Web3 Security View guide → Home：Web3 Exploration Guide →

Binance new-user bonus · Enjoy 20% fee rebate

Invite codeBINANBT

✅ The invite code is applied automatically when you register — no need to enter it manually

⚠️ Complete identity verification (KYC) after signup to trade & withdraw

⏳ The registration page takes 2–5 seconds to load — please wait, don't tap repeatedly.

Web3 Security • 11/8/2026 • Updated 11/8/2026 • Author：CoinVado Research • 13 reads • 14 min

Personal Web3 Security Checklist 2026: What to Check Daily, Weekly and Monthly

Web3 security is not just hiding your seed phrase. In January 2026, signature phishing cost 4,741 victims about $6.27 million, and most of them never lost a seed phrase. This guide turns personal security into a cadence: 3 minutes a day, 15 minutes a week, 60 minutes a month and 2 hours a quarter, covering transaction review, approvals, EIP-7702 delegations, address poisoning, 2FA and withdrawal whitelists, plus a 30-minute incident response order.

⚠️ Read this first: a security checklist only helps once you have an account. Use the registration link (for example, "Register now") or enter invite code BINANBT to sign up for Binance and qualify for the new-user rewards (20% fee rebate + up to $19,800 welcome package). Getting the entry point right and keeping assets safe are two separate jobs; do the first one properly before you work on the second.

Key takeaways (TL;DR):

In 2026, the biggest losses often come from a signature you approved yourself, not a stolen seed phrase. ScamSniffer recorded about $6.27 million in signature-phishing losses across 4,741 victims in January 2026. Two victims accounted for roughly 65% of the total, and the largest single loss was $3.02 million — most of these users never lost a seed phrase.

Security needs a cadence, not a one-time setup. Three minutes a day for pre-signing checks, 15 minutes a week for approvals and devices, 60 minutes a month for account and asset structure, and two hours a quarter for recovery drills and address rotation.

Three risk layers, three playbooks. Seed compromise is handled with offline backups and hardware wallets; signature and approval risk is handled by treating every signature like a transfer; platform custody risk is handled by limiting exposure and rehearsing withdrawals.

Two checks are new in 2026. EIP-7702 whole-account delegations and address poisoning are not covered by the old "hide your seed phrase" checklist.

The first 30 minutes after a theft decide how much is left. Move remaining assets first, revoke second, preserve evidence and contact exchanges third, then do the post-mortem.

Match the controls to the balance. A $500 wallet does not need multisig; a $50,000 portfolio sitting in one hot wallet is a bet, not a strategy.

One-line answer: treat every signature like a transfer
Where losses actually happen
Daily, 3 minutes: five checks before you sign
Weekly, 15 minutes: approvals, devices and login history
Monthly, 60 minutes: account and asset structure
Quarterly, 2 hours: recovery drills and address rotation
The full schedule in one table
Three 2026 risks your old checklist misses
First 30 minutes after a theft
How much security you need at each balance level
💰 Binance rebate: invite code BINANBT
FAQ
Further reading

One-line answer: treat every signature like a transfer

Personal Web3 security is not about hiding your seed phrase more cleverly. It is about making every signature pass a simple test: do I know exactly what this transaction will do? A seed phrase leak is rare and one-off; signature phishing is frequent and happens every day. The first is a backup problem, the second is an operating habit.

Start with the numbers. ScamSniffer's January 2026 signature-phishing report recorded about $6.27 million in losses across 4,741 victims. Losses rose 207% month over month while the victim count fell 11%, which means attackers shifted from broad spraying to whale hunting. Two victims accounted for roughly 65% of January losses, and the largest single loss — $3.02 million — came from a malicious permit or increaseAllowance signature¹.

Those users did not necessarily store their seed phrase in a cloud drive. They visited a page that looked normal and clicked confirm. That is why the first rule of this checklist is simple: every signature you approve is potentially a transfer you did not intend to make.

