Community lessons for wallets and work
Keep community leads separate from conclusions. These threads help identify questions. Technical conclusions require product specific documentation, official warnings and forensic evidence where needed.
Paid work can be a pretext for malicious software
A V2EX author says they accepted a paid audit invitation, ran the supplied project and then lost hot wallet assets. Replies analyse code, but this edition did not run samples or independently establish the complete attribution. [S62]
Rule to use: investment demos, recruitment tests and meeting repairs do not justify running unfamiliar files on devices used for assets. The FBI has documented similar approaches. If technical testing is necessary, let the technical team use a dedicated environment isolated from real accounts. An incognito window or second browser profile is insufficient. [S57]
A search result may only look familiar
Another V2EX author describes reaching a lookalike domain through search, approving a supposed verification transaction and then discovering outgoing assets. This is the author's account; independent forensic verification has not been completed. [S63]
Rule to use: enter through a separately verified and saved route. Understand the authority requested. Words such as “verification,” “zero value” or “signature only” do not guarantee safety. Stop if you cannot understand the action; do not revisit a suspicious page simply to investigate. See chapter 7. [S16]
Do not guess which app leaked a secret
A V2EX account involves both cloud notes holding recovery words and later transmission through chat, followed by wallet loss. Comments offer different explanations. The sequence alone cannot establish the leak point. [S64]
Rule to use: protect recovery material using the wallet's official process. Keep offline secrets out of cloud notes, chat and AI tools. Deleting a chat or changing an app password does not make exposed material safe again. Have a trusted team assess the affected accounts. See chapters 8 and 41. [S13] [S17]
Complex custody still needs a human safety plan
Bitcointalk discusses hardware wallet attack surfaces; Reddit discusses remote authority, delays and decoy wallets. These are opinions and design proposals, not tested protection results. [S60] [S61]
Rule to use: assess asset permissions, lawful recovery and human crisis response separately. Multisignature, hidden wallets and delays cannot promise protection from violence. Complexity is not proof of safety. Use drills without real assets to examine shared failures, owner incapacity and threats to other signers. See chapters 6 and 47.