Name the common mistakes people make holding their own crypto and the habits that prevent them.
Moving crypto off an exchange and into a wallet you hold yourself puts every step of the transfer in your hands. Lesson 1.1, "Bitcoin is a shared ledger that nobody runs", showed that a confirmed transaction cannot be reversed, and in self-custody that falls on you personally. There is no bank to call if a crypto transfer goes wrong. If coins go to an address nobody controls, or to a stranger's address, they are gone. The protection is a short routine you follow in the same order every time, plus a habit of reading anything an application asks you to sign.
Darren holds bitcoin on an exchange and decides to move part of it to a hardware wallet. He copies the receiving address from the hardware wallet's app, pastes it into the exchange's withdrawal page and types in the amount. With his finger over the send button, he stops. A wrong character in the address, or the wrong option picked on the page, cannot be undone once the transaction confirms. Each check below deals with one way his transfer could fail.
Typing the wrong address is the mistake most people expect. Choosing the wrong network is the one that catches experienced people: sending a token on one blockchain to a wallet or exchange that only watches another blockchain. Many tokens exist on more than one blockchain. A dollar stablecoin may be offered on Ethereum and on several other networks, and exchange withdrawal pages ask which network to use, often listing address formats that look alike. If you withdraw on one network to a receiver that only watches another, the coins may sit where the receiver cannot see or reach them. Sometimes they can be recovered, with a lot of effort and the receiving firm's cooperation, but often they cannot.
Before sending, confirm that the receiving wallet or exchange supports that exact token on that exact network. The deposit page or wallet app usually lists the supported tokens and networks. If it does not, find out before you send anything.
The first time you move a meaningful sum to an address, start with a test transfer: send a small amount, wait until it arrives and shows in the receiving wallet with the confirmations the receiver needs, and then send the rest. You will pay the network fee twice, the fee you learned to work out in lesson 1.4, "Follow one transaction from wallet to block". That second fee buys a cheap check that the address, the network and the receiving setup all work.
Darren is moving S$1,500 of bitcoin, an example figure. An extra fee of a few dollars, also an approximate example, is worth it to him to know the rest will land. The test only helps if it goes before the large send. A small amount sent after the full amount has checked nothing and cost you a second fee.
Some malware watches your clipboard. When you copy something that looks like a crypto address, it swaps in an attacker's address, and what you paste looks like a similar jumble of characters, so the change is easy to miss.
Address poisoning works through your transaction history. An attacker sends a tiny transaction to your wallet from an address built to look like one you use often, with the same first and last few characters. Later you copy the lookalike from your history by mistake and send your coins to the attacker.
One check covers both attacks. Compare the pasted address with the source, character by character at the start and the end, plus a few characters in the middle. Do this on the device that will sign the transaction. A hardware wallet shows the address on its own screen, which malware on your computer cannot alter. Never copy a destination address from transaction history.
Having worked through these risks, Darren writes down the routine he will use for every transfer out of the exchange, in this order:
Confirm the receiving wallet supports this token on this network. Copy the address from the receiving wallet itself, never from history or a message. Check the first and last characters on the signing device's screen. Send a small test amount and wait until it arrives. Send the rest, then check the balance has landed.
The routine adds a few minutes to each transfer.
Applications bring a second risk. You met smart contracts, programs that run on a blockchain, in lesson 2.1, "Ethereum runs programs, and ether pays for them". Many applications ask you to sign an approval, a permission letting their smart contract spend a particular token from your wallet. Token swaps and lending deposits work this way. An approval can be unlimited in amount and stays in place until you cancel it. If you sign one for a malicious contract, it can drain that token from your wallet whenever it likes, without asking again. The request may come from a fake version of a real site, or from a site promoted through a link in a chat group. People have lost their whole wallet balance this way while believing they were claiming a free token or connecting to a game.
Treat approvals as a practice separate from your transfer routine. Read what the wallet asks you to sign, and if it says the site may spend your tokens when you did not expect that, reject it. Keep the wallet you use with unfamiliar applications separate from the wallet holding most of your coins. Block explorers and some wallets let you see and cancel old approvals, so review yours now and then and cancel any you no longer need.
Your own routine may differ from Darren's depending on what you hold and how you hold it. Draft the steps you will follow, in the order you will follow them.
Write the five steps you will follow before sending any crypto. One of them must be a test transfer before the full amount.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).