Web3 security advice ages badly except for one category: wallet hygiene. The habits below predate every current chain and will outlive the next scam cycle, because they attack the constant — a signature you shouldn't have made.
- Split wallets by job: a hot wallet for interacting, a cold one that never touches a dapp.
- Read what you sign. An approval for 'unlimited' spending of a token is exactly that.
- Revoke stale approvals quarterly — old permissions are the drainer's favorite door.
- Address poisoning works because people copy from history. Verify the middle characters, not just the ends.
- Nothing legitimate ever needs your seed phrase. Not support, not a claim page, not a 'migration'.
None of this requires hardware you don't own or expertise you don't have. It requires treating every signature like the money it controls — which, on-chain, it literally is.
