Risk and Safety Handbook.

Chapter 1

Fraud usually starts with language before it reaches your wallet

CFTC and SEC fraud alerts warn about high guaranteed returns, low-risk promises, and complicated language that makes an offer hard to understand. Those signs matter because the scam often begins long before any transaction is signed. It begins when the victim is trained to suspend skepticism.

Chapter 2

Domain discipline prevents many avoidable losses

Users often land on malicious sites because they click links in direct messages, replies, or lookalike search ads. The safe path is to start from a known official source, store the verified domain, and compare it carefully before logging in or connecting a wallet.

1. Open official links from saved bookmarks or verified documentation.
2. Check the full domain, not just the page design or logo.
3. Treat surprise support outreach as suspicious by default.
4. When in doubt, disconnect first and verify through the official help center.

Chapter 3

Wallet safety begins with the recovery model

MetaMask's safety messaging is direct: never share the Secret Recovery Phrase. That message is foundational because the recovery phrase or private key is effectively the root credential for the wallet. If another person acquires it, the wallet is no longer yours.

Separation also matters. A burner wallet for experimentation is different from a storage wallet that should rarely interact with unfamiliar applications.

Chapter 4

Approvals can outlive the moment that created them

Many users think risk only exists when they actively send funds. In reality, token approvals can remain in place after the original interaction. If the contract is malicious or later compromised, those permissions can become part of the attack path.

1. Read approval prompts with the same caution as send prompts.
2. Use separate wallets for higher-risk experimentation.
3. Review stale approvals periodically.
4. Do not normalize signing prompts you do not fully understand.

Chapter 5

Device hygiene lowers risk by reducing accidental exposure

Wallet risk is not only about blockchain behavior. It is also about the browser, device, extensions, saved sessions, and software upkeep surrounding the wallet. A cleaner device environment reduces the number of ways a user can be tricked, intercepted, or confused.

Practical steps include reviewing installed extensions, keeping software updated, and avoiding unnecessary wallet use on shared or poorly controlled devices.

Figure B. Domain discipline should be a fixed operating path, not an improvised guess under pressure.

Figure C. Browser separation, extension review, and updates reduce the number of ways confusion turns into exposure.

Chapter 6

Incident response should be calm, structured, and documented

When something feels compromised, panic creates secondary mistakes. The first move is to stop interacting. The second is to identify what happened: a bad link, a suspicious approval, a compromised account, or a fake support interaction. Only then should the user decide on the next containment step.

1. Stop using the affected workflow immediately.
2. Review recent approvals, sites, and transaction history.
3. If necessary, move remaining assets carefully to a clean destination wallet.
4. Document the incident so the same pattern becomes easier to recognize next time.

Figure A. A calm response sequence reduces the chance of a second mistake during a bad event.

Research Notes

Source foundation and further reading

External facts were paraphrased and checked against official or public-interest sources available at drafting time. Before public launch, re-check support guidance, wallet tooling, and reporting paths against the current official documentation.

• CFTC: Digital asset fraud warning signs
• Investor.gov: Introduction to Investing
• MetaMask Help Center