CRYPTO-SECURITY · EN · FREE
5. Incident plan and final check
Identify what may have been exposed
If suspicious, stop interacting with the questionable site and do not respond to unsolicited “rescuers”. In a separate note, record the time, domain, request type and public transaction hash if available. Remove secrets and personal details from material shared for assistance. Recovery is not guaranteed; an advance fee for “guaranteed recovery” is a reason to stop.
If an account password was exposed, use a trusted device to open the official service, change the password, end unfamiliar sessions and review recovery methods and MFA. Include email if affected. If a suspicious permission was granted, use the network’s official instructions to inspect and revoke it. These measures address different problems.
If a recovery phrase or private key was exposed, the old access model cannot be considered safe after merely changing a password or revoking one approval. The plan usually requires a new, independently created wallet with fresh keys and protection of remaining assets. Do not enter the old phrase into a rescuer’s “new” form. If there are signs of automated draining, do not blindly fund the compromised address for gas: those funds may also be taken. A real incident needs verified help tailored to the situation.
Final exercise
Write three separate rows: password leaked / suspicious permission / key exposed. Beside each, write the corresponding check from this lesson. Add a personal stop rule: “If I do not understand a request, I do not confirm; urgency does not replace checking.” This is a planning exercise, not an instruction to perform real operations.
Before the exam
Explain address versus secret, password versus recovery, and connection versus approval. Revisit scenarios A and B. The exam assesses decisions under the stated conditions; it does not audit your devices or certify a real wallet as secure.
Sources and scope
Original LOGRI educational text; sources checked on 31 October 2026. Interfaces, recovery methods, permissions and network conditions change: consult current official instructions. EVM mechanisms cannot automatically be applied to Solana, TON or other networks. Neither a wallet nor an exam eliminates every risk. The primary sources below are mostly in English; reading them neither replaces nor blocks the complete course in your chosen language.
Primary sources
Ethereum: wallet safety: https://ethereum.org/security/
MetaMask: recovery phrase and password: https://support.metamask.io/start/user-guide-secret-recovery-phrase-password-and-private-keys
MetaMask: token approvals: https://support.metamask.io/transactions-and-gas/transactions/what-is-a-token-approval/
MetaMask: disconnecting versus revoking: https://support.metamask.io/more-web3/dapps/disconnect-wallet-from-a-dapp/
Uniswap Labs: signature scams: https://support.uniswap.org/hc/en-us/articles/40050562560781-Crypto-Wallet-Signature-Scams
Solana: security guide: https://solana.com/learn/staying-safe-on-solana
Coinbase: destination tags and memos: https://help.coinbase.com/en/coinbase/trading-and-funding/sending-or-receiving-cryptocurrency/destination-tag-memo-faq
CISA: four basic online safety habits: https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-4-Easy-Ways-Stay-Safe-Online-Tip-Sheet.pdf