Dust tokens that lure you to a fake site to 'claim' or 'revoke'. Do not interact.

A multisig that can pause or upgrade an L2 in emergencies. A trust assumption to understand.

Any screenshot, cloud backup, or support scam that exposes the mnemonic. Funds are gone once it is used.

An NFT (and sometimes ERC-20) permission that lets an operator move every token you own in that contract.

Asking you to sign a typed-data message that grants operatorship or transfers assets.

Attackers port your phone number to intercept SMS 2FA. Use app or hardware 2FA for exchanges.

Guardians who can help rotate a smart-wallet key if you lose the primary device.