Muhammad Idrees

A friendly reminder to take your crypto security seriously. Start doing these things TODAY: - Keep your long-term holdings offline. Consider a hardware wallet or an air-gapped wallet on a dedicated offline device. If you don't want to buy a hardware wallet, air-gapped storage is an alternative. - Never use one wallet for everything. Keep separate wallets for long-term holdings, trading, DeFi, airdrops, and unfamiliar protocols. @Rabby_io and @phantom are the only wallets I use. - Don't keep your entire portfolio in one place. Avoid concentrating all your funds on a single CEX, hot wallet, protocol, or device. - Don't use public Wi-Fi for crypto activity. If you work from cafes or coworking spaces, use your phone's personal hotspot instead of connecting to public Wi-Fi networks. - Protect your seed phrases. Never store them in screens, cloud storage, emails, or password managers connected to the internet. If your seed phrase has ever been stored on an internet-connected device - migrate to a fresh wallet NOW! - Keep secure offline backups. Store recovery backups somewhere safe, preferably with protection against fire/water and unauthorized access. I recommend getting a fire-resistant and water-resistant document bag. - Use a dedicated device for crypto. Keep your hot wallets and high-value transactions on a separate device. Don't use it for random downloads, gaming mods, unknown software, or everyday browsing. - Use a separate browser for wallets. Keep your wallet browser dedicated to trusted crypto activity. Avoid unnecessary extensions and random websites. - Never install cracked software on crypto devices. Pirated applications, fake installers, and malicious updates can contain wallet-stealing malware. If you need to run untrusted software, keep it completely isolated from your crypto environment. - Keep your devices updated. Update your OS, browser, and wallet software through official sources. - Remove unnecessary browser extensions. Even legitimate extensions can become dangerous after a compromised update or ownership change. Keep only what you absolutely need. - Stop using Google Search to find crypto websites. Fake websites and malicious sponsored results can look almost identical to legitimate ones. Use independently verified official links from bookmarks instead. - Don't open random links from X or Telegram. Especially not in the browser where your wallets are installed. Never!!! - Secure your CEX accounts. Use passkeys or hardware security keys where supported. Enable withdrawal address whitelists and avoid relying on SMS 2FA. - Consider getting a YubiKey. A physical security key can help protect your email and exchange accounts against phishing. Buy only from the official manufacturer sellers. - Review your Google-connected crypto accounts. Check which crypto services use Google Sign-In. Never disconnect your only login method without setting up an alternative first. - Revoke unnecessary token approvals. Use @RevokeCash to review and remove permissions you no longer need. Disconnecting a wallet from a dApp does NOT revoke its token approvals. - Avoid unlimited token approvals. Whenever possible, approve only the amount you actually need. Unlimited allowances can expose much larger balances if a spender is compromised. - Review Permit2 permissions. Permit2 signatures can authorize token transfers without a normal on-chain approval transaction. Review existing allowances and permissions. Some malicious signatures can be exploited long after they're signed. - Never blindly sign messages. A signature doesn't need to cost gas to be dangerous. Never get distracted while signing transactions. Either finish your transactions first or take care of everything else before you start. Make this a rule. - Be careful with custom RPC endpoints. Don't add/delete now unknown RPC URLs. Use trusted providers and verify network settings independently. - Understand EIP-7702 authorization risks. On supported networks, account delegation can grant powerful capabilities to other code. Never approve an account delegation you don't understand. (That's why Binance was hacked) - Never copy addresses blindly from transaction history. Address poisoning attacks can place lookalike addresses in your transaction history. Verify the full destination address against a trusted source. - Watch out for clipboard malware. Malware can replace a copied wallet address with an attacker's address. Always verify the entire destination address after pasting, preferably on an independent trusted display. - Verify token contracts and networks. A familiar ticker or logo doesn't prove a token is legitimate. Check the contract address and make sure the receiving platform supports the exact asset and network. - Test large transfers first. When sending funds to a new destination, start with a small test transaction. - Ignore unexpected tokens and NFTs. Random assets appearing in your wallet may contain phishing links or fake reward claims. Don't interact with them just because they appeared in your balance. - Don't trust unexpected job offers or collaboration requests. Fake interviews, partnership offers, and test applications can be used to distribute wallet-stealing malware. Never run unfamiliar software on your crypto device just to qualify for an opportunity. - Never run terminal commands you don't understand. Fake troubleshooting guides, verification pages, and job interviews may ask you to copy and paste commands into your terminal. One malicious command can compromise your entire device, including your wallets. - Never trust a QR code blindly. QR code can contain a malicious website, payment request or an attacker's wallet address. Avoid scanning unknown QR codes with devices that contain your crypto wallets or other sensitive data. - Understand bridge and DeFi risks. Before depositing significant funds, check contract upgradeability, admin privileges, timelocks, and bridge security assumptions. Audits are useful, but they don't guarantee safety. - Secure your multisig properly. If you use @Safe or another multisig, keep signer keys on independent devices. Review owners, signing thresholds, modules, and guards. A malicious module may bypass normal multisig approval requirements. - Monitor your wallets. Set up alerts for unexpected transfers, approvals, and other sensitive activity where supported. Use Codex/Claude to vibe-code a simple TG-bot that notifies you whenever something happens in your wallets. - Have an emergency recovery plan. Know what to do if a wallet, seed phrase, device, or exchange account is compromised. If your seed phrase is exposed, move your assets to a new wallet generated from a fresh seed on a trusted device. Revoking approvals alone won't fix a compromised private key. - Keep your crypto holdings private. Avoid publicly revealing wallet balances, screenshots of large portfolios, or details of your security setup. Don't make yourself an easy target for social engineering or physical theft. - Protect yourself from SIM swapping. Attackers can hijack your phone number and intercept SMS verification codes. Use authenticator apps, passkeys, or hardware security keys instead of SMS wherever possible. Secure your mobile carrier account too. - Don't blindly trust familiar contacts. A message from someone you know doesn't mean their account is still under their control. Verify it through another channel first. - And one last thing: You don't need to be paranoid. You just need to make it much harder for someone to steal what you've spent years building. Protect your capital before you think about growing it.