Pinned Tweet
We just went 2.5 hours live.
Revealed the name. Revealed the website. Revealed the release date.
XCOLDPRO BootVault.
Software-based cold storage that eliminates everything wrong with hardware wallets.
Here's what we covered
The Drip Report is back live this Saturday, Nov 7 at 1 PM Mountain, here on X and on Rumble.
Brad, Flo, Jim and Liam go through the week in crypto security in plain language and take your questions live.
Save the time and bring a question.
We stream every Tuesday and Saturday at 1 PM Mountain. Follow @XDRIP so you catch the next one.
A wallet is only as safe as the device it sits on.
Two good habits when phone malware is in the news. Keep the phone updated. Keep long-term keys off a device that is online every day.
XColdPro keeps those keys on a machine that stays offline, so there is no live connection for malware to reach.
xcoldpro.com
Found a token in your wallet you never bought? Leave it alone.
Surprise tokens often carry a website in their name, and that site asks you to connect your wallet to "claim" or "swap" them. That's where people lose real money.
You can hide it in most wallet apps. Just don't visit the site in its name or approve anything it asks for.
We cover token approvals and wallet hygiene in the free lessons at xdripacademy.com
One small change that makes phishing a lot harder.
Use a separate email address only for exchanges, wallets and money apps. Don't post it anywhere, don't sign up for newsletters with it, and turn on the strongest sign-in it offers.
Scammers have a much harder time targeting an inbox they've never seen, and a fake "support" message stands out fast when that address only hears from a few places.
Free lessons on keeping accounts and wallets safe at xdripacademy.com. Nothing there is paid.
A lookalike download page can fool anyone, and this week one was even being suggested by AI chatbots.
A simple habit for anything that touches your crypto. Type the official address yourself, bookmark it, and only download from that bookmark. Not from an ad, a DM, or a link someone handed you.
For XColdPro, our offline cold wallet, that address is xcoldpro.com.
A photo of your recovery words feels safe because it's in your pocket. But most phones copy photos to the cloud automatically, and plenty of apps ask for access to your camera roll.
Write the words on paper or stamp them in metal, and keep them where only you and the people you trust can find them. Then delete any photo you took, including from recently deleted and your cloud backup.
If they've ever been photographed, plan to move that wallet to new words.
The free Self-Custody Security Checklist walks through backups step by step: xdripacademy.com/toolkit/sel…
Binance's initial findings on last week's theft list the tactics its security team says it ran into this year: fake job interviews, malware disguised as popular developer tools, tampered software packages and browser extensions, and fake video meeting apps.
You don't have to work at an exchange for these to reach you. If someone you just met asks you to install a meeting app, open a "test project" or add an extension before you can talk, stop there.
Use the app you already have. A real recruiter or partner will be fine with that.
Binance's write-up is on its blog under Community. Free plain-language lessons on how scams like this work at xdripacademy.com
Watching a video about wallet backups doesn't mean you can restore one.
That's why every year at XDRIP Academy ends with a practical you have to pass, not a video you have to finish. Restore a wallet from backup after a wipe. Sort twenty signature requests without calling a single hostile one safe. Write a continuity plan someone non-technical could follow.
It's free. Orientation and Year One are open to read without an account, and a short placement check tells you where to start.
Start free at xdripacademy.com. Nothing there is paid.
Check the Whole Address
Some scammers send tiny transactions from an address that starts and ends with the same characters as one you've used before. They're hoping you copy it from your history next time you send.
Checking the first few and last few characters isn't enough anymore. Save trusted addresses in your wallet's address book and copy from there, not from your transaction history.
When the amount matters, check the full address, every character.
Send a Little First
Moving a large amount to a new wallet this week? Send a small amount first.
Confirm it lands at the address you expected, on the network you expected, and that you can see it in the new wallet. Then send the rest.
It costs one extra fee and a few minutes. Sending on the wrong network, or to an address that got swapped on your clipboard, can cost a lot more, and there's no undo button.
There Is No $150 Reward
Heads up if you use Binance. Posts are spreading that claim a $150 compensation reward for the withdrawal suspension, with a screenshot of a reward task to claim.
Binance has replied to several of them saying the screenshot is digitally altered, and its support account says it is not offering rewards for the withdrawal suspension.
Scams show up right after big incidents because people are anxious and waiting for good news. Get updates only from the exchange's official accounts and app, and don't tap links from strangers in the replies.
No Forgot Password Button
When you lose a bank password, you click a link and reset it. Self-custody doesn't have that button.
Your recovery words are the reset. Nobody at a wallet company can send them to you, and anyone who offers to is running a scam.
Write them on paper, keep them somewhere only you can reach, and check once in a while that you can still find them.
The First Hour
Most crypto education starts with how to buy. XDRIP Academy starts with what to do when something goes wrong.
Lesson O101-01, The first hour, walks through a worked example. Someone types their recovery words into a fake app. From a phone that never saw those words, they set up a new wallet, move the two tokens that are left, change passwords, re-enroll 2FA and freeze withdrawals. About twenty minutes.
Nothing gets recovered. Two tokens and an exchange account get kept, and there's a report ready to file that night.
Happy Halloween from all of us at XDRIP. Thank you to our community for being part of the build. Have a safe and fun night. #Halloween














