Free crypto security guides
Farm airdrops. Keep your wallet.
Fake claim sites, wallet drainers and impersonators take far more from airdrop hunters than gas ever does. 37 plain-English guides on how these attacks work and how to stay out of their way.
The short version
- Never type your seed phrase into a website, form, chat or "validator". Only into the wallet itself, when restoring it.
- Claim links come from the project, not from replies or DMs. Get them from the official site you already had bookmarked.
- Read every signature. "Permit", "setApprovalForAll" or an unreadable message can empty a wallet without any transfer.
- Farm from a separate wallet that holds only what the tasks need. Keep savings in a wallet that never touches new sites.
Wallet basics
Seed phrases, wallets, passwords and 2FA: the foundation everything else rests on.
- Start here: crypto safety in 10 rulesThe ten habits that stop nearly every common crypto theft, from seed phrase leaks to wallet drainers. Read this first.
- Seed phrases: what they are and how to store themYour 12 or 24 recovery words are the master key to your wallet. How they work, how to back them up, and the mistakes that get them stolen.
- Hot wallets vs cold walletsBrowser and phone wallets, hardware wallets, exchanges and multisig compared. What each protects you from, and what it does not.
- Setting up a hardware wallet safelyBuying, unboxing, initialising and using a hardware wallet without falling for tampered devices, fake apps or seed phrase traps.
- Wallet separation: vault, daily and farming walletsWhy every airdrop hunter should split funds across separate wallets, and how to set up a vault, a daily wallet and burner wallets.
- Password managers for crypto usersWhy unique passwords matter for exchange and email accounts, how a password manager helps you spot phishing, and what it should never store.
- Two-factor authentication: SMS vs apps vs security keysNot all 2FA is equal. Why SMS codes are weak, how authenticator apps and passkeys compare, and which to use for exchanges and email.
- SIM-swap protectionHow attackers hijack your phone number to take over exchange and email accounts, the warning signs, and how to lock your number down.
- Securing the email behind your crypto accountsYour email can reset your exchange, wallet app and social accounts. How to lock it down and spot the phishing that targets it.
Airdrop safety
How to farm and claim airdrops without handing your wallet to a drainer.
- How to spot a fake airdropThe patterns behind fake airdrop announcements, claim links and "eligibility checkers", and a quick test to run before you connect a wallet.
- Fake claim sites and lookalike domainsHow phishing domains imitate real projects with typos, extra words, other extensions and lookalike characters, and how to make sure you are on the real site.
- Token approvals and how to revoke themWhat approve, unlimited allowances and setApprovalForAll actually permit, why old approvals are a risk, and how to check and revoke them.
- Signature drainers: permit, setApprovalForAll and blind signingHow wallet drainers steal funds with signatures that look harmless, the request types to treat as dangerous, and how to read them before you click.
- Reading wallet transaction previewsHow to read a wallet confirmation screen: domain, contract, function, simulation and fees, and the signs that a claim is not what it claims to be.
- Scam tokens and NFTs that appear in your walletWhy strangers send you free tokens and NFTs, how interacting with them can lead to a drainer, and what to do instead.
- Address poisoning: the copy-paste trapHow attackers plant lookalike addresses in your transaction history so you send funds to them, and the habits that make the trick fail.
- How to claim an airdrop safely, step by stepA checklist for claiming a real airdrop without getting drained: finding the official link, preparing the wallet, reading the transaction and moving the tokens after.
- What legitimate airdrops never ask forA short list of requests that a real airdrop will never make, so you can reject scams immediately without investigating further.
- Airdrops and taxes: general pointsAirdropped tokens can create tax obligations in many countries. General principles, what records to keep, and where to find official guidance. Not tax advice.
Common scams
The scams that take the most crypto, how each one works and how to spot it.
- Impersonation and DM scams on X, Telegram and DiscordFake founders, fake moderators, fake friends. How impersonation scams start in your DMs and replies, and simple rules that shut them down.
- When official channels get hackedReal project accounts on X, Discord and Telegram are regularly compromised to post fake airdrops. How these attacks work and how to protect yourself even when the source looks genuine.
- Fake support agentsScammers pose as wallet, exchange and project support to steal seed phrases and account access. How to recognise them and how to get real help.
- Pig-butchering investment scamsLong-con romance and friendship scams that lead victims to fake trading platforms. How they unfold, the warning signs, and what to do if someone you know is caught in one.
- Rug pulls and honeypot tokensHow token launches and DeFi projects are set up to trap buyers, the contract and liquidity red flags to check, and why many "airdrops" are just exit liquidity.
- Fake wallet apps and browser extensionsCounterfeit wallets in app stores, extension stores and search ads steal seed phrases the moment you import them. How to make sure you install the real thing.
- Malware from fake jobs, games and "beta tester" offersAttackers send crypto users files and code that steal wallets and browser sessions. How fake interviews, game tests and meeting apps are used, and how to stay safe.
- Recovery scams: the second scam after the firstVictims of crypto theft are targeted by fake recovery firms, hackers and "lawyers" who promise to get the money back for a fee. Why they cannot, and where real help comes from.
Everyday security
Exchanges, DeFi, devices and planning for the long term.
- Exchange account security and withdrawal allowlistsHow to lock down a centralised exchange account: 2FA, anti-phishing codes, withdrawal allowlists, API keys and what to keep on the exchange at all.
- DeFi and bridge risk basicsThe risks you take when using DeFi protocols and cross-chain bridges for airdrop farming, from contract bugs to oracle failures, and how to size your exposure.
- Device and browser hygiene for cryptoKeeping the computer and phone you use for crypto clean: updates, separate browser profiles, extensions, downloads and the habits that keep infostealers out.
- Inheritance and backup planningHow to make sure your crypto can be found and recovered by the right people if something happens to you, without making it easier to steal today.
Get help
Hacked, scammed or unsure? Start here.
- I've been hacked: the first-hour checklistWhat to do, in order, when your wallet has been drained or your seed phrase, exchange or email account is compromised. Speed and order matter.
- Where to report crypto scamsWhere to report crypto theft, phishing sites, scam addresses and impersonation accounts, by country and by type of report.
- Printable crypto security checklistA tick-box checklist covering seed phrases, wallets, accounts, devices and airdrop habits. Your ticks are saved in this browser only.
- Crypto security glossaryPlain-English definitions of the security terms used across this site, from address poisoning to zero-value transfers.