A sad story. At first, I thought this was a joke. After checking the on-chain records, I fell silent. This brother held 492 ETH for five years without participating in any DeFi, NFT, or mining investments, until yesterday when he tried something new for the first time and was directly hacked, losing 13 million RMB in an instant. It echoes an old saying: 'What is meant to be will be, and what is not meant to be cannot be forced.'
Through the blockchain explorer, I found that this brother first hoarded coins 1800 days ago, transferring in 144 ETH, which was also the first transaction for this address. In the following years, there were only transfers of ETH with no interactions in DeFi, NFTs, etc. It seems he is a long-term hoarder.
The tragedy happened two days ago; this brother, for some reason, probably after seeing some free airdrop or something, directly authorized his wallet and performed a claim operation, resulting in 494 ETH being stolen in an instant.
The Ethereum blockchain explorer shows that this operation is a claim reward, which means collecting rewards. Friends familiar with DeFi know the term 'claim'; it is generally used by project parties to reward liquidity mining, etc. Usually, many rewards are claimed together to save on gas fees.
The address where 494 ETH was transferred has already been marked by Etherscan as a fake phishing address, indicating that more than just him has fallen for it.
A lesson of 13 million reminds everyone again: if it's a main wallet with a large amount of coins, do not interact at all. Use a small wallet for airdrop DApp interactions. If you need to interact with your wallet, always verify the website address to prevent phishing. Some hackers will fish for a long time; they might not steal your coins for over six months if your private key is lost, because the amount is too small. But the day you suddenly withdraw a large sum to that address, a pre-written program or robot could take it away in a minute. You won't even remember when you leaked your private key.
If you are a newcomer with few coins, just keep them in top-tier exchanges.
1. Passwords should be independent and complex.
Passwords are the first line of defense for digital assets; never be careless. Many people, seeking convenience, use the same password across exchanges, wallets, and email platforms, which is like putting all their eggs in one basket. Once a password is leaked from one platform, assets on other platforms may be at risk.
The correct approach is to set independent passwords for each platform, and the passwords should be complex enough. You can use a combination of 'uppercase letters + lowercase letters + numbers + special symbols,' aiming for a length of at least 12 characters. For example, 'Qwerty123!@#' is much safer than '123456'. At the same time, develop the habit of regularly changing passwords, suggesting every 3-6 months, to prevent hackers from taking advantage.
2. Enable 2FA (two-factor authentication).
Two-factor authentication (2FA) acts like an extra lock on your account, significantly improving account security. SMS or email verification codes are the most basic forms of 2FA but are relatively less secure because SMS can be intercepted, and email can be hacked.
A safer choice is to use Google Authenticator or a hardware security key. The verification codes generated by Google Authenticator are time-based and do not rely on the internet, making them more secure. A hardware security key is a physical device that allows login only after being inserted and validated, providing top-level security. Do not shy away from the hassle; enabling 2FA can help protect your assets at critical moments.
3. Be wary of phishing links / fake customer service.
In the field of digital assets, phishing scams are rampant, and scammers' tactics are becoming increasingly sophisticated. They disguise themselves as official customer service representatives, project teams, etc., sending you phishing links or requesting passwords, recovery phrases, or verification codes through emails, SMS, or private messages.
Remember a hard rule: any 'official' request for your password, recovery phrase, or verification code is 100% a scam! Official sources will never ask users for such sensitive information for any reason. If you encounter suspicious links or messages, be vigilant and do not click or respond easily. You can verify through official websites or customer service channels and only take action after confirming accuracy.
4. Download software through official channels.
Wallets, exchange apps, and other software are important tools for managing digital assets. Downloading pirated software can lead to dire consequences. Pirated software may steal your account information, passwords, recovery phrases, etc., leading to asset theft.
Therefore, when downloading software, always go through official channels; download only from official websites or official app stores. Before downloading, carefully verify developer information to ensure you are downloading the official software. Do not click on unknown links to download software, nor install APK files from unknown sources, to avoid falling into scammers' traps.
Wallets (the top priority).
5. Recovery phrase = all your assets.
The recovery phrase is the key to restoring your wallet, equivalent to the 'key' to your digital assets. Once the recovery phrase is leaked, your assets face the risk of being stolen, and it is very difficult to recover them.
The correct way to securely store the recovery phrase is to write it down on paper, not to screenshot, store on cloud drives, email, or WeChat. You can keep the handwritten recovery phrase in multiple safe places, such as a fireproof and waterproof safe, or give it to trusted family members for safekeeping. Never disclose the recovery phrase to anyone, including so-called 'official customer service.'
6. Cold wallets are the way to go.
Hot wallets (mobile/computer software wallets) are convenient to use, but they are connected to the internet and carry certain security risks, suitable for storing small amounts of pocket money. For large assets, always use hardware wallets (like Ledger, Trezor) for offline storage.
Cold wallets do not connect to the internet, effectively avoiding risks from hacker attacks and phishing. When using a cold wallet, transactions need to be confirmed on the device, providing higher security. Although cold wallets are relatively expensive, this investment is very worthwhile compared to the potential loss of large assets.
7. Be cautious with authorizations.
When using DApps, you need to authorize your wallet to connect to the DApp for transactions and other operations. But be cautious when authorizing, carefully check the permissions and amounts authorized to avoid granting unnecessary permissions or excessive assets.
For example, some DApps may request indefinite authorization to use your assets, which is obviously unsafe. Before authorizing, clarify the scope and duration of the permissions, and only grant necessary permissions. After using the DApp, promptly revoke unused authorizations. You can use tools like Revoke.cash to check and revoke authorizations, reducing the risk of asset theft.
Advanced vigilance.
8. Money does not fall from the sky.
In the digital asset market, so-called 'super high returns,' 'airdrops,' 'delegated investments,' 'insider information,' etc., often appear; most of these are scams or traps. Scammers exploit people's greed to attract investors, ultimately running off with their money.
Remember, money does not fall from the sky. High returns often come with high risks, and those projects that promise 'guaranteed profits' and 'super high returns' are 99.9999% scams. Do not let greed cloud your judgment; maintain rationality and calmness, carefully discern various investment information, and avoid being deceived.
9. Do not mess with unfamiliar tokens.
Sometimes, you may suddenly see some unfamiliar tokens in your wallet, especially NFTs. This is likely a phishing trap. Once you interact with or sell these tokens out of curiosity, you might trigger a malicious contract, leading to the theft of assets in your wallet.
In such situations, do not be curious, and do not operate these unfamiliar tokens. You can ignore them or hide them from your wallet. Do not easily trust tokens recommended by strangers, and do not casually participate in token trading of unknown projects.
10. Regularly check security settings.
The security of digital assets is a dynamic process that requires regular checks and maintenance. You can periodically check the login devices, authorization status, security settings of various platforms, ensuring account safety.
For example, check for unfamiliar login devices, delete seldom-used login devices in a timely manner; review authorization status and revoke unnecessary authorizations; check if passwords are secure enough and if they need changing; confirm if 2FA is properly enabled, etc. By regularly checking, you can promptly identify and resolve security risks, protecting your digital assets.
A newcomer who has just stepped into the digital asset field can easily be overwhelmed by the fantasy of 'becoming rich quickly,' but countless lessons learned through blood and tears remind us: safety is the lifeline of digital assets. A single oversight may lead to losing all your capital. Always remember this deeply.
If you currently feel helpless or confused about trading and want to learn more about cryptocurrency and the latest insights, click on my profile to follow me, so you won't get lost! Market trends are clearer when you have solid understanding, and steadily profiting is much more practical than fantasizing about getting rich quickly.