지갑 보안 매뉴얼 · 문서 WH-2026-002
시드 문구가 바로 그 열쇠입니다. 한 번이라도 당신의 손을 떠나면 — 사진 찍히거나, 웹사이트에 입력되거나, "지원"으로 보내지는 — 당신의 지갑은 더 이상 당신의 것이 아닙니다. 이 매뉴얼은 세 가지를 다룹니다: 열쇠가 어떻게 잃어지는지, 어떻게 보호하는지, 잃어버렸을 때 무엇을 해야 하는지.
데모용 소품 · 사기꾼이 가장 원하는 것
* 위는 데모용 단어입니다. 실제 시드 문구가 아닙니다. 셀을 클릭하여 봉인을 제거하세요.
위협 기록부
No elite hacker required. No device breach needed. Most thefts travel these three most ordinary paths. Know the enemy first, then know what to defend.
Fake official sites, forged airdrops, "official" DMs — all using pages that look completely legitimate to trick you into entering your seed phrase or signing malicious transactions. The FBI reported over $5.6 billion in crypto-related fraud losses in 2023 alone.
방법: 무장된 신뢰 · 목표: 누구나
Screenshots, cloud sync, typing into "verification" sites, sending to "customer support." The seed phrase is the only key to your wallet. Once it leaves your hands — even once — treat it as compromised. No exceptions.
방법: 열쇠 도난 · 결과: 복구 불가
Under the "mint""claim""stake" approval popup may hide an unlimited allowance. Scammers don't need you to send funds — they can drain everything within that limit yourself. You may not notice a thing.
방법: 서명 덫 · 결과: 조용한 드레인
방어 매뉴얼
이것은 소망 목록이 아닙니다 — 순서입니다. 규칙 하나부터 시작하세요. 각 단계를 따르세요.
Write it by hand on paper. Lock it in a drawer or safe. Never screenshot it, never type it into any website, never send it to anyone. A digital seed phrase is already compromised.
Store large holdings in a hardware wallet (cold). Use a separate hot wallet for daily small transactions. The two wallets must have different seed phrases — if the hot wallet is compromised, the principal stays safe in cold storage.
After pasting, verify character by character. Focus on the first and last 8 characters. Save addresses to a contacts list. Compare every time — don't just glance at the first few.
Check the scope of approvals on unfamiliar contracts. Revoke unused ones at revoke.cash. Beware of clone domains — verify the tool's own URL before confirming anything.
Large transactions should require hardware confirmation and second-factor auth. For team or family funds, use a multi-sig wallet — no single person can move everything.
Write down in advance: what to do if your device is lost, if you suspect a leak, if you send to the wrong address. List the steps now, follow them later — don't decide in a panic.
시드 금고
「종이에 쓰세요」는 이야기의 절반에 불과합니다. 쓰는 것은 시작일 뿐입니다 — 어떻게 보관하느냐가 30년 동안 생존할지, 네트워크에 가까워질지 결정합니다.
Paper can be flooded, burned, eaten by insects. For long-term large holdings, metal backup (engraved stainless steel plates like Cryptosteel or Billfodl) is recommended, or at minimum waterproof paper cards with lamination. Any "digital seed phrase" in screenshots, documents, or cloud storage should be treated as compromised.
Use Shamir Secret Sharing to split your seed phrase into multiple parts stored separately (e.g. 2-of-3, 3-of-5): losing any single shard isn't fatal, leaking any single shard isn't fatal either. Best for large long-term holdings — but the shard rules themselves must be stored as securely as the seed phrase.
Main copy + backup copy + emergency copy (at a trusted person's place), stored in different physical locations. Each copy must guard against being "seen" — a roommate, a security camera, a repair worker could all become witnesses.
Generally no. Password managers live on internet-connected devices — one malware infection and your seed phrase is gone. The only truly safe "digital seed phrase" exists on a fully offline device, and even then there's still the risk of being photographed or cloud-backed up. Beginners should skip this route.
One wrong word in your seed phrase and recovery will fail. After writing it down, practice recovery right away: delete your wallet, recover using only the paper words, confirm it works — this is the only way to verify your backup is actually good.
NEVER screenshot it. NEVER type it into any website. NEVER send it to anyone — including those claiming to be official, security experts, or customer support. NEVER put it on any internet-connected device.
빨간 깃발
사기는 계속 진화하지만, 그들의 허점은 결코 변하지 않습니다. 그중 하나만으로도 충분합니다 멈추고, 검증하고, 떠나세요.
"Last 2 hours""Account will be frozen if you don't act." Official channels never manufacture urgency. Pressure is scam's first hallmark.
No legitimate project will ever ask for your seed phrase or private key. If they ask, it's a scam. No exceptions. No "verification."
wallet-connect-verify.com, or one or two characters off from the official spelling. Check the address bar. Don't check the page content — the page itself is fake.
Official support never DMs you first, and they never pull you into a "recovery group." "Official" contacts that come to you are, by default, fake.
An "airdrop" that asks you to send funds first is a pay-to-receive phishing trap. Real airdrops never require you to pay anything.
