October 06, 2026

Eight actions that actually keep your coins

Not "be careful". Concrete actions, ordered by how people ACTUALLY lose money — and it isn't by breaking cryptography. In 2025, 76% of all losses came from stolen credentials, social engineering and supply chain.

1️⃣ THE SEED DOES NOT EXIST IN DIGITAL FORM

No photo, no note, no cloud, no password manager, no message to yourself.

The rule that closes almost the whole attack class: a real wallet NEVER asks you to type the seed on a web page or in a popup. The seed goes in only inside the wallet itself — at first setup, or when you decided to restore access.

Any other request is theft. Researchers recently found 40 browser extensions that showed a harmless notepad and, on command from a server, swapped it for an "import your wallet" page.

2️⃣ REVOKE OLD APPROVALS

An approval you granted a protocol two years ago still works and never asks you again. CertiK put 2024 losses from signed approvals at over $1 billion.

Where to look: revoke.cash (100+ networks) or the Token Approvals section on Etherscan.

Revoking is a transaction and costs gas. Do it once a month in a batch, not one at a time.

3️⃣ BE CAREFUL WITH THE REVOKE TOOLS THEMSELVES

The least obvious item here. Drainers run FAKE revoke sites — you go to protect yourself and sign the thing that empties the wallet.

Real domains from recent campaigns: revokes-drift[.]trade, revoke-kernelsdao[.]com, revoke-zetachain[.]com.

The links get dropped by "ordinary community members" into threads under hack news — exactly where everyone is confused and looking for what to do.

So: type the revoke site's address yourself, or use your own bookmark. Never from someone else's message, however friendly it looks.

4️⃣ TURN ON TRANSACTION SIMULATION

Simulation shows what a signature will ACTUALLY do before you give it. A drainer disguised as a routine swap or mint becomes visible immediately.

Tools: Blockaid, Wallet Guard, Pocket Universe, Tenderly. MetaMask, Coinbase Wallet, Rainbow, Ledger and Zerion have warnings built in — check yours aren't switched off.

5️⃣ SPLIT WALLETS BY FUNCTION

Three of them: receiving, spending, storage.

The storage wallet connects to no sites and signs nothing at all. Then a signature you regret costs you the working wallet, not everything.

6️⃣ COMPARE THE WHOLE ADDRESS

Address poisoning works because you copy from your own history, and the fake shares the first and last characters. Some malicious extensions go further and swap the address in your clipboard.

The eye reads the whole word and misses a single swapped character. Check the middle. On a large amount, send a test transfer first.

7️⃣ A PASSPHRASE ON TOP OF THE SEED

The 25th word. Even if the seed is found, there is no access without it.

Store it SEPARATELY from the seed — otherwise it adds nothing. And remember: losing the passphrase equals losing the wallet, there is no backup copy.

8️⃣ SCREEN WHAT YOU RECEIVE

A wallet protects you from theft. It does nothing about accepting tainted coins — and the freeze lands on whoever accepted them last.

Screening the sender before the deal takes ten seconds. And keep the result: when an exchange asks six months later where the coins came from, a dated report with hashes is the only thing you will have.

WHAT IS NOT ON THIS LIST

A hardware wallet does NOT protect you from items 2–4: if you sign a malicious approval, the device will faithfully sign it. Hardware protects the key, not the decision.

And physical risk has no technical fix: $30M was taken by force in H1 2026, a quarter of it through pressure on family. Don't publicise holdings.

Screen an address for free: https://t.me/amlconsensus_bot?start=en Live feed of theft and freezes: https://api.amlconsensus.com/theftwatch/?lang=en