Mars MarketPractical
Twelve rules that measurably reduce your exposure
None of these rules requires a purchase, an account or a subscription, and this page earns nothing from any product. They are ordered by how much they reduce risk per unit of effort, which is not the same as the order in which they are usually published.
The premise
Crypto has no reversal step. Every loss described on this site was final at the moment it happened, so protection has to operate before the transaction rather than after it.
Rules
Twelve rules, in order of return on effort
-
Treat every destination reached through a search result as unverified
This single rule removes the largest category of loss on this site. The ranking of a result is a measure of how well somebody optimised for the query, not of whether the destination is genuine. Assume nothing about a link because it appears first.
-
Read the prompt before you sign it
A transfer request and a permission request are different operations that look similar in a wallet popup. One moves a specific amount now; the other grants standing access that can be exercised later, when you are not looking. Refuse anything open-ended.
-
Review and revoke old approvals periodically
Permission granted to a site two years ago survives that site changing hands, being cloned or being abandoned. A stale approval is an open door that nobody is guarding, and clearing the ones you no longer use costs nothing.
-
Understand what the recovery phrase is
It is not a password, a backup contact detail or a support mechanism. It is full, permanent control of the wallet. No legitimate party asks for it, in any framing, including a framing that claims your funds are at risk without it.
-
Separate wallets by purpose
One wallet for long-term holdings, kept offline and never connected to a website; one for routine activity, funded only with the amount you would accept losing this month. Compromise of the second should be an inconvenience rather than an event.
-
Compare the full destination, not its ends
Matching opening and closing characters is a procedure that can be defeated by design, and it has been. Where the amount is material, verify the entire string, and send a small test transaction first when the destination is new.
-
Trust the hardware display over the screen
Malware on a computer can alter what you see and what you paste. It cannot alter what a separate signing device shows you. Where the two disagree, the device is correct and the session is compromised.
-
Verify people out of band, every time
Inbound contact claiming to be support, a moderator, an exchange or a colleague is a claim, not an identity. Close the channel and reopen it through a route you already controlled before the message arrived.
-
Use unique credentials and a password manager
Credential reuse is what turns one breach into a chain of them, and infostealer malware exists specifically to harvest saved logins in bulk. Unique passwords are not diligence; they are damage limitation.
-
Prefer app-based or hardware second factors over SMS
Message-based codes can be intercepted through number porting and are routinely defeated as part of account-takeover campaigns. A code generator or a hardware key is not.
-
Keep a plain record of what you did
Transaction identifiers, destinations, timestamps, the addresses of pages you visited, and any messages exchanged. Rebuilding this after the fact is far harder than noting it in advance, and without it nobody — including police — can act.
-
Decide your loss limit before you need the money
Write down the amount you are prepared to lose entirely, and treat any amount above it as already gone. In this sector the decision to keep going after a bad outcome is the mechanism by which a small loss becomes a large one.
Straight answers
Four questions we are asked constantly
Can stolen crypto be recovered?
Sometimes, but not by you and not quickly. No party can reverse an on-chain transfer. Recovery happens when investigators identify and seize the recipient, which has occurred in several major cases and generally takes years. Anyone who contacts a victim offering a paid recovery service is almost always running a second fraud against the same person.
Does a PGP signature prove an address is genuine?
No. It proves that the holder of a given key wrote a given message. When the key arrived through the same page, at the same time, as the address it supposedly authenticates, nothing has been verified independently — the check is circular by construction.
Is multi-signature escrow safe?
Only if the other keys belong to parties who can and will refuse to sign. Where buyers deposit without controlling any key, the arrangement offers them no protection at all, whatever it is called in the marketing.
Does an anonymising network make me anonymous?
No. It conceals the route between you and a destination. It does not conceal payment flows, and no network layer is needed to follow funds. Investigators have repeatedly worked from transaction records rather than from traffic, and those records never expire.
Next
Protection is cheaper than recovery, every time
If nothing has gone wrong yet, the rules above are the whole of the work. If something already has, the sequence on the help page is the one that preserves options.