Security and scams

What this lesson explains and who it is for

This lesson is about not losing funds in crypto to a verification mistake rather than a bad move on the chart. It is for anyone who signs their own transactions, connects a wallet to new applications, or buys tokens outside the main exchanges. It gives you one fixed sequence of checks to run before sending anything, a list of stop conditions, and a way to calculate the maximum loss you grant by signing an approval. Key storage, segregation of funds and the withdrawal test belong to a separate lesson — storing funds.

Threat model: four vectors of loss

A crypto scam rarely looks like fraud. It usually looks like an ordinary activity based on substituted information. Four vectors cover most real cases.

Four vectors, one consequence: a loss without a stop-loss. The market will not hand your position back after a key leak, because there is nothing left to close. Leverage and funding kill a trading account; these four vectors kill it before trading starts.

Verification protocol before sending anything

The sequence is fixed and always runs in the same order: each step filters out cases that invalidate the next. Run every step before the first signature, not after a mistake.

1. URL from an official source. Type the address yourself or use a saved bookmark. A link from a private message, a comment, a search advertisement or a post is not a source. Compare the domain character by character, including the top-level domain.
2. Contract address consistent with the project documentation. The documentation or official channel gives the address. The contract you see in the interface must be identical, character for character. Do not rely on the name or ticker: both can be copied.
3. Scope of the approval (approve) deliberately limited. Before confirming, read what the approval grants access to and for how much. If the interface proposes an unlimited cap and you cannot justify it, set the limit yourself.
4. Withdrawal limits checked before the deposit. Before funds enter a new application, check whether they can be withdrawn within a reasonable time, and on what terms. A limit you learn about after depositing is too late.
5. The official channel confirms the announcement. If an instruction arrived by message, confirm it in the channel you know from the documentation — not in the same thread. An airdrop, a token migration, an “account verification” all pass through this test.

Five steps, one goal: no signature is the result of haste triggered by someone else’s message.

Stop conditions: when you walk away instead of “checking further”

A stop condition is a situation in which you end the procedure immediately, without negotiating or asking for clarification. Write it down in advance: under pressure in a live conversation it works differently than at your desk.

The stop condition also applies when you are halfway through and everything has matched so far. Four matching steps do not invalidate the fifth.

Approvals: how to calculate the maximum loss

An approval without a limit is not an abstract risk. It has a measurable size, which you can calculate before signing:

maximum loss from an approval = the smaller of two values: the balance of the token covered by the approval and the cap granted in the approval

This changes how you approach new applications. With a cap set manually, your loss is known in advance and equals what you specified. With an unlimited cap, it equals the whole token balance, including tokens bought later. Every future purchase then increases an exposure you had forgotten about.

Revoke — cancelling an approval — is something you do when the experiment is over, not “at some point”. An approval granted for a test and never revoked keeps working long after the project stops interesting you. DeFi hygiene is the same mechanism as a stop-loss, moved from the decision layer to the access layer.

MiCA, KNF and CASP: what you check at the source

The European Union has a supervisory framework for the crypto-asset market. In Poland, consumer announcements and the warning list are published by, among others, KNF. Check an entity’s status as a crypto-asset service provider at the source — in the authority’s announcements and registers — not in an advertisement, a “regulated in the EU” footer or an influencer’s post. The KNF entry explains what this authority is.

This course neither grants nor confirms a licence to any platform. Statuses change, as does the scope of entities’ obligations. Your dated note is worth more than a remembered sentence from an advertisement.

Phishing protocol — fill it in with your own case

Do not copy other people’s incident reports. Walk through this table using your own example, even a hypothetical one, but with your checklist and your decision.

The goal is one complete, dated row — not the conviction that you already know all about scams.

How to limit the blast radius of losses

Split your funds deliberately and name the baskets. The amount you trade, the amount kept off platforms, and the experimental amount you can afford to lose in full. A new application receives only the third basket, for example a few per cent of your capital (illustrative figure), plus the smallest sensible approval cap.

In words: no new application sees funds whose loss would change your plan. A hard boundary works better than good intentions, because by the third signature of the evening intentions stop working. Separating keys and accounts is described in storing funds, and token-side risk in stablecoins and de-peg risk and spot versus perpetual.

When verification says “do not trade”

1. You cannot point to the contract address in the project documentation. The ticker and name alone are not enough: both can be copied within minutes. The stablecoin entry shows how easily similarly named assets are confused.
2. The interface proposes an unlimited approval and you cannot justify it. No justification means you do not understand the transaction you are signing.
3. You do not know how to withdraw funds from the new application. A deposit you cannot reverse is not a test but a bet.
4. The instruction arrived only through a private channel and no official source confirms it. A message does not become true because the sender has a familiar avatar.

Common mistakes

• Giving the seed to anyone. Official support never needs the recovery phrase, whatever the justification.
• Buying small-cap tokens “for the yield” when you cannot check the contract. If you cannot walk the five steps, do not enter.
• Signing “because airdrop”, without reading what you authorise. The promise of a free token does not justify a signature you do not understand.
• Keeping all your capital in one hot wallet connected to experiments. A single bad approval then covers everything.
• Treating an audit as a guarantee. An audit lowers the risk of known bug classes, but it does not remove economic risk or block later changes to the project.
• Trusting a “licence” shown in a chat screenshot. Check status at the official source, not in material sent by a stranger.

Measurable exercise

Carry out the protocol on one real application and record the result with a date.

1. Write out the five steps and, for each, record what you checked — the address, the cap, the channel.
2. Record the maximum loss from the approval, using the formula from this lesson, with a cap set manually to a test amount, for example fifty dollars (illustrative figure).
3. Make one test transaction from the experimental basket and revoke the unnecessary approval.
4. Fill in the phishing protocol table for a case you make up yourself, and record your decision.
5. Set a repeat check of the entity’s status for the next quarter.

The result you are looking for is not “I know scam theory”, but one completed row with a date, one revoked access, and one calculated maximum-loss figure.

Common questions

Does a smart contract audit guarantee security?

No. An audit lowers the risk of known classes of technical bugs, but it does not remove economic risk, does not protect against a sudden liquidity pull, or against a later change of permissions in the project. A contract with an audit can still be a token with no exit.

Why calculate the maximum loss from an approval if I revoke access after the test anyway?

Because you decide to revoke only after the fact, while the approval is live from the moment you sign. That number is the only parameter you know in advance and that does not depend on memory. With an unlimited cap it also covers tokens bought later, so it grows without any decision from you. Without it you do not know how large a position you opened.

Exchange or self-custody wallet — which should I choose?

It is not a choice of one model but a division of tasks. The custodial model shifts risk onto the platform; the own-keys model shifts it onto your operational hygiene. Both have different failure vectors, so there is no risk-free variant.

Does this course confirm that a given exchange holds crypto-asset service provider status?

No. Check the status yourself in official supervisory announcements and registers, and in EU announcements. An advertisement and a screenshot are not confirmation, and the information changes over time — so write down the date of your check.