The scale is not limited to one metric. In the US, the FBI's IC3 2025 Internet Crime Report put crypto-related fraud losses at $11.366 billion across 181,565 complaints, more than half of all reported cybercrime losses that year². Signature phishing is one slice of that total, but it is the slice most directly under your control.

Where losses actually happen

Crypto losses fall into six layers, each with a different frequency, loss size and defense. Treating them as one problem leads to the comfortable but wrong conclusion that "if my seed phrase is safe, I am safe."

Risk layer	Typical scenario	Loss size	Frequency	Main defense	Check cadence
Seed / private key leak	Fake wallet app, seed photo in cloud, "wallet recovery" phishing	Entire wallet	Low	Offline backup, hardware wallet, official channels	Quarterly
Signature / approval	Malicious permit, unlimited approve, Permit2, EIP-7702	One chain to the whole account	High	Read before signing, simulation, regular revokes	Daily / weekly
Address poisoning / wrong address	Copying a lookalike address from history	One transfer	Medium	Verify the full address, address book, whitelist	Every transfer
Device / browser	Malicious extension, clipboard malware, fake keyboard	Medium to high	Medium	Clean device, extension audit, OS updates	Weekly
Platform custody	Exchange hack, commingling, freeze, bankruptcy	Entire platform balance	Low but systemic	Diversification, proof of reserves, withdrawal drills	Monthly
Physical coercion	Home invasion, kidnapping, forced transfer ("wrench attack")	Everything	Low	Asset tiers, duress wallet, privacy	Quarterly

Chainalysis's 2026 mid-year report documented 46 physical-coercion incidents against crypto holders in the first half of 2026, with more than $30 million known to have been taken. France alone accounted for 30 cases, and home invasions rose from 14% of incidents in 2025 to 37%³. This layer sits outside traditional "cybersecurity," but for large holders it is as real as a seed phrase leak.

Identify your largest exposure first, then spend your time there. If 90% of your assets sit on an exchange, monthly exchange due diligence matters more than daily approval checks. If you interact on-chain every day, your signing habit is the first priority.

Daily, 3 minutes: five checks before you sign

The daily three minutes are not for auditing your whole portfolio. They are for pausing ten seconds before you press confirm. The first three checks below stop most signature-phishing attempts.

1. Enter through a bookmark, not a link

Phishing pages rarely fail because of a bad logo; they fail because the domain is almost right. Common tricks include swapping l for I, 0 for O, adding a hyphen, or using punycode so the address bar displays something that looks like a familiar brand.

Bookmark every exchange, wallet and DeFi protocol you use, and open them from the bookmark bar. When you receive an "airdrop claim," "account alert" or "wallet upgrade" link, do not click it. Open the official site from your bookmark and check the announcement there. On mobile, tap the address bar to expand the full domain before you connect.

2. Tell "connect," "sign" and "approve" apart

A wallet popup can mean three very different things: connecting only reveals your address, signing can change on-chain state, and approving can let someone spend your tokens. Phishing pages often use "Connect wallet" as a low-risk first step, then serve the malicious signature in step two.

Ask three questions:

Is this Connect, Sign, or Approve / Permit?
If it is only a connection, why does it need a signature?
If I did not intend to do anything on this site, why is there a signature request at all?

Blind signing means the wallet shows only a hex blob and you have no idea what you are approving. Malicious permit, setApprovalForAll and EIP-7702 delegation requests thrive in blind-signing flows.

Most modern wallets offer transaction simulation and will tell you "this signature moves X tokens to Y address." If your wallet does not simulate, or the page pressures you with "sign now or the airdrop expires," treat that as a red flag. Switch wallets or devices rather than signing something you cannot read.

4. Verify the full address, not just the first and last four characters

Address poisoning exploits the habit of checking only the beginning and end. An attacker generates an address with the same first and last characters as one you use, sends you 0 USDT or a tiny token so the fake address appears in your transaction history, and waits for you to copy it next time.