Can't understand the English in the approval popup? It says "unlimited"? If you don't understand it, don't sign. Close the page and come back later.
사기 사건
시트 04의 빨간 깃발을 현실적인 순서로 따라갑니다. 각 단계에서 왼쪽은 사기의 동작, 오른쪽은 지금 당신이 해야 할 것을 보여줍니다.
You receive a DM (Telegram / Discord / X): "Hello, we're the official XX team. Congratulations — you qualify for an airdrop. Claim here: xxx-claim.com."
Don't click. Links in DMs are phishing by default. Verify through official channels — cross-reference SHEET 06, or search the official announcement directly.
The fake site (domain xxx-claim.com) looks identical to the real one — even sporting a fake "official site" badge, with a giant claim button on the homepage.
Check the address bar domain against the official entrances table, character by character. Page content can be faked. A domain cannot — you just have to look.
The page asks you to "connect wallet," or directly asks you to "enter your seed phrase to verify identity." They claim this is a required step for the airdrop.
A seed phrase must never be entered into any website. Connecting your wallet is fine — but watch the next approval popup carefully. That's the real battlefield.
The signing popup reads "Approve unlimited amount of TOKEN," with a countdown timer designed to rush you.
If you don't understand it, don't sign. See unlimited? See a countdown? See any pressure? Click "Reject," close the page, and come back later.
Assets are drained in bulk within minutes. Once a chain transfer is confirmed, it cannot be reversed.
Immediately execute SHEET 07 Emergency Checklist Step 1: move remaining assets to a brand-new wallet (new seed phrase). Isolate first, investigate later.
The scammer doesn't rush — they slowly drain within the approved limit. You may not notice for days or weeks.
Immediately revoke that contract approval (revoke.cash — verify the domain first), then monitor your balance closely.
왜 이것이 중요한가: 사기는 단일 동작이 아닙니다 — 그것은 네 단계의 체인입니다: 접촉, 미끼, 진입, 서명. 각 단계에는 flaw이 있고, 모두 시트 04에 기록되어 있습니다. 모든 사기를 암기할 필요는 없습니다. 각 단계에서 1초만 멈추면 됩니다: 이건 DM인가? 도메인이 맞는가? 시드를 요구하는가? 이 팝업을 이해하는가?
공식 입구
대부분의 피싱은 검색 결과의 광고 위치 또는 DM의 링크에서 시작됩니다. 고정된 진입점을 제공하세요: 이 표를 통해서만 지갑 사이트에 접근하고, 항상 주소 표시줄 도메인을 확인하세요.
도메인은 2025년 8월에 확인되었습니다. 「새 URL」을 받으면 먼저 이 표로 돌아오거나 지갑의 공식 소셜 계정으로 더블체크하세요 — 복제 도메인은 종종 1~2글자 차이만 있습니다. 앱은 공식 웹사이트의 링크를 통해서만 다운로드하거나 공식 앱 스토어에서 개발자 전체 이름을 직접 검색하세요.
SSL 참고: 정당 한 지갑 사이트는 모두 HTTPS를 사용하지만, SSL 인증서는 연결이 암호화되었다는 의미일 뿐, 웹사이트 자체가 신뢰할 수 있다는 의미는 아닙니다. 도메인과 주소 표시줄 확인이 가장 신뢰할 수 있는 검사입니다.
비상 매뉴얼
순서는 하나뿐입니다: 먼저 고립, 다음으로 조사. 자산 안전은 항상 무슨 일이 있었는지 이해하는 것보다 우선됩니다. 각 단계를 실행하세요:
Move assets to a brand-new wallet (new seed phrase) right now — don't wait a moment. The new seed phrase goes only on paper. Treat the old one as compromised; never use it again.
Revoke suspicious contract approvals at revoke.cash (verify the domain first), then watch your balance closely. Not sure which approvals are suspicious? Revoke them all. Re-authorize only what you actually need.
Contact the project team and exchanges immediately to attempt freezing (the window is short). Preserve all evidence (transaction hashes, chat logs, links), then report to authorities. On-chain transfers are usually irreversible — that's why the first two steps always come first.
Never pay anyone to "unlock funds" or "recover lost assets." Those claiming they can help you recover are the second wave of scammers, targeting people who just got burned.
일반적인 속설
가장 흔한 합리화 네 가지 — 각각이 당신의 지갑에 또 다른 문을 엽니다.
Bulk-scanning scripts don't discriminate. They scan for assets and exposures on-chain. Small accounts are on the same list.
They protect against remote theft — they can't stop you from typing your seed phrase into a phishing page. A hardware wallet is only as safe as the hands holding its seed phrase.
Groups are public. Anyone can rename themselves "support." Impersonating official staff is the most common starting point for scams in crypto.
Checksum addresses distinguish case. Imposters construct visually similar addresses. Verify completely — at least the first and last 8 characters, and cross-reference with your address book.
용어집
위의 모든 섹션은 이러한 용어를 알고 있다고 가정합니다. 읽는 동안 막히면 이 표로 돌아오세요. 이는 매뉴얼의 부록 — 그리고 또한 그 시작점입니다.