MATEY

This is a little thread regarding security in Web3. The reason for writing this thread is a recent bounty by the @Kromes_io (which is a great project and I love my Kromes). I am not a fan of AI and English is not my main language so pardon me for any errors. I will just puke my thoughts which hopefully will serve as a shield against bad actors if you manage to stick around till the end and protect you from losing your assets , precious jpegs and magical internet moneys. Let's dive in: 1.Discord Oh discord. The place where most community's gather and where a big portion of the scam's / drains take place. To keep your self safe in Discord you need to follow a few simple rules : 1.1 If someone approaches you to trade your assets P2P (Wallet to wallet , Video Call , Calls in general) - 99 out of 100 times it is a scam. 1.2 If other party claims they can't buy your NFT on ME / Tensor, because of their country being banned , some random made-up issue - 99 out of 100 times it is a scam. 1.3.If other party claims they can't use famousfoxes (or whatever trading platform is the go-to for jpegs on the blockchain you are using) - 99 out of 100 times it is a scam. 1.3.1. If other party sends you a link claming they have made the offer and urging you to visit the link - it is a scam and you will most likely end up drained. Good practice is always to go the site of the trading platform your self and check if there is a pending offer / initiate offer. 1.4. Doing a trade trough middleman on discord often someone you know or a reputable mod / person in the space. Now this is tricky - I middleman a lot for people and I know sometimes its the only option especially when cross-chain assets are involved or more than 5 (4?) pNFTs since this is the limit of NFTs in a trade on foxxy. With all that said I still advise people to never do trades trough middlemans as it can get sketchy and you can lose your stuff easily. What the scammers usually do is they make a group chat with a fake impersonator who pretends they have your best interest in mind and will middleman out of good will. How it ends is you send them your assets and the scammers just leave the group chat and you are stuck asking your self what happened and why did it happen to you. The answer is simple - you got bamboozled. Simply avoid it and if you really have to and don't have a choice confirm the identity of the middleman by requesting them to tag you in the server / place where you know them from. Another thing you could do is enable developer tools from discord settings and compare the Unique ID of the person middle manning with the one they are pretending to be.
Honestly just use common sense.
 1.5. Links. Don’t click links in discord. Its that simple.If you really have to click a link have your default browser set to the one where your burner is (and no other wallets just in case of stupidity or if you are feeling brave).
If you really have to click on a link always double triple quadruple check if its the right one - go to twitter / official page of the website you are being lead to and confirm you are not getting scammed.
Something I often do is If I suspect a link is malicious i just open it in safari (MAC only tho) which has none of my wallets installed. Then I can check the site without much risk for my stuff being drained and decide if im even gonna connect my burner to this or not. Will go trough wallet set up later in this post so stay tuned. 1.6. Joining random sketchy discord servers - not going to dive into this too deep , but basically a fake verify bot can steal your discord token which gives access to malicious actors to your account. Don’t click links , if you are joining super degen servers rather use a secondary discord account and not your main one especially if you are in a position of power in a popular discord where people can lose money because you decided to mint degenerate 8inch dongers and gave ballonsville kinda guy access to the admin account of the NFT community you manage where a link gets posted later and people get drained. Use your brain and if you don’t have one at least follow some basic rules.

 GENERAL GOOD PRACTICE : USE 2FA(Most important). Have a spare discord account for your most degen activites. Don’t click links especially links from randoms. If you are in a position of power be extra careful, because you may not just lose your money , but also other people’s moneys. If you don’t know what you are doing better close your DM’s to strangers.

 GENERAL RULE : If anything seems too good to be true and creates a urge in you to act - it most likely is too good to be true and it very likely is a scam. Use your head and don’t be stupid. Elon Musk won’t chose to give you 500 million $ in $DOGE just because u have a pretty PFP. This space is filled with bad actors who are out to get ya and you are the only one who can protect your self from these people. You lose your stuff - its gone for good. 2. X (Formerly Twitter) Not much more can be said about X and much of the above applies to X too. Be careful with Twitter ADS - I have seen blatant drainers posted as twitter ads. You don’t click these. I repeat. You don’t click these.
How do you identify one ? Well they mostly create an urge to act and offer free stuff.
Take a second and think about it. Why would someone PAY for an AD to GIVE YOU - FREE STUFF? Doesn’t make sense right? Yeah. Common sense.
 
GENERAL GOOD PRACTICE: Use 2FA. DON’T CLICK LINKS. Be extra careful when interacting with comments especially comments under big Web3 accounts as scammers / impersonators often lurk there with drainer fake sites which imitate the original and again create an urge for you to receive this amazing free asset , because you deserve it and we go back to - DON’T CLICK LINKS.

 Also beware of hacked accounts. If a huge web3 account posts a link to somewhere all of a sudden without any prior announcement it is most likely compromised and interacting with the link can lose your moneys.So once again it all comes down to - NOT CLICKING LINKS. You see a pattern?

Always be on the lookout as this is your hard earned money / assets and you don’t wanna lose it.

 3. Wallet setup

 So I am pretty sure I am not the biggest web3 security guru out there and i am pretty sure there are even better practices , but I will tell you what I do and how I do it.

I have most good browsers installed :

Safari (set as default browser) - for checking links (no wallet on it) and just general browsing. 
Chrome - For my @xverse (BTC) wallet. Rarely used as I don’t like Chrome, because it takes too much memory and i operate on a calculator(thats a joke laugh). 
Firefox - Phantom Burner - I think I have ~13 Burners set up on firefox , but my main one serves as a minting wallet and rarely has any funds. Funds go in it only if im going to mint and it also depends if i wanna use phantom or any of my other burner wallets. 
Brave - @Phantom Ledger - Thats where i store most of my assets. Brave is promoted as the crypto browser and although its based on chromium it seems to be the most secure of all (i might be wrong here don’t quote me on this) This is where my ledger is (and if you are in web3 and operate with more than a few hundred bucks you should definitely get a cold storage device like ledger / trezor). My ledger doesn’t interact with anything besides matrica and even matrica I disconnect after I connect my ledgers. I buy stuff from my burners and it gets sent to the ledger. If im trading / selling an asset it gets sent out of the ledger to the burners. It takes me some time to do it , but it also acts as another layer of security and sometimes make me think twice what am I doing and do I really wanna do it which is never a bad thing in this space.
I also have a @solflare_wallet and @Backpack burners on my Brave which I use for various degen activities. With that many burners you can pick which one you gonna test your luck with if you REALLY have to do something stupid (which i suggest you don’t). 

 GENERAL GOOD PRACTICE : Own a cold storage device. Your could storage never interacts with anything. Different browsers for different things. Different burners with different seeds / paper wallets. Never share your seed with anyone (do i really have to say it ?). Never share your public / private key with anyone. Actually dive deep into web3 security and do your own research, because I am barely scratching the surface here. The more knowledgeable you are the better you can protect your self and your assets.

 Closing words : Don’t install random shit , cracked stuff from unknown sources. Hell if you can afford it pick a laptop that is solely for crypto and watch your porn on other devices. Don’t be stupid . Always think twice. Don’t click links. Educate your self on most common scams and exploits. Protect your self. Protect others.

 If ever in doubt you can always feel free to reach out in my DM’s on X or toiletsenpai in Discord. I will do my best to help even if I don’t know you.

 Hope you found this long block of text informative. If you did I will appreciate you hitting the engagement buttons and especially the bookmark ond retweet as I heard these buttons magically send BTCs to your Metamask. Yours -ToiletSenpai @okaybears (this is an engagement farm tag don’t mind it)