Crypto Golden Rules and the CSF Security Rules
Rules v2 · 32 rules in four families · last reviewed October 2026
The CSF rules are 32 single-sentence security rules. Each one is built to stop a specific way people lose crypto: a scam, a hack or a costly mistake. The 8 Golden Rules sit at the core; the Operational, Scam Defense and Technical Security Rules cover the rest.
These rules are used across the CryptoSafetyFirst guides, including The Crypto and Web3 Scams Prevention Guidebook and The Three-Wallet Model (both 2026 Edition, Rules v2).
What the CSF rules are
Each rule answers one question: what single behavior would have prevented this loss? The rules are not tips and not explanations. Each one is:
Derived from loss patterns that recur in real crypto and Web3 incidents
Specific to one way of failing, so it is clear when it applies
Short enough to remember and act on in the moment
Versioned: a rule changes only through a new rules version, never silently
Advisory: it lowers the risk of loss, it does not guarantee safety
If you only remember three rules
Never share your seed phrase (GR-001).
Verify the full URL before connecting your wallet (GR-002).
Never approve a transaction you do not understand.
Most losses happen when one of these three is broken.
The CSF security model
The Three-Wallet Model is the custody core: it limits the damage when anything goes wrong. Around it sit three areas, each with its own rule family. The 8 Golden Rules are the must-know rules, drawn from every area and the core. And when something has already happened, the guides show what to do first.
The four rule families
| Area | Family | Rules | What it protects against | Covered in depth in |
|---|---|---|---|---|
| Core and all areas | Golden Rules (GR) | 8 | The losses that are most often total and irreversible | All CSF guides |
| Avoid deception | Scam Defense Rules (SDR) | 10 | Social engineering and fraud | Scams Prevention Guidebook |
| Prevent mistakes | Operational Rules (OR) | 7 | Costly mistakes in managing your own wallets and backups | User Mistakes Prevention Guidebook |
| Protect devices and accounts | Technical Security Rules (TSR) | 7 | Hacks of devices, accounts and infrastructure | Hackers guide |
Golden Rules (8)
The must-know rules, drawn from every area and the core. Breaking one of these is behind most of the largest and least recoverable losses.
GR-001 · Never Share Your Seed Phrase
What it prevents: Prevents total, instant loss: anyone who has your seed phrase controls your wallet, and no real support team, exchange or project will ever ask for it.
Failure pattern observed: Recurring across crypto phishing attacks, fake wallet recovery portals, impersonated support scams, and social engineering fraud. Loss occurs when users voluntarily disclose seed phrases inside malicious Web3 interfaces or scam verification flows.
Read more: Impersonation Scams · Phishing Scams · Fake Apps and Wallets · Recovery Scams
GR-002 · Always Verify the Full URL and Domain Before Connecting Your Wallet to Any Website
What it prevents: Prevents connecting to a look-alike site that copies a real one letter for letter and then asks you to sign something that drains your wallet.
Failure pattern observed: Observed in crypto phishing websites, fake airdrop pages, cloned exchange login portals, and malicious dApp frontends. Trust granted to attacker-controlled domains leads to wallet drainers, credential theft, and unauthorized smart contract approvals.
Read more: Phishing Scams · Malicious Contracts
GR-003 · Always Use a Hardware Wallet for Long-Term or High-Value Crypto Storage
What it prevents: Prevents losing savings to malware or a hacked phone or computer, because the keys of a hardware wallet never leave the device.
Failure pattern observed: Recurring in malware infections, compromised browser extensions, clipboard hijacking, and endpoint-level wallet exploits. Hot wallets exposed to internet-connected environments increase risk of irreversible crypto theft.
Read more: Fake Apps and Wallets
GR-004 · Always Revoke Unused Token Approvals After Interacting with New Smart Contracts
What it prevents: Prevents an old or malicious contract from taking tokens months later through a permission you forgot you gave, on any wallet that still holds funds.
Failure pattern observed: Observed in wallet drainer attacks and malicious smart contract interactions where unlimited token approvals persist beyond initial use. Loss occurs when attackers later exploit standing permissions without additional user interaction.
Read more: Malicious Contracts · Giveaway and Airdrop Scams
GR-005 · Never Follow Urgent Support or Security Instructions. Exit the Channel and Re-Enter Through the Official App or URL
What it prevents: Prevents fake support and fake security alerts from steering you, because you only act after reaching the company through its official app or website.
Failure pattern observed: Recurring in crypto impersonation scams, fake exchange support calls, and account takeover attempts. Victims remain inside attacker-controlled communication channels long enough to override security warnings or disclose authentication codes.
Read more: Impersonation Scams · Blackmail and Extortion
GR-006 · Always Send a Small Test Transaction Before Transferring Large Amounts of Crypto
What it prevents: Prevents a large transfer going to a wrong, swapped or unsupported address, by confirming a small amount arrives first.
Failure pattern observed: Observed in wrong-network transfers, address poisoning attacks, clipboard manipulation, and smart contract interaction errors. Large irreversible losses occur when users skip verification steps before high-value transfers.
