Custody: who holds your money?
This is the most important security concept in crypto. There are two models:
Custodial (someone else holds it)
When you keep crypto on an exchange like Coinbase or Binance, they hold your keys. It's like a bank — convenient, but if the company is hacked, goes bankrupt, or freezes your account, you may lose access.
Self-custody (you hold it)
When you use a wallet like MetaMask, Phantom, or a hardware wallet, you hold your own keys. No one can freeze your funds, but if you lose your keys, no one can recover them either.
Most DeFi activity happens with self-custody wallets. This gives you full control — and full responsibility.
Your seed phrase is everything
When you create a self-custody wallet, you receive a seed phrase (also called recovery phrase) — usually 12 or 24 words. This phrase is the master key to your wallet. Anyone who has it controls your funds.
Rules for your seed phrase:
- Write it down on paper. Never store it digitally (no screenshots, no cloud notes, no email).
- Store it in a safe, secure location — ideally two separate physical locations.
- Never share it with anyone. No legitimate service will ever ask for it.
- If someone asks for your seed phrase, it is a scam. Always. No exceptions.
Hardware wallets
A hardware wallet (like Ledger or Trezor) is a physical device that stores your private keys offline. Even if your computer is compromised, your keys remain safe on the device. To sign any transaction, you must physically confirm it on the device.
For any significant amount of crypto, a hardware wallet is strongly recommended. Think of it like a safe for your most important documents — less convenient than leaving them on your desk, but much more secure.
Common scams and how to recognize them
Crypto scams follow predictable patterns. Knowing them is your best defense:
Phishing
Fake websites that look identical to real services (like a fake Uniswap or MetaMask). They ask you to connect your wallet and approve a transaction that drains your funds. Always verify the URL before connecting your wallet. Bookmark the real sites you use.
Fake customer support
Scammers impersonate support agents on Discord, Telegram, or Twitter. They offer to "help" with a problem and ask you to share your screen, enter your seed phrase, or visit a link. No legitimate project will ever DM you first offering help.
Too-good-to-be-true yields
A new token offering 1,000% APY, a mysterious airdrop worth thousands, a guaranteed return on investment. If it sounds too good to be true, it is. Sustainable yields in DeFi are typically 2%–8%. Anything dramatically higher carries extreme risk or is an outright scam.
Malicious tokens and airdrops
Scammers send random tokens to your wallet that appear to be worth money. When you try to sell or interact with them, you approve a transaction that drains your real tokens. Ignore tokens you don't recognize. Don't interact with them.
Impersonation
Fake social media accounts posing as project founders, influencers, or companies. They promote scam links, fake giveaways, or malicious contracts. Always verify accounts through official channels.
Rug pulls y estafas de salida
Un rug pull ocurre cuando los desarrolladores de un proyecto crypto lo abandonan repentinamente y desaparecen con los fondos de los inversores. Esto sucede con frecuencia en nuevos protocolos DeFi o lanzamientos de tokens: el equipo recauda dinero a través de ventas de tokens o pools de liquidez, luego vacía los contratos inteligentes y desaparece. Las señales de alerta incluyen equipos anónimos sin historial verificable, liquidez que no está bloqueada o con períodos de bloqueo muy cortos, ausencia de auditorías de seguridad independientes y un TVL (valor total bloqueado) inflado artificialmente para crear una falsa sensación de confianza. Los proyectos que promueven agresivamente rendimientos irreales mientras desalientan la investigación son particularmente sospechosos. Investiga siempre el equipo, el historial de auditorías y el estado del bloqueo de liquidez antes de depositar fondos.
Token permissions and approvals
Every time you use a DeFi service, you typically grant it permission to move a specific token on your behalf. These approvals persist indefinitely — even after you've stopped using the service.
If a service you approved is later hacked, attackers can use that approval to move your tokens. This is why periodically reviewing and revoking old approvals is good security practice.
CleanSky's Security tab shows all active permissions on your wallets — which services have access to which tokens, and whether any of them look risky. This is one of the most important security checks you can do.
Smart contract risk
When you deposit crypto into a DeFi service, your tokens are held by a smart contract — a program running on the blockchain. If that program has a bug or vulnerability, your funds could be at risk.
Things that reduce (but don't eliminate) smart contract risk:
- Audits — Reputable services have their code reviewed by independent security firms. Look for audit reports on the protocol's website.
- Track record — Services that have been running for years with significant value locked have been battle-tested.
- Open source code — When the code is public, more eyes can find potential issues.
- Insurance — Some DeFi insurance services (like Nexus Mutual) offer coverage against smart contract failures, though coverage is limited and not automatic.
Los contratos no auditados son un ingrediente común en los rug pulls. Si un proyecto no tiene una auditoría públicamente disponible de una firma reconocida, considéralo una señal de alerta significativa antes de comprometer fondos.
Aprende cómo protegerte: Cómo verificar contratos inteligentes.
Network and bridge risks
Moving tokens between different blockchain networks requires bridges — services that lock your tokens on one network and release equivalent tokens on another. Bridges are historically one of the highest-risk components in crypto, having suffered some of the largest hacks in DeFi history.
If you bridge tokens, understand that you're adding a layer of risk on top of whatever you do with those tokens afterward. CleanSky's risk analysis accounts for bridge exposure as a separate risk factor.
Practical security habits
The most effective security comes from consistent habits:
- Use a dedicated browser profile for crypto. Don't install unnecessary extensions.
- Bookmark the services you use and always navigate from bookmarks, never from search results or links in messages.
- Verify before you sign. Read what a transaction is doing before you approve it in your wallet.
- Start small. When using a new service for the first time, try it with a small amount before committing more.
- Revoke old approvals. Periodically review which services have permission to move your tokens.
- Keep software updated. Your wallet app, browser, and operating system should always be current.
- Don't share your setup. Avoid publicly discussing which services you use, how much you hold, or which wallets are yours.
Remember: In crypto, there are no refunds, no chargebacks, and no fraud departments. Every transaction is final. The time you spend on security is always worth it.
Scan your wallet for risky token approvals and suspicious permissions — no signup required.