Recently, I saw someone get their wallet taken by a phishing site’s “airdrop claim,” which isn’t due to lack of technical skill but because the red line wasn’t guarded. Mnemonic phrases, to put it simply, are the actual keys; any page that prompts you to “input/import” should be assumed to be a scammer. Don’t rush to sign authorizations, especially those you don’t understand what you’re authorizing—better to just turn it off and pretend you didn’t see it. If you can use a secondary wallet, don’t use your main wallet; the main wallet only receives and doesn’t move funds. Do all daily interactions with a hot wallet, even if it’s more trouble, so you can sleep peacefully.

By the way, regarding the NFT royalty waterfight, everyone’s arguing about creator income and secondary liquidity. I’m actually more worried that platforms will make authorization more and more one-click to make things smoother, causing users to sign without understanding. My habit is: first check the domain name, then check permissions, and finally click confirm.

I regret not the outcome, but the feeling at the time that “just clicking once probably won’t hurt.” That’s all for now.