Read more: Address Poisoning
GR-007 · Never Store Your Seed Phrase in Cloud Storage, Email, or Screenshots
What it prevents: Prevents a hacked email, cloud account or photo backup from exposing your seed phrase to someone you will never see.
Failure pattern observed: Observed in cloud account breaches, SIM swap attacks, email compromise, and device malware infections. Digital seed phrase storage converts account compromise into full crypto custody loss.
Read more: Wallet Backup Missteps (Mistake #4)
GR-008 · Keep Long-Term Holdings in a Vault Wallet. Use a Separate Wallet for DApps, Trading, and Web3
What it prevents: Prevents one bad signature or malicious site from reaching your long-term savings, because those sit in a wallet that never connects to dApps.
Failure pattern observed: Observed in malicious dApp interactions, fake mint sites, token approval abuse, and smart contract exploit exposure. Loss severity increases when high-value storage wallets are used for routine Web3 interaction.
Read more: Malicious Contracts · Giveaway and Airdrop Scams · The Three-Wallet Model
Operational Rules: Prevent Mistakes (7)
How to manage wallets, backups and access so that a lost device, a mistake or an emergency does not cost you your crypto.
OR-001 · Test Your Wallet Recovery Before Trusting It
What it prevents: Prevents discovering only in an emergency that your backup is wrong, incomplete or for a different wallet.
Read more: Wallet Backup Missteps (Mistake #4)
OR-002 · Never Rely on a Single Seed Phrase Backup
What it prevents: Prevents losing everything to a single fire, flood, move or misplaced sheet of paper.
Read more: Wallet Backup Missteps (Mistake #4)
OR-003 · Document How Your Wallet Was Created
What it prevents: Prevents being unable to restore a wallet because you no longer know its type, passphrase, derivation path or network.
Read more: Unsafe Crypto Wallet Setup (Mistake #1)
OR-004 · Never Store Seed Phrases Only in Digital Form
What it prevents: Prevents a device failure, deleted file or expired account from wiping out your only copy of the seed phrase.
Read more: Lost Seed Phrase (Mistake #3)
OR-005 · Always Verify the Destination Before Sending Crypto
What it prevents: Prevents sending funds to a poisoned, mistyped or wrong-network address, where the transfer cannot be reversed.
Read more: Address Poisoning · Wrong Wallet Address (Mistake #6)
OR-006 · Maintain Access to Your Authentication Systems
What it prevents: Prevents locking yourself out when you lose the phone, number, security key or email your accounts depend on.
Read more: Locked Out Crypto Wallet (Mistake #5)
OR-007 · Plan Wallet Recovery for Emergencies and Inheritance
What it prevents: Prevents your crypto becoming unreachable for you or your family after an accident, illness or death.
Read more: Crypto Inheritance (Mistake #11)
Scam Defense Rules: Avoid Deception (10)
How to recognize and walk away from scams before you pay, sign or share anything.
SDR-001 · Never Trust Unsolicited Crypto Contact
What it prevents: Prevents most scams at the first step: whatever the topic, crypto contact you did not start, such as a DM, call, email or friend request, is suspect from the first message.
Read more: Social Engineering Scams · Impersonation Scams · Fake Investment Platforms · Romance Scams · Blackmail and Extortion · Recovery Scams
SDR-002 · Never Send Crypto to Receive Crypto
What it prevents: Prevents giveaway, airdrop and job scams that ask for a small payment before a promised larger reward that never comes.
Read more: Social Engineering Scams · Giveaway and Airdrop Scams · Job and Task Scams
SDR-003 · Never Pay to Unlock or Withdraw Funds
What it prevents: Prevents the fee loop of fake platforms, where every “tax”, “fee” or “deposit” you pay is followed by another one.
Read more: Fake Investment Platforms · Romance Scams · Job and Task Scams · Recovery Scams
SDR-004 · Verify Identities Outside the Message Channel
What it prevents: Prevents impersonation of friends, recruiters, founders and companies, because a scammer controls the chat they contact you in but not the number or website you look up yourself.
Read more: Social Engineering Scams · Impersonation Scams · Romance Scams · Blackmail and Extortion · Recovery Scams
SDR-005 · Never Connect Your Wallet to Unknown Websites
What it prevents: Prevents connecting to sites that are exactly what they claim to be, but where the project itself is the scam, such as airdrop claims, new mints and unknown dApps.
Read more: Phishing Scams · Malicious Contracts · Giveaway and Airdrop Scams
SDR-006 · Question Urgency, Hype and Guaranteed Profits
What it prevents: Prevents decisions made under pressure, because real opportunities do not disappear in minutes or promise fixed returns.
Read more: Social Engineering Scams · Fake Investment Platforms · Token Scams · Romance Scams
SDR-007 · Verify Projects Before Investing
What it prevents: Prevents investing in fake platforms, rug pulls and tokens that cannot be sold, by checking the team, contracts and history before any money goes in.
Read more: Fake Investment Platforms · Token Scams
SDR-008 · Never Trust Social Media Popularity
What it prevents: Prevents being convinced by followers, likes, comments and checkmarks that can all be bought or faked.
Read more: Token Scams
SDR-009 · Verify All Links Before Logging In
What it prevents: Prevents entering your exchange or email password, 2FA code or seed phrase on a copied login page reached through a link, so open accounts from a bookmark instead.
Read more: Phishing Scams
SDR-010 · Never Pay Anyone to Recover Lost Crypto
What it prevents: Prevents losing more money after a scam: services that charge upfront to “recover” lost crypto are almost always the same scammers or new ones.
Read more: Recovery Scams
Technical Security Rules: Protect Devices and Accounts (7)
How to keep your devices and accounts from becoming the way in.
TSR-001 · Never Install Crypto Software from Unofficial Sources
What it prevents: Prevents installing fake wallets, browser extensions and trading apps built to steal your keys.
Read more: Fake Apps and Wallets · Job and Task Scams
TSR-002 · Assume Your Device Can Be Compromised
What it prevents: Prevents over-trusting the device on your screen, so you check addresses and transactions on the hardware wallet and keep secrets off the computer.
Read more: Fake Apps and Wallets
TSR-003 · Avoid Public Wi-Fi for Crypto Operations
What it prevents: Prevents others on a shared network from intercepting or redirecting your traffic while you log in or send crypto.
Read more: How to Keep Your Crypto Safe from Hackers
TSR-004 · Use Hardware-Based Two-Factor Authentication
What it prevents: Prevents account takeover through SIM swaps and phished codes, because a physical security key cannot be redirected or entered on a fake site.
Read more: Phishing Scams · How to Keep Your Crypto Safe from Hackers
TSR-005 · Enable Withdrawal Whitelists on Exchanges
What it prevents: Prevents an attacker who gets into your exchange account from withdrawing to their own address.
Read more: Address Poisoning
TSR-006 · Separate Devices and Accounts for Crypto Use
What it prevents: Prevents one infected device or breached account from exposing all your crypto at once.
Read more: Fake Apps and Wallets · Job and Task Scams
TSR-007 · Slow Down Before Clicking or Installing
What it prevents: Prevents the one rushed click or install that most attacks depend on, by giving you time to notice that something is off.
Read more: Social Engineering Scams
Tools that put the Golden Rules into practice
Each Golden Rule is a behavior. These tools make the behavior easier to keep.
| Golden Rule | Tool | What it reinforces |
|---|---|---|
| GR-001 Seed phrase protection | Secure offline seed storage | Prevents digital seed phrase exposure |
| GR-002 URL verification | Password manager + domain age lookup | Blocks phishing domains and fake platforms |
| GR-003 Hardware wallet | Hardware wallet | Isolates private keys from compromised environments |
| GR-004 Approval discipline | revoke.cash | Removes standing smart contract permissions |
| GR-005 Fake support defense | Hardware security keys + 2FA | Prevents phishing-based account takeover |
| GR-006 Test transaction | Hardware wallet screen verification | Prevents wrong-address and wrong-network errors |
| GR-007 Seed storage security | Metal backup storage | Protects recovery material from digital compromise |
| GR-008 Three-Wallet Model | Separate wallets for storage, daily use and dApps | Limits the damage of a bad dApp interaction |
How the rules are governed
The rules change only through a new rules version, published with a change log. Within that, three things never change:
- Rule IDs are permanent. An ID is never renumbered or reused, so a guide that cites GR-004 always means the same rule.
- Retired rules stay listed. A rule that is dropped is marked retired, not deleted.
- Merged rules keep their old ID. If two rules are combined, the old ID stays as a pointer to the rule that replaced it.
Every week, new incidents are collected, classified and added to the CSF incident dataset, and the rules are assessed against that new data. A rule never changes how an incident is classified; it only describes the behavior that would have prevented the loss. The registry and schema are public:
Change log
| Version | Date | What changed |
|---|---|---|
| Rules v2 | October 2026 | All 32 rules published on one page, in four families, with a plain-language explanation of what each rule prevents. New rule SDR-010: Never Pay Anyone to Recover Lost Crypto. Rule names aligned with the 2026 guides. |
| Rules v1 | — | The 8 Golden Rules published. |
Frequently asked questions
What are the CSF rules?
32 single-sentence security rules, grouped in four families, each built to stop one recurring way people lose crypto. The 8 Golden Rules are the core.
Do the rules guarantee protection?
No. No rule can. They lower the chance of loss by blocking the patterns that cause most real losses.
Are the rules based on real data?
Yes. Each rule is derived from loss patterns that recur in the CSF incident dataset, not from opinion. New incidents are collected and assessed against the rules every week.
What changed in Rules v2?
All four families are now published here with explanations, and SDR-010 was added after recovery scams showed up repeatedly as a second loss after a first scam.
Why do rule IDs never change?
So that every guide, post and tool that cites a rule keeps pointing at the same rule. A guide written for Rules v2 stays readable when Rules v3 comes out.
Which rules version does my guide use?
Each guide states it near the front, for example “This edition uses CSF Rules v2.”
How are the rules different from general crypto safety tips?
Tips explain; the rules decide. Each rule is one behavior, tied to a specific way of losing crypto, and versioned so it does not change silently.