy. Limiting blast radius if something goes wrong. **How to create a burner wallet in Phantom (Solana) step by step**: Open the Phantom extension and click the menu icon (three horizontal lines) in the top left. Select Add / Connect Wallet → Create a new wallet. Generate a fresh seed phrase. Write it down on paper immediately and store it separately from your main wallet's seed. Never screenshot or store it digitally. Name the wallet clearly (e.g., "Burner - June 2026 - Risky dApp Test"). Fund it with a small, intentional amount — usually 0.05–0.5 SOL is plenty for most testing and fees. Send it from your main wallet. Use only this wallet for the specific interaction. When finished, you can leave the remaining balance or sweep it back if the interaction was safe. Burner wallets are not magic — they're a risk-management tool. The smaller the amount inside, the less it hurts if something goes wrong. **5. Hot Wallets vs Cold Wallets vs Burner Wallets** Wallet Type Best For Risk Level Convenience Recommendation Hot (Phantom, Backpack, etc.) Daily DeFi, trading, frequent dApp use Higher (always online) High Use with simulators + good habits Cold / Hardware (Ledger, etc.) Large long-term holdings Very low Low Ideal for serious stacks Burner Testing, risky interactions, airdrop claims Contained (small funds only) Medium Essential habit for active users Simple rule: Big money or long-term holding → lean toward cold storage. Frequent activity → hot wallet + strong security hygiene. Anything experimental or potentially shady → burner with minimal funds. 6. Common Scam Types You'll Encounter Drainer sites & malicious contracts: Seemingly normal dApps or "claim" pages that drain your wallet on connect or sign. Prevention: simulators + never connect main wallet to unverified sites. Address poisoning: Scammers send tiny amounts from a lookalike address. When you copy from transaction history, you accidentally paste theirs. Prevention: Always verify the full address character by character. Use address book features or ENS names when possible. Modern wallets are adding better warnings. Fake airdrops & "support" DMs: Unsolicited messages promising free tokens or help. They lead to drainers or seed-phrase requests. Legitimate projects almost never DM you first. Phishing links & fake support in communities: Cloned websites, fake X accounts, or compromised "official" channels pushing malicious links. 7. Regular Wallet Hygiene: Revoking Old Approvals Even legitimate dApps can become liabilities later. Old approvals sit onchain indefinitely. If a project gets hacked or turns malicious, those permissions can still be used against you. Why do this regularly? Reduces your attack surface dramatically. Many users have dozens of stale approvals from past experiments. It's quick and cheap (especially on Solana). How to revoke on Solana (2026): The easiest and most reliable tool right now is revoke.cash (it added strong Solana support). Go to https://revoke.cash Connect your Phantom (or other Solana) wallet. Select the Solana network. Review the list of active delegates/approvals. Revoke anything you no longer recognize or need. Alternative dedicated Solana tool: famousfoxes.com/revoke — also recommended in Phantom's own help docs. Do this every few weeks or after any period of heavy dApp activity. It takes minutes and gives massive peace of mind. 8. Seed Phrase Safety (The Nuclear Codes of Web3) Your seed phrase is the master key to everything. Treat it accordingly. Where to store it: Write it on high-quality paper or, better, engrave it on metal (Cryptosteel, Billfodl, or similar). Store physical copies in at least two separate, secure physical locations (fireproof safe, trusted family member's house, etc.). Consider a passphrase (the optional 25th word) for extra protection. Where to NEVER store it: Screenshots or photos on your phone/computer Cloud storage (Google Drive, iCloud, Dropbox, etc.) Password managers (unless using advanced air-gapped encrypted setups) Email, notes apps, or any digital format Shared with anyone — ever Critical rule: No legitimate project, airdrop, "verification" service, or support agent will ever ask for your seed phrase or private key. If they do, it is 100% a scam. Close the conversation immediately. 9. What to Do If You Suspect Your Wallet Is Compromised Act fast, stay calm: Revoke immediately - Use revoke.cash (and famousfoxes.com/revoke for Solana) from a different device/browser if possible. Revoke everything. Create a fresh wallet with a completely new seed phrase. Test transfer - Send a tiny amount from the compromised wallet to the new one first to confirm it works. Sweep remaining funds to the new safe wallet. Scan devices for malware and remove suspicious browser extensions. Document everything (transaction hashes, contract addresses) and share warnings in trusted communities if it's a new vector. Upgrade habits going forward — hardware wallet for main holdings, stricter verification, simulators always on. The faster you move, the more you can usually save.