These days, there's been more arguing in the group about whether privacy coins and mixing coins count as "original sins" or not. Honestly, what I fear more are the most basic pitfalls: seed phrases and signatures. Don't screenshot your seed phrase, don't store it on the cloud, and don't type it out on any "customer service" pages. If you really need to memorize it, write two copies offline and keep them in two different places—just don't let it touch any connected device.

Also, don't treat signature authorization as just a simple confirmation. Some phishing sites use "check balance / claim airdrops" to get you to authorize unlimited access, and you might think you're just logging in. My bottom line is: if you don't understand what you're signing, don't sign it. Use a secondary wallet instead of your main wallet if possible, and after authorization, revoke the permissions. No matter how much people argue about compliance boundaries, losing your wallet is truly unarguable... Let's talk about this again next time.