Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.
We cover crypto-security incidents every week, and after enough post-mortems a pattern emerges: the losses are rarely exotic. The same handful of mistakes show up again and again. Here is a practical defense checklist drawn straight from the cases we've reported — no hype, just what actually moves the needle.
1. Treat your seed phrase as the whole game
A hardware wallet never asks for your seed phrase on a website. The biggest retail losses start with a phished seed or a fake "wallet validation" page. If anything — an app, a support agent, a pop-up — asks you to type your 12/24 words, it is a scam. Store the phrase offline, never as a photo or cloud note.
2. Audit your token approvals
Many drains don't steal your keys — they abuse an approval (allowance) you granted a contract long ago. A buggy or abandoned contract you once approved is a standing door into your wallet. Periodically review and revoke allowances (tools like revoke.cash make this easy), especially for routers and bridges you no longer use.
3. "Deprecated" is not "safe" — withdraw from dead protocols
The Aztec Connect drain of ~$2.19M happened three years after the product shut down, because the immutable contract still held residual funds with no team to pause it. Treat any shutdown announcement as a deadline: withdraw your balance and revoke approvals before you forget.
4. Be paranoid around security disclosures and "urgent updates"
Scammers ride the news cycle. After any legitimate disclosure, expect fake "firmware update" or "migrate your funds now" messages. Update wallet firmware only inside the official app, bookmark official sites, and distrust urgency.
5. Avoid thin-liquidity tokens
Most retail blow-ups happen in low-liquidity altcoins and freshly minted "mining" tokens that are trivial to manipulate. There's a reason Russia's regulator restricted retail investors to just BTC, ETH and USDT — depth is protection. The deeper and more boring the market, the harder you are to rug.
6. Assume romance/investment "opportunities" are scams
The industrial "pig-butchering" networks behind the largest-ever $15B bitcoin seizure and the Disruption Week takedown all run the same playbook: a friendly stranger, a slow build, a fake platform showing fake gains. If someone you met online is guiding your crypto investing, you are the target.
7. Lock down your accounts AND your registrar
Account security isn't just 2FA. The GoDaddy case showed a domain moving despite 2FA and a transfer lock — because the registrar's support desk operated above the customer's settings. For anything critical (exchange logins, your domain, email), use phishing-resistant 2FA (a passkey or hardware key, not SMS) and a registry-level lock on key domains.
8. The money rarely comes back — prevention is the whole strategy
Across enforcement actions, recovered funds are a tiny fraction of what's stolen; mixers and cross-chain bridges move proceeds faster than freezes land. Don't rely on getting hacked funds back. The defense is not falling for it in the first place.
9. Verify before you trust a "no admin keys" claim
"Fully decentralized, no admin keys" is marketed as safety, but it can also mean no one can stop an exploit either. Immutability cuts both ways. For any protocol holding your funds, look for real audits, a live bug bounty, and a track record — not just a slogan.
None of this is complicated, and that's the point. The exotic-sounding hacks we write up almost always reduce to one of these nine failures. Get them right and you've eliminated the vast majority of how people actually lose crypto.
We turn every incident into lessons like these. Follow @mrtdnet on Telegram for the next one.
