MetaMask Hacking Tactics... How to Avoid On-Chain Scams

The Web3 and crypto ecosystem is growing really fast these days. It's now common to use personal wallets like MetaMask or OKX Wallet to trade directly on-chain or use smart contracts. But as convenient as this is, the number of scammers targeting your assets is growing too!

Today, I'll walk you through the types of on-chain scams and how to prevent them in an easy and fun way. Let's take a close look at how scammers try to trick us and how we can protect ourselves!

1. Approval Hijacking Scams

The most common scam is approval hijacking. Scammers pose as free airdrops or events and send you fake links. If you fall for "Claim your airdrop!" and click the link, a window pops up saying "Approve to receive your tokens." If you hit approve here, all your assets get stolen.

• Never click links you receive on social media, and check whether the account is official.
• Of course, even official accounts get hacked sometimes! Always double-check the details before approving a transaction.

2. Permit Scams

Have you ever heard of a feature called Permit? It was created by platforms like Uniswap to reduce gas fees, but it can be dangerous if misused. If you approve a permit on the wrong platform, scammers can transfer your assets however they like.

• Make sure the platform is trustworthy.
• When a signature request comes in, always check that its contents are safe.
• Only approve the permissions you really need.

3. Screenshot and Screen Recording Scams

There are also many cases where scammers steal information like private keys or mnemonic phrases through screen recordings or screenshots. For example, it's a big problem if they ask for remote support, or if sensitive information is showing on your screen during a video call.

• Never save your private key or mnemonic phrase as a screenshot. Write it down on paper and keep it in a safe place.
• When sharing your screen, make sure no sensitive information is exposed.

4. Fake Token Scams

Have you ever found a strange token suddenly sitting in your wallet? Scammers airdrop tokens that have no real value or whose value has been artificially inflated, to get users to trade them. Then they lure you to a phishing site and drain your assets.

• Never trade suspicious tokens.
• Don't approve transactions on unknown platforms.

5. Address Poisoning Scams

Have you ever almost made a mistake when sending coins? Scammers target exactly these mistakes. They create addresses that look similar to the ones you use often, send you several transactions, and wait for you to slip up.

• Add the addresses you use often to a whitelist and label them.
• Make a habit of checking the address two or three times before sending.

6. Exit Scams and Rug Pulls

This is a truly vicious scam. The project team promotes heavily to pull in investment, then one day suddenly disappears or manipulates the token price to make it crash.

• Don't invest large amounts in projects you don't know well.
• Regularly check and remove DApp permissions.

How Can You Use Your Wallet Safely?

In the Web3 crypto world, just building a few habits can make your assets much safer. Especially if you use personal wallets like MetaMask or OKX Wallet, check the following 3 precautions regularly.

1. Clean up permissions: Regularly remove unnecessary approvals from your wallet. You can do this with Revoke.cash or in your wallet settings.
2. Keep important information offline: Write your mnemonic phrase on paper, not in digital form, and keep it in a safe place.
3. Double-check transactions: When signing a transaction, always check the details and the scope of permissions. Be careful not to approve in a hurry.

The Truth About MetaMask Hacking and Recovery

So far, we've looked at various scams carried out through on-chain transactions. Strictly speaking, assets get stolen because of a wrong signature or a leaked mnemonic phrase, not because MetaMask itself got hacked.

The assets in MetaMask can be considered safe as long as your private key or mnemonic phrase isn't leaked. If permissions or keys have been leaked and you keep suffering losses, it may be better to reset all of your wallet's permissions or create and use a new wallet.

To put it another way, if your key or mnemonic is leaked, it's practically the same as losing all control over your assets. That means no matter how many permissions you revoke, the scammer can keep accessing your wallet going forward.

Also, if you lose assets from your wallet, you should assume there's practically no way to get them back. So it's best to fully understand the 6 scam cases we covered above and how to prevent them, and to always sign transactions carefully.

Finally, watch out for scammers who offer to help recover assets lost to scams and then ask for your private key, tell you to enter your mnemonic phrase, or ask you to deposit a certain amount!