Safety on X and Discord

The bigger Web3 gets, the more effort goes into scamming the people inside it. Profiles get cloned, links get faked, and the pitch is always aimed at someone who just wants to be part of something.

It happens to new collectors, working artists and seasoned community leads alike, so none of this is too obvious to say out loud. Here is how to stay properly active on X and Discord without leaving a door open.

📧 Never click random links in DMs

Giveaways, secret airdrops, urgent help, an offer on a piece you own. If it arrives unrequested in your direct messages, treat it as hostile until proven otherwise — and it will rarely be worth the effort of proving otherwise.

• Only follow links from official servers, verified announcement channels, or posts you found by navigating to a profile yourself.
• Never connect your wallet to a site you arrived at through a DM.
• Never approve a signature request that originated from a conversation you did not start.
• Shortened links, unusual domains and anything that asks you to "verify" or "sync" your wallet are all the same answer: block, report, move on.

No real project has ever needed you to click within the next ten minutes.

🕶 Impersonators are everywhere

On X, scammers copy a project or artist account exactly — same display name, same avatar, same banner — and change a single character in the handle. A capital I standing in for a lowercase l is the classic, because in most fonts they are identical. They then reply under the real account's posts, offering to help.

Before you trust a profile:

• Read the handle character by character, not the display name. The display name is free to copy.
• Check the account age and post history. Scam clones are usually weeks old with a thin, oddly repetitive timeline.
• Look at the engagement. Hundreds of followers and no real conversation is a tell.
• Cross-check the links in the bio against the ones on the project's own site.
• Reach official communities by typing the address yourself or following a link from a source you already trusted yesterday.

🎁 Fake giveaways and airdrop claims

The fake giveaway is the most common trap in crypto because it is the one that flatters you. You have won. You qualified. You were selected for an exclusive mint.

Real projects will never:

• Ask you to connect your wallet to claim a prize.
• Ask for your seed phrase, secret key or password — for any reason, in any context.
• DM you out of nowhere about rewards you did not enter for.
• Require you to send funds first in order to receive funds.

Legitimate drops, mints and giveaways from XRPL Home and the CommUnity are announced publicly through the official channels. If you did not see it there, it is not real — and if you think you might have missed it, go and look for yourself rather than trusting the person who brought it to you.

🔒 Lock down your Discord

Discord is where the community actually lives, which is exactly why it is worth hardening. Five minutes of settings work removes most of the risk.

1. Turn off DMs from server members

   Settings → Privacy & Safety → turn off direct messages from server members. Apply it to existing servers when prompted. This single change stops the majority of scam attempts before you ever see them.

2. Turn on two-factor authentication

   An authenticator app on your account, and save the backup codes somewhere offline. A compromised Discord account becomes a scam vector aimed at everyone who trusts you.

3. Be careful with Authorize App

   Only authorise applications you went looking for, from a link inside the official server. Review the permissions on the screen. Revoke old ones you no longer use in Settings → Authorized Apps.

4. Do not open files from strangers

   Images, archives, installers, "portfolio" PDFs from an unknown commissioner. Malware arrives as a friendly attachment far more often than as an obvious one.

5. Verify moderators in the server

   Check the member list and role colour inside the server itself. Real mods never DM you first and never ask for wallet information, seed phrases or a screen share.

🔑 Protect your keys and split your risk

Your seed phrase is the whole wallet. If someone else has it, the funds are gone, and no support ticket, mod, exchange or team can reverse it.

• Never share, type or photograph your seed phrase or secret key. Not into a website, not into an app, not into a DM, not for anyone claiming to be XRPL Home, Xaman, a moderator or support. No legitimate team will ever ask, and no genuine process requires it.
• Keep it offline, physically, somewhere only you can reach. Cloud notes and photo libraries are not that place.
• Only connect your wallet to apps you know, reached through links you found yourself.
• Read every signing request before approving it, and reject anything that does not match what you just did.
• Keep a second wallet with a small balance for experiments, collabs, allowlists and anything unfamiliar. Your main holdings stay somewhere that never touches an unknown site.

The collecting-specific version of these habits — issuer verification, taxon checks, off-market deals — is in How to Collect NFTs Safely, and the broader ground rules are in Crypto Safety 101.

👀 Trust, but verify — and speak up

Even in friendly rