In our workshops, the same mistakes appear repeatedly. None require advanced technical skill to avoid — they require habits and scepticism.
Approving transactions without reading
Wallet pop-ups show what a transaction will do. Malicious sites trick users into approving transfers of all tokens. Slow down. If you do not understand the approval, reject it.
Connecting to unknown sites
“Connect wallet” on a random link from social media is a common attack vector. Bookmark official sites. Verify URLs character by character.
Fake support messages
No legitimate support team will ask for your seed phrase. Ever. Scammers impersonate wallet support on Discord and Telegram daily.
Airdrop scams
Unexpected tokens appearing in your wallet may be bait. Interacting with scam tokens — clicking links in their metadata or selling through fake interfaces — can drain your wallet.
Using mainnet before practising
Create a devnet wallet first. Send test transactions. Get comfortable with addresses, fees, and explorers before using real SOL.
Storing keys on shared computers
Library PCs, work laptops with remote admin access, and family computers are poor places for wallet extensions with significant funds.
Ignoring software updates
Wallet and browser updates patch security holes. Enable automatic updates where possible.
Our wallet security workshop walks through several of these scenarios live on devnet.