On December 19, 2025, one trader lost 49,999,950 USDT this way. He made a small test transfer first; the attacker spotted it, generated a lookalike address with matching first and last characters, and planted it in his history. Twenty-six minutes later he copied the wrong address⁴. In January 2026, another $12.25 million was lost in a similar case.

Do this instead: never copy an address from transaction history; use your wallet's address book or an exchange withdrawal whitelist; after pasting, check at least the first six, last six and a middle segment; send a minimum-size test transfer for large amounts.

5. Use a test amount and a clean device

For any new address, network or protocol, run the smallest possible transaction first. That is not a waste of time; it is a few dollars spent confirming that the flow works. Keep the wallet that holds serious assets away from random browser extensions, unofficial downloads and public Wi-Fi.

The weekly 15 minutes are for cleaning up permissions you granted and forgot. An approval does not disappear when you close the tab; it stays on-chain until you revoke it.

Check 1: ERC-20 and NFT approvals

Open Revoke.cash, connect your wallet, and go chain by chain:

Is there an unlimited approval to a contract you do not recognize?
Is an app you no longer use still able to spend your tokens?
Did you grant setApprovalForAll for an entire NFT collection to a contract?

Two practical notes. Revoking costs gas, so batch revocations on the same chain. And revoking is not the same as rotating your wallet: if you suspect the private key is compromised, revoking limits the damage but does not restore safety.

Check 2: Permit2's two-layer approvals

Permit2 splits an approval into "token → Permit2 contract" and "Permit2 → specific app." Many users revoke the second layer and never realize the first still exists. Others assume that revoking an app invalidates its Permit2 signature. Worse, SignatureTransfer permits can be signed entirely off-chain, so they never appear on-chain and no revocation tool can see them.

For the mechanics and batch-revocation method, see Permit2 batch revocation guide.

Check 3: EIP-7702 delegations

EIP-7702 lets an ordinary wallet address delegate execution to a contract. That is not "approve one token"; it is "hand over the whole account." Once a malicious delegation is signed, the attacker can sweep assets every time you deposit, including deposits made before you revoke.

How to check:

Open the Delegations tab in Revoke.cash to see active delegations. It is primarily a viewer; revocation usually has to happen inside your wallet.
Look up the address in a block explorer and check for type 0x04 / SetCode transactions.
In your wallet's account details, look for a Smart Wallets / Delegation / Smart Account toggle and turn off anything you do not use.

Revoking an EIP-7702 delegation means sending another 0x04 transaction that points the delegation at the zero address. Button names differ by wallet, so use your wallet's current account page as the source of truth. If you do not understand the toggle, the safest move is to send the assets to a freshly generated wallet and retire the old address.

Check 4: Devices and browser

Are your wallet extension and browser up to date?
Did you install any "airdrop alert," "MEV protection" or "transaction accelerator" extension from an unknown source?
Does the wallet holding serious assets share a browser profile with everyday browsing and downloads?

A malicious extension can read every page you visit, replace clipboard addresses and inject transaction content. The simplest fix is a separate browser profile for the high-value wallet, with nothing installed except the wallet's official site and essential tools.

If you use an exchange, spend two minutes on three things:

Any unknown device or city in the login history?
Do API keys have only the permissions they need, with withdrawals disabled and an IP allowlist?
Are the withdrawal whitelist and anti-phishing code still active?

For the exact settings, see the Binance account security guide.

Monthly, 60 minutes: account and asset structure

The monthly hour is for settings that are configured once and quietly expire. You will not notice them day to day, but they decide how much you can save when something goes wrong.

1. Move 2FA off SMS

SMS 2FA is the second-weakest factor; no 2FA is the weakest. SIM swapping lets an attacker port your number and receive your codes. Prefer a TOTP authenticator (Google Authenticator, Authy, 1Password, etc.) or a passkey/hardware security key.

Change the order carefully: bind the new method on a new device, confirm it works, then remove the old one. Store recovery codes offline, not only on your phone. Turn on the exchange's anti-phishing code as well; official emails should display the phrase you chose, and emails without it are likely phishing.

