The habits that actually protect you
You will recognise the ways people really lose funds — approvals, look-alike sites, pressure — and the wallet features that exist to stop each one.
Blind signing
Never approve what you cannot read.
Most losses are not broken cryptography; they are a signature given to something the signer never understood. The wallet decodes what it can and shows the decoded action before confirming, and it never auto-approves anything for a website. If a screen cannot tell you what you are agreeing to, that is the answer: do not agree to it.
Illustration to come
Real screen capture of a decoded approval in VigiWallet, ideally one carrying a risk flag. Real interface, no invented warning text.
Look-alike sites
The domain is the check, not the design.
A convincing copy of a wallet page costs an afternoon; a convincing copy of a domain does not exist. Type the address yourself, bookmark it, and treat any link that arrives by message as a link to somewhere else. The wallet screens known-bad and typosquatted domains, and that screening is a second line, not the first.
Illustration to come
Real photograph or clean typographic print of two domains differing by one character, side by side. The near-identity has to be visible at a glance.
Pressure
Urgency is a technique, not a circumstance.
Almost every social attack needs you to act before you think: a closing window, a support agent, a friend in trouble, a deadline. Nothing legitimate about this network ever requires haste — blocks arrive every thirty seconds, and they will keep arriving tomorrow. A message that cannot survive you stopping to check it is a message that was not going to survive checking.
Illustration to come
Real photograph of a phone showing a generic urgent message, held slightly away as if being considered. Invented content only; no real brand or person.
Extra locks
A passkey, a duress password, and a wipe.
The wallet can require a device passkey alongside the password, so a stolen vault and a cracked password are still not enough. It can hold a duress password that opens a decoy, and a panic wipe that clears the device. None of these replace the phrase on paper — they protect the device, and the phrase protects you from losing the device.
Illustration to come
Real photograph of a physical security key or a phone showing a biometric prompt. Everyday objects, no glowing screens.
In short
- Read every approval; the wallet decodes it so that you can.
- Verify domains by typing or bookmarking, never by following a message.
- Urgency is the attack; nothing here needs to be done in the next minute.
- Passkey, duress password and panic wipe protect the device — the paper phrase protects you.