The Beginner's Guide to Fighting Crypto Scams: 10 Steps to Better Security

Source: Bankless

Compilation: Bitui BitpushNews Tracy

Use these 10 essential security tips to protect your cryptocurrencies from threats like phishing scams:

Dear fans, with digital thieves at an all-time high, it's critical to stay vigilant against potential threats.

Today, we bring you a beginner's guide on how to harden your defenses against threats like phishing scams. Let’s dive into 10 easy steps to ensure your assets remain safe and your journey in the cryptocurrency space unimpeded.

Phishing scams pretending to be unbanked are on the rise.

Ultimately, a successful phishing attack depends on three main factors:

• A fake opportunity that looks real enough (usually a purported airdrop claim site or NFT minting page);
• Phishers successfully convince victims to sign malicious transactions on false opportunities;
• Victims have valuable token approvals in compromised wallets, which attackers can exploit through malicious transactions.

With a decent pitch and website, any of us could be scammed at first.

Fortunately, there are a range of practices and resources we can employ to eliminate the possibility of signing a malicious transaction, or effectively minimize its impact.

Here are 10 important steps to harden your cryptocurrency defenses in 2023:

1. Create a vault

Strategy: Create a multi-signature wallet for your long-term cryptocurrency holdings!

Recommended Tool: Safe Wallet

Multi-signature wallets, often referred to as "vaults," are similar to encrypted currency versions of secure bank storage. It provides increased security for your cryptocurrency by requiring multiple private keys (i.e. wallets) to authorize any transaction.

Therefore, a multi-signature wallet is like a digital fortress, and even if one of your keys is compromised, your long-term holding assets will remain safe.

One of the easiest ways to create a multi-signature wallet these days is to create a Safe account. You can add any address you want as a signer, but starting with a 2-of-3 multisig is straightforward. Also, consider using a hardware wallet like Ledger as one of your signers for an added layer of security!

2. Make a Risk Wallet

Strategy: Create a risk wallet dedicated to everyday activities!

Recommended tool: Delegate

Never use your vault for regular cryptocurrency activities like airdrop claiming or NFT minting. For these activities, set up a separate dedicated wallet and only recharge currencies such as ETH when needed.

What is the idea? Your active wallet should not be filled with all your on-chain savings. You may also consider using a service such as Delegate to delegate the authority of your vault wallet to a risk wallet without moving or compromising any assets, for example if you want to participate in an allowlist minting and the NFTs are eligible.

That way, even if you accidentally sign a bad deal on your risky wallet, your long-term savings won't be affected.

3. Use transaction preview tool

Tactic: Download a trade preview tool to alert yourself to malicious trade attempts!

Recommended tools: Fire, Pocket Universe, Stelo

Wait a moment? ! I don't want to transfer 60,000 USDC and all my NFTs to this random address? ! ? This is exactly what the preview tool helps you visualize before you approve any deal.

These tools are free browser extensions you can download that provide pop-ups explaining any proposed deals. These extensions are a great defense against phishing incidents, so make sure to run one of them on all your transactions!

4. Review your token authorization

Strategy: Revoke your unlimited token spend authorization!

Recommended tool: Revoke.cash

Many Ethereum-based applications (such as DeFi) will require you to approve "unlimited" token spending, so that you do not have to constantly re-approve to use your funds on these applications.

The problem is, if your wallet is compromised and there are a lot of ongoing unlimited token delegations, the attacker can empty all assets in it.

Therefore, you should regularly monitor your pending authorizations and revoke or minimize unlimited authorizations where possible. The revoke.cash platform makes editing your grants a breeze, so don't overlook it.

5. Pre-experimental research

Strategy: Research projects you're interested in before trying them out!

Recommended websites: DeFiLlama (current resources), CryptoWiki (historical information)

In the cryptocurrency space, never act blindly, do your homework!

For example, recently I was exploring the Ajna protocol, a newer governanceless DeFi lending protocol. I went straight to its documentation, FAQs, white papers, etc. to be able to start understanding it and assess its nuances and risk profile.

Due diligence is important: take the time to understand the basics before diving into anything. Don't irresponsibly put yourself at risk through blind imitation. If you can't find good documentation and similar educational resources for a project, that's probably a big red flag.

6. Monitor your positions

Strategy: Monitor Your Crypto Assets with a Portfolio Tracker!

Recommended tools: DeBank, MetaMask Portfolio, Zapper, Zerion

In the world of cryptocurrencies, keeping tabs on your holdings is crucial, and a portfolio tracker is your best friend in this regard. They provide an overview of your holdings across multiple wallets and platforms, enabling you to monitor your crypto assets in real time.

Remember, understanding your position is not just about profit, it is also an important part of risk management. By regularly monitoring your assets, you can spot unusual activity that may indicate a security breach and potentially take action to protect your remaining assets.

7. Stay up to date with the latest ecosystem news

Strategy: Keep up to date with cryptocurrency news like recent hacks!

Recommended resources: Bankless, DeFiLlama Roundup

Sometimes attacks on projects such as DeFi protocols may directly or indirectly affect your encrypted assets. In order to understand potential consequences in advance, it is crucial to stay informed.

You don't have to do all the work yourself, though. Bankless, for example, dissected Curve's reentrancy attack in detail via a Twitter thread hours after the attack began. We always try to keep you informed in a timely manner, but there are many other good resources to refer to in this regard, such as DeFiLlama's news aggregation chatroom on Telegram.

8. Lock down your web2 life

Strategy: Rely on good operational security practices to protect your Web2 activities!

Recommended resource: Officer's Blog

Don't give attackers any chance, even outside of Web3.

Criminals can hack into your email or social accounts in an attempt to trick other people who trust you into clicking on fraudulent websites. Don't let them get away with it! According to security researcher officercia.eth, a strong operational security foundation includes:

• Use a secure email provider such as ProtonMail
• Use different strong passwords and do not reuse them in multiple places
• Do not associate your mobile number with a crypto platform
• Use 2FA to backup your account, but do not use SMS-based 2FA
• Ask your mobile operator to lock your phone's SIM card
• Use up-to-date antivirus software

9. Create an escape route

Strategy: Create an asset evacuation strategy for worst-case scenarios!

Recommended tools: Webacy, Spotter

Even with all the tools and practices mentioned earlier, it's still important to consider preparing for the worst.

To this end, Web3 is a platform that provides Web3 security services, which allows you to create a custom backup wallet + panic button system; if you are attacked or just feel uneasy, you can use the platform's "Panic" function or any remaining assets to a pre-designated backup wallet.

For more advanced users, there are other monitoring and protection services like Spotter, designed to help you detect and escape on-chain attacks in milliseconds rather than minutes.

10. Sound the alarm

Tactic: If you encounter a phishing scam, sound the alarm quickly!

Recommended resource: CryptoScamDB

Speak up when you see a problem!

If you do come across a cryptocurrency phishing attempt, please sound the alarm so others can be alerted. This could be a quick PSA message in your favorite group chat, a social media post, or a report to a scam database like CryptoScamDB. 30 seconds of your time may help save someone else's cryptocurrency!