2. Set a withdrawal whitelist and cooling period

A withdrawal whitelist means that even if an attacker gets into your account, they can only send funds to addresses you pre-approved. Major exchanges support this, and new addresses usually have a 24- to 48-hour cooling period, which gives you time to notice unauthorized changes.

The trade-off is flexibility: adding a new address takes time. Add your cold wallet and fiat off-ramp addresses in advance, not when you urgently need them.

3. Clean up API keys

API keys are the back door many users forget. Check every key's permissions: read-only, spot trading, futures trading, withdrawals. Disable anything you do not need, bind an IP allowlist, and delete unused keys. A key with withdrawal permission and no IP restriction is a copy of your account key sitting on a server.

4. Tier your assets

Do not keep everything in one place, and do not keep everything on an exchange. A workable starting point:

Cold / hardware wallet: long-term holdings, usually 70%–80%.
Hot wallet: daily interactions and small payments, 5%–10%.
Exchange: trading and earn balances, 10%–20%, depending on how often you trade.

The percentages are not dogma. The point is that a loss at any single venue should not be life-changing. If your exchange balance is more than half of your total, move some of it to self-custody.

5. Check that your backup still exists

A seed backup is not finished when you write it down. Paper absorbs moisture, fades, or gets thrown away as scrap; metal plates can be damaged if stored badly. Once a month, confirm the backup is where you left it, the words are legible, and nobody else knows the location.

Do not photograph it, upload it to a cloud drive, or send it to yourself in a chat app "just in case." Those actions copy the seed phrase onto servers you do not control.

Quarterly, 2 hours: recovery drills and address rotation

The quarterly two hours answer one question: if your device disappeared today, could you actually recover? Most people discover a missing word or a broken import process only when it is too late.

Drill 1: Recover a small wallet end to end

Use a spare wallet and your real backup method. Confirm:

the word order is correct and every word is legible;
the recovered address matches the one you recorded;
the balance appears and you can send a small transaction.

Do not experiment on your main wallet. Put a few dollars in the drill wallet, confirm the process, then move the funds back.

Drill 2: Check the hardware wallet and firmware

Was it bought from the official store, and did it arrive with a pre-set seed? (It should not.)
Is the firmware current, and did you update it through the official app?
Is the screen intact and are the buttons working?

A hardware wallet's value is the screen that lets you verify the address and amount on the device. If you habitually tap confirm without looking, that value disappears.

Drill 3: Retire old addresses

The more a hot wallet interacts, the larger its exposure. If a wallet has connected to dozens of apps, signed many approvals and appeared on airdrop sites, consider moving its assets to a new address and retiring the old one. Retiring does not mean deleting it; it means no longer using it for serious balances.

Drill 4: Write down what you would do if you were robbed right now

Put the response order somewhere you can see it:

Move remaining assets to a newly generated wallet (not one that may be compromised).
Revoke still-active approvals and delegations.
Record transaction hashes, the stolen address, timestamps and amounts; take screenshots.
Contact any exchange the funds reach and ask it to freeze the address.
File a police report and keep the receipt.
Watch for "recovery services" that ask for an upfront fee.

These six steps matter more in a real incident than any technical detail.

The full schedule in one table

Cadence	Time budget	What to check	Tools	Pass condition
Daily	3 min	Domain, transaction content, recipient before signing	Wallet simulation, bookmarks	You can explain what the signature does
Weekly	15 min	ERC-20 / NFT approvals, Permit2, EIP-7702 delegations	Revoke.cash, block explorer, wallet settings	No unknown or unlimited approvals
Weekly	5 min	Exchange login history, API key permissions	Exchange security center	No unknown devices; least privilege
Monthly	60 min	2FA, anti-phishing code, withdrawal whitelist, asset tiers, backups	Authenticator, exchange settings	Non-SMS 2FA, active whitelist, legible backup
Quarterly	2 h	Recovery drill, hardware firmware, old-address retirement, inheritance/emergency contact	Spare wallet, official hardware app	You can complete a recovery unaided
Every transfer	30 sec	Full address, network, memo/tag, test amount	Address book, block explorer	Beginning, middle and end all verified

Use this table as the checklist. If you can only do one thing, do the weekly 15-minute approval check. If you can do two, add the monthly 2FA upgrade.

Three 2026 risks your old checklist misses

Traditional checklists stop at "do not screenshot your seed phrase" and "do not click strange links." In 2026, more losses come from the signature layer. Three risks deserve their own entry.

Risk 1: EIP-7702 whole-account delegation

EIP-7702 went live with the Pectra upgrade in 2025. It lets an ordinary address delegate code execution to a contract. The mechanism is neutral; the problem is that phishing pages dress it up as a "wallet upgrade," "enable smart account," or "authorize before claiming an airdrop." Once signed, the attacker gets execution rights over the whole account, not a token allowance.

Red flags: the popup mentions delegate, authorization, set code or upgrade; the transaction type is 0x04; the counterparty is a contract, not a token; the page creates urgency.

What to do: do not sign. If you already did, disable the delegation inside your wallet, or move the assets to a new wallet and retire the old address.

Risk 2: Address poisoning

Address poisoning does not attack a contract or a private key. It attacks the habit of copying an address from transaction history. The attacker generates an address with matching first and last characters, sends you a zero-value or tiny transaction so the fake address enters your history, and waits.

Red flags: a zero-value transfer you do not remember; a recipient whose first and last characters match your usual address but whose middle differs; someone urging you to "send to the same address as last time."

What to do: do not copy from history; use an address book or whitelist; verify the full address; test with a small amount.

Risk 3: Permit2 sub-approvals

Permit2 splits an approval into two layers, which makes "I revoked the app, but the master approval is still live" a common failure. The more hidden case is SignatureTransfer: the permit can be signed entirely off-chain, so it never appears on-chain and no revocation tool can see it.

What to do: include the Permit2 master approval in your weekly check; do not sign unlimited, long-lived permits for apps you do not know; see the Permit2 batch revocation guide.

First 30 minutes after a theft

The goal of the first 30 minutes is not recovery. It is stopping the loss from growing. A wrong order can cost you assets that were still salvageable.

0–5 minutes: move what is left

Do not keep operating in the compromised wallet. Generate a new wallet (ideally on a clean device) and move any remaining assets. If the private key or delegation is compromised, every minute you leave assets there is a risk.

If the attacker has set up an automatic sweeper, deposits into the old wallet may be swept immediately. In that case, prioritize high-value, fast-moving assets and contact exchanges to freeze the destination addresses.

5–15 minutes: revoke approvals and delegations

While you can still operate, revoke:

all ERC-20 and NFT approvals;
Permit2 master and sub-approvals;
EIP-7702 delegations (disable in the wallet, or move assets and retire the address).

Revocation costs gas. If the old wallet has no gas, send a small amount in, revoke, or abandon the address.

15–30 minutes: preserve evidence, contact, report

Screenshot balances, transaction history and the theft transaction hash.
Record the stolen address, amount, timestamp and token types.
Contact any exchange the funds reach, provide the hash and request a freeze.
File a police report and keep the receipt.
Submit the information to on-chain security communities such as SlowMist or ScamSniffer to increase the chance the address gets flagged.

Do not trust anyone who contacts you offering recovery. A legitimate recovery process will not ask for a deposit, a transfer, or your seed phrase/private key. Second scams target recent victims specifically.

How much security you need at each balance level

Security spending should match the balance. A full multisig setup for $500 is poor value; a $50,000 portfolio in one hot wallet is gambling.

