Recently, hardware wallets are out of stock again, and a bunch of people in the group are rushing to place orders. I instead think: first, improve the cheapest security habits. Don’t take photos of your seed phrase or upload it to cloud storage, don’t be overconfident that “my phone is clean,” the market never rewards confidence.

When it comes to signing/authorization, it’s even more critical. Basically, it’s “what you’re clicking isn’t confirm, but opening the door for others.” Some phishing sites look exactly like legitimate ones; just changing the link can ruin everything. To make an analogy: it’s like a delivery person asking you to sign on a blank sheet of paper, and later they fill in whatever they want—you just accept it… When I see unfamiliar domain names or pop-ups urging you to “claim/verify immediately,” I just close them. Better to miss out than to treat them as lessons.