DeFi security basics: everyday habits that protect your funds

Split your wallets by job

The single most effective habit is to stop using one wallet for everything. Give each wallet a job, and keep the jobs apart.

If the experimenting wallet signs something harmful, the damage stops there. Your storage wallet, which has never approved anything, is untouched. The crypto wallets guide covers the wallet types that fit each role.

Get to the right site every time

Fake versions of popular DeFi apps are one of the most common traps. They look identical to the real thing, but connecting and signing sends your tokens to an attacker.

• Bookmark each app you use once you have confirmed its address, and always open it from that bookmark.
• Skip search ads. Paid results can point to lookalike domains, sometimes above the real site.
• Ignore links in direct messages, replies and comments, even from accounts that look official or familiar. Accounts get hacked and impersonated.
• Check the domain carefully. Watch for swapped letters, extra words, unusual endings and characters from other alphabets that look the same.
• Be wary of urgency. “Claim within 24 hours” and “your wallet will be suspended” are pressure tactics, not features.

Verify contract and token addresses

On a blockchain, anyone can create a token with any name. A token called “USDC” in your wallet is only the real USDC if it lives at the real contract address. Scammers create lookalike tokens, sometimes sending them to your wallet unasked, to lure you to a fake site to “sell” them.

Before you trade, deposit or approve, confirm the address you are interacting with:

• Find the official contract address from the project’s own documentation and compare it with a second trusted source, such as the official block explorer’s verified token page.
• Check that the address matches in full, not only the first few characters.
• Confirm the network. The same asset can have different addresses on different networks.
• Treat unknown tokens that appear in your wallet as bait. Do not try to sell or interact with them.

For more on how contracts behave, see smart contracts basics.

Small test transactions

Blockchain transfers are final. A test transaction costs a small fee and buys a lot of certainty.

Whether a test is worth its fee depends on network costs; the gas fees guide explains how fees work. For a step-by-step first run, use the first DeFi transaction checklist.

Device hygiene

Your wallet is only as safe as the device it runs on.

• Keep your operating system, browser and wallet software up to date.
• Install only the extensions and apps you need, from official sources.
• Use a strong device passcode and lock screen, and turn on two-factor authentication for any platform account, preferably with an authenticator app or security key rather than text messages.
• Avoid cracked software, game mods and unknown downloads on the device that holds your wallet.
• Consider a separate browser profile, or a separate device, used only for crypto.
• Never let anyone remotely control your computer to “help” with your wallet.

Hardware wallets add a useful layer here. Because the key never leaves the device, malware on your computer cannot simply copy it. It can still try to trick you into approving a harmful request, so always read the details on the device’s own screen rather than trusting what the computer shows.

Public Wi-Fi and shared computers deserve extra caution. If you must use them, avoid signing anything important, and never restore a wallet from your recovery phrase on a device you do not control. Treat a lost or stolen phone as a possible wallet compromise: if the wallet on it held meaningful funds, move them using your backup on a trusted device.

Phishing patterns to recognise

Most DeFi losses come from people being tricked into approving something, not from anyone breaking the underlying blockchain. The patterns repeat, which makes them easier to spot.

• Fake airdrops and claims that ask you to connect and sign to receive free tokens.
• Fake support that appears after you post a question publicly, then sends you to a “recovery” page.
• Wallet sync or validation pages that ask for your recovery phrase.
• Impersonated projects and influencers promoting a “new contract” or migration.
• Address poisoning: tiny transfers from an address that looks like one you use, hoping you copy it from your history next time.

You can test suspicious offers against the scam red flags tool before you engage.

Your checklist

• Set up separate storage, active and experimenting wallets.
• Bookmark each app’s confirmed address and use only those bookmarks.
• Verify token and contract addresses from two trusted sources.
• Send a small test before any large or unfamiliar transfer.
• Keep devices updated and use app-based two-factor authentication on platform accounts.
• Ignore unsolicited links, airdrops and support offers.
• Review and revoke unused token approvals regularly.

Sources and dates

• Ethereum security and scam prevention — ethereum.orgreference
  No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
• Ethereum wallets — ethereum.orgreference
  No date shown on page · checked 2026-10-31. What wallets are and how they hold keys.
• Introduction to smart contracts — ethereum.orgreference
  No date shown on page · checked 2026-10-31. What a smart contract is and how it executes.
• Gas and fees — ethereum.orgreference
  No date shown on page · checked 2026-10-31. How transaction fees (gas) work on Ethereum.
• Report fraud and cybercrime — Canadian Anti-Fraud Centrereference
  No date shown on page · checked 2026-10-31. How Canadians report fraud and cybercrime, including crypto scams.
• Investor tools — crypto assets — Canadian Securities Administratorsreference
  Page date 2025-10-22 · checked 2026-10-30. Crypto assets can be very volatile and risky; you could lose some or all of your funds.