Main Takeaways

  • Once a blockchain transaction is confirmed, it’s irreversible, so your final line of defense in Web3 is careful review of the signature page.

  • Double-check the entire recipient address, not just a few characters, to ensure your funds go to the right destination.

  • Know the difference between signing a transaction and signing a message – both can carry serious risks. A single misstep could give scammers access to your assets.

As you interact with digital assets and decentralized applications (DApps) on your Web3 journey, it's crucial to understand how to keep your funds safe. Think of your Binance Wallet as your digital vault, and the "signature page" as the moment you authorize actions from that vault.

When interacting with decentralized exchanges and DApps, you'll be routinely prompted to review and confirm a transaction or a "signature request." This is your critical moment to pause, verify, and protect your assets before they leave your hands! Read on to learn how to stay out of trouble while navigating the exciting world of Web3.

Understanding the Basics

The blockchain's power lies in its immutability: once a transaction is recorded, it remains there forever. This is why careful verification before you commit to any on-chain action is your ultimate defense.

The "No Undo" Rule

  • Finality: On-chain cryptocurrency transfers are final. Once you confirm a transaction via the signature page and it is processed on the blockchain, there's no way to reverse it.

  • Recipient is Key: Your funds will go to the address specified. If that address is wrong, or belongs to a scammer, your crypto is likely lost forever. This underscores the importance of always verifying the recipient's address extra carefully.

Review your actions. The confirmation page is the final step that will show you the action you're about to perform. Is it a swap, transfer, approve, sign, or something else? Make sure it aligns exactly with what you intended to do on the DApp.

On-Chain Transaction Signing

When you're making a transfer (e.g., sending crypto to another wallet) or executing a smart contract (e.g., swapping tokens on a DEX, providing liquidity etc), you will “confirm” it via the signature page. This means you are authorizing a change to the blockchain's state and your crypto will be transferred.

What to Review

  • Recipient address:  Is it accurate? Are there any changes to the address you entered previously? 

  • Details: Is the information about the coin (USDC/USDT, etc.) and the chain (BSC/ETH, etc.) you are sending funds on accurate?

  • Warnings: Are there any security warnings associated with the transfer? If something looks off, cancel the transaction and double-check everything.

Message Signing (Off-Chain / Signature Requests)

Sometimes, a DApp might ask you to "sign a message" or approve a "signature request." This type of signature usually doesn't directly move your funds. 

While message signing itself isn't a direct transfer, malicious DApps can trick you into signing messages like Permit, Permit2 or eth_sign that grant them broader permissions or even unlimited access to your tokens later. Binance Wallet has blocked the riskiest message signing functions (like eth_sign), but vigilance is still key.

What to Review

  • When presented with a message to sign, understand why the DApp is asking for it. If it seems unrelated to the action you're trying to perform, or if the message text is unreadable or looks like a string of random characters, do not sign it. 

  • If you're unsure, close the DApp and research what that specific signature request means for that particular platform.




Recognize the Common Traps

The Poison Address Trap

How: Scammers send virtually worthless amounts of crypto to your wallet from an address that mimics the first few and last few characters of an address you frequently use. They can also employ more sophisticated techniques to spoof your address, making it seem like you have sent funds to the address when you have never actually done it. 

Why: They hope you'll copy this address from your transaction history by mistake next time.

Prevention: Do not rely on muscle memory or copying from recent transaction lists. Instead,

  • Hide small/spam transactions. On Binance Wallet, you can click the filter button on the top right and hide these transactions from the list.

  • Use the address book. Save frequent recipients’ verified addresses to the address book and always use it to transact with these counterparties.

  • Copy from the source. Always copy the address directly from the original source (the person or platform you're sending to).

  • Test transactions (especially for large amounts). For significant transfers, send a very small amount first as a test transaction. Only after verification of receipt should you proceed with the larger transfer.

  • Paste and verify. Paste the destination address into your wallet and visually compare the entire string to ensure they match.

Phishing Websites

These are fake websites designed to steal your wallet credentials or trick you into signing malicious transactions.

How: Scammers might send you links via email, social media, or even manipulate online search results. Once you connect your wallet and provide an approval or risky sign your funds can be drained from your wallet without you taking any further action.

Prevention:

  • Check the URL meticulously. Look for subtle misspellings (e.g., uniswap.com vs. unὶswap.com) or alternative domain endings (.xyz instead of .com).

  • Never click suspicious links. Always go directly to the official website by typing the URL yourself or using a trusted bookmark.

  • Verify information independently. If you receive an urgent message about your account, verify it through official channels (e.g., logging into your account directly, contacting customer support through their official contact information) rather than clicking links in the message.

Phishing site impersonating an anti-money laundering (AML) checking website.

Fake Airdrops / NFTs in Your Wallet

You may suddenly see a strange token or NFT in your wallet that you didn't purchase. Scammers send these as bait.

How: They might include a malicious link in the token's metadata or description, enticing you to visit a website where you'll be tricked into signing a transaction that drains your wallet – or the Airdrop/NFT token itself might be malicious in nature.

Prevention: Do not interact with, sell, or click on any links associated with unsolicited or unknown tokens or NFTs. As long as you don't interact with them, they can't harm your funds. Clicking the red warning symbol, indicating a known malicious token, will show you more details about the current detected risks.

Ponzi Schemes

Ponzi schemes are scams intended to fund the scammer by keeping you investing and referring others to invest.

How: These schemes promise high returns to early investors from funds contributed by later investors. They collapse when there aren't enough new investors to pay off the old ones. 

Prevention: If something sounds too good to be true, it almost certainly is. Legitimate crypto investments involve risks, and consistent, guaranteed high returns are a major red flag.

Your Golden Rules for On-Chain Safety

  • Research Thoroughly: Before connecting your wallet to any DApp, do your due diligence. Research the project, its team, and its reputation. Look for smart contract audits conducted by reputable third-party firms.

  • Avoid Copy Pasting: While convenient, copying and pasting addresses can be risky due to clipboard hijackers (malware that changes copied addresses). 

  • Use Address Books: Bookmark your frequent verified address in the address book and always use these saved addresses.

  • Triple Check: Before you confirm any transfer on the signature page, compare the recipient address with the address you intended to send to, character by character. Scammers often rely on you only checking the first few and last few characters.

  • Beware of Social Engineering: Attackers often exploit human psychology rather than technical vulnerabilities, so beware unsolicited offers and scammers' pressure tactics.

  • Understand Permissions: Know exactly what you are doing when connecting your wallet or signing a message/transaction.

  • Heed Warnings: Always heed warnings shown in the wallet, when connecting or attempting to transact or sign else you can suffer total fund loss.

Final Thoughts

Navigating the Web3 landscape safely requires vigilance and a thorough understanding of the critical role the signature page plays as your final checkpoint before irreversible blockchain transactions. By carefully verifying recipient addresses, distinguishing between transaction and message signing, and staying alert to common scams like phishing sites and poison addresses, you can significantly reduce the risk of losing your assets. 

Remember, your Binance Wallet is your digital vault. Treat every signature request with caution, double-check every detail, and never rush the process. Staying informed and cautious is your best defense in protecting your funds and confidently exploring the exciting world of decentralized finance.

Further Reading

Disclaimer: Binance Wallet is an optional product. It is your responsibility to determine if this product is suitable for you. Binance is not responsible for your access or use of third-party applications (including functionality embedded within the Binance Wallet) and shall have no liability whatsoever in connection with your use of such third-party applications, including, without limitation, any transactions you dispute. Please carefully review the Binance Wallet Terms of Use and always do your own research.