Airdrop season is back again. The task platform is simultaneously fighting against witch-hunting and implementing a points system, making earning tokens feel like clocking in at work... What I need to be reminded of most recently isn't "whether to compete or not," but rather not to treat wallet security as a default just to save trouble.

The red line of mnemonic phrases doesn't need to be mentioned; I really can't believe someone would input them on a webpage. Even more sinister are signatures/authorizations: they look like logins, but in fact, they're giving you a long-term access pass. A few days later, when your assets are gone, you might not even remember what you clicked. My approach is pretty simple: only receive transfers in the main wallet, use a secondary account for interactions; if I see unlimited authorization requests, I cancel them first; if on-chain confirmations aren't enough, I just pretend nothing happened. After experiencing block rollback issues, I only trust confirmation counts and caution.