Balance	Minimum setup	Add next	Not necessary
Under $1,000	Hot wallet + 2FA + weekly approval check	Hardware wallet if holding long term	Multisig, complex inheritance planning
$1,000–$50,000	Hardware wallet + cold/hot separation + monthly checks	Withdrawal whitelist, separate browser profile, quarterly recovery drill	Multisig unless shared custody
Over $50,000	Hardware wallet + multisig/MPC + geographically split backups	Inheritance plan, duress wallet, professional security audit, quarterly tabletop drill	Keeping everything on one exchange

A simple test: if you lost your phone today, your computer were infected, and your exchange paused withdrawals, would your life be affected? If yes, move up one tier.

💰 Binance rebate: invite code BINANBT

New users who enter invite code BINANBT at registration get a 20% trading-fee rebate — worth having if you trade regularly. This article contains a referral link; we may earn a reward if you register through it, at no extra cost to you.

Rebate: 20% of trading fees, ongoing; the more you trade, the more you save.
Welcome package: up to $19,800, unlocked through tasks, not paid as cash on signup.
How to claim: enter BINANBT in the invite-code field at registration; that is the most reliable way.
Important: registering directly in the app gives you none of the new-user rewards. An in-app signup is not linked to any invitation, so the $19,800 package and the 20% fee rebate will not apply. Use the registration link or enter invite code BINANBT.

👉 Register on Binance and claim the 20% fee rebate

FAQ

Can I store my seed phrase in a password manager or cloud drive?

It is not recommended. Cloud drives, photo galleries, chat history, email drafts and password managers are all online storage. If the account is credential-stuffed, the device is infected or the provider is breached, the seed phrase is effectively public. A safer approach is to write it on paper or stamp it into a metal plate, make two copies, store them in two physical locations, and check periodically that the words are still legible. A password manager is fine for exchange passwords, not for the seed phrase itself.

Does a hardware wallet guarantee safety?

No. A hardware wallet keeps the private key offline, but it cannot stop you from signing a malicious transaction, copying a poisoned address, installing fake firmware or buying a tampered device. Its real value is the screen that lets you verify the recipient and amount on the device itself. If you tap confirm without reading, it is no safer than a hot wallet. Buy from the official store, inspect the packaging, and initialize the device yourself; never use a device that arrives with a pre-set seed phrase.

How often should I revoke token approvals?

Check weekly and do a full revoke at least monthly. The goal is not to remove every approval, but to remove three categories: unlimited approvals, approvals to apps you no longer use, and approvals to spenders you cannot name. Keep limited approvals for protocols you use often; for a wallet you rarely touch, fewer approvals is better. Revoking costs gas, so batching several revocations into one transaction is usually cheaper.

What is EIP-7702, and do regular users need to care?

EIP-7702 arrived with the Pectra upgrade in 2025. It lets an ordinary wallet address delegate code execution to a smart contract. The intent is to enable batched transactions and gas sponsorship, but a malicious delegation hands over the entire account, including future deposits, which can be swept automatically. You do not need the technical details. Remember one rule: if a site or DM asks you to sign a wallet upgrade, delegation or set-code request, decline first and verify afterwards.

Which is safer: an exchange or a self-custody wallet?

Neither is universally safer; they allocate risk differently. An exchange carries platform hacks, commingling, freezes and bankruptcy risk, but it is easy to use. Self-custody carries seed loss, signature phishing, wrong-address transfers and physical coercion risk, but nobody can freeze your assets. In practice, split by purpose: long-term holdings in a cold wallet, small balances in a hot wallet for daily use, and only trading capital on an exchange. For the exchange side, see Is it safe to keep crypto on an exchange?.

Can stolen crypto actually be recovered?

Sometimes, but the odds are low and depend on where the funds go. If the assets are still on-chain, blockchain analysts and law enforcement may be able to freeze them. If they have passed through mixers or been bridged and split, recovery becomes much harder. Victims should move remaining assets, revoke approvals, preserve transaction hashes and screenshots, contact any exchange the funds reach, and file a police report. Any recovery service that asks for an upfront fee should be treated as a second scam.

Contents