Almost nobody loses funds because a blockchain was hacked. They lose them because a seed phrase ended up in a photo gallery, because they clicked "Approve" without reading, or because they sent USDC on the wrong chain to an exchange that had no way to return it. The frustrating part is how ordinary these errors are: each one takes seconds, and each one is reversible only in theory. What follows is a checklist worth reading before your next transaction, and again every few months.

1. Seed phrase exposure: the mistake that ends the story

Your twelve or twenty-four words are the wallet. Anyone who reads them owns everything in it, on every chain, forever. There is no password reset and no support line that can undo it.

The usual leaks are mundane. A screenshot in the camera roll, synced to the cloud. A note in Apple Notes or Google Keep. An email draft you sent to yourself for safekeeping. A text message to a partner. Each of those is one account compromise away from being someone else's property.

Three cases deserve special attention:

• Typing it into a website. No legitimate wallet, exchange, airdrop, or migration tool ever needs your seed phrase. If a page asks for it, the page is the attack.
• Sharing it with "support." Real support teams never ask. Anyone who does is impersonating one, usually from an account that messaged you first.
• Storing a single copy. House fires, hard drive failures, and moving countries have cost people more than any exploit. Keep at least two copies, offline, in separate physical locations. Paper is fine; metal plates survive water and flame better.

When you write the phrase down, check it twice before you move anything of value into the wallet. Then wipe a test wallet and restore it from the backup to confirm the words and their order are correct. A backup you have never restored is a hope, not a backup.

2. Approving contracts you never inspected

Token approvals are the quietest drain on this list. To swap on a decentralized exchange, you first grant its contract permission to move your tokens. Many interfaces set that permission to unlimited by default, and it stays open until you revoke it. If the contract is later exploited, or if it was malicious from the start, your balance is exposed without another click from you.

The NFT version is setApprovalForAll, which hands a contract control of an entire collection. Approvals are also why wallet-drainer kits work: you connect to a fake mint page, sign a request that costs nothing, and the tokens leave minutes later.

What to do instead

• Read the approval screen. If the requested amount is unlimited and you only need a small swap, set a specific amount.
• Review and revoke old approvals periodically using a reputable revoke tool, and disconnect sites you no longer use.
• Treat any signature request as a transaction, even when your wallet shows zero gas. Off-chain permit signatures can authorise transfers just as effectively.
• If your hardware wallet screen shows data you cannot interpret, stop. Hex you don't understand is not consent.

3. Wrong network, wrong address, missing memo

Blockchains are unforgiving about routing. Send a token on the wrong chain and it may not arrive where you expected; send it to a contract address instead of a wallet, and it usually cannot be recovered at all.

The most common version: depositing USDC or ETH to an exchange using a network the exchange does not support for that asset. Some platforms will retrieve it for a fee. Many will not, and the funds sit in an address nobody controls the keys to.

Then there are memo or destination tags, required by some chains and exchanges to credit your deposit to the right account. Omit the tag and your deposit can land in the exchange's general pool, requiring a manual support ticket. Send it to the wrong tag and you may have gifted it to another user.

Copy-and-paste deserves a warning of its own. Clipboard malware still swaps addresses after you copy them, and "address poisoning" attacks send tiny amounts from lookalike addresses so a fake entry appears in your history. Verify the first six and last six characters against saved, trusted data — a screenshot or a written note — rather than against what your wallet displays. For anything sizeable, send a small test amount first and confirm it lands before the rest follows.

4. Phishing pages and counterfeit wallet software

Fake wallet extensions, cloned login pages, and paid search ads pointing to near-identical domains remain the most efficient way to steal from careful people. The page often looks perfect because it is a copy of the real one, with a different URL and a form that forwards your input.

Habits that block most of it: type the domain yourself or use a bookmark, and never trust a link from a direct message, a Discord announcement, or a sponsored search result. Check the publisher of any browser extension before installing it, and prefer installing from the official store listing you navigated to independently. Treat countdown timers and "claim before it expires" prompts as a design choice aimed at your judgement, not your benefit.

5. Poor wallet architecture and skipping the boring maintenance

A single wallet holding your long-term savings, your trading float, and the thing you use to mint random NFTs is a wallet that will eventually be compromised in full. Split roles. Use a hardware wallet, or a multisig, for what you cannot afford to lose. Keep a separate hot wallet with modest balances for daily activity, and a throwaway wallet for anything unvetted.

Install updates for your wallet app, browser, and operating system. Test your restore process once a year. Don't import the same seed phrase into a dozen apps, since each app becomes another place it can leak from. And don't store meaningful value on a phone you use for unknown apps and sideloaded software.

6. Panic, and the "recovery" offers that follow

Losses compound when people are frightened. Posting your seed phrase in a forum asking whether it looks compromised ends the conversation immediately. Hiring someone who promises to recover stolen funds, or paying a "withdrawal fee" to unlock an account, is almost always a second theft of the same victim. Anyone offering remote screen access to fix your wallet is asking for your keys with extra steps.

If something goes wrong, slow down. Move whatever remains to a fresh wallet you control, created from a new seed phrase on a clean device. Write down what happened. Report it to the platform involved. Expect no rescue, and be suspicious of anyone who arrives offering one.

A five-minute pre-flight checklist

1. Is my seed phrase offline, written correctly, and stored in two separate places?
2. Am I on the right domain, having typed it myself rather than followed a link?
3. Does the receiving address match my saved copy in the first and last six characters?
4. Is the network supported by the destination, and have I included the memo or tag if required?
5. Have I sent a small test amount before the full transfer?
6. Do I understand what this signature or approval actually authorises?

None of this is glamorous. It is, however, the difference between a wallet that quietly does its job for years and a support ticket you will never get a satisfying answer to. Run the list, keep the seed phrase off every screen, and treat every confirmation prompt as though it were the last one you'll read.

Photo: Ann H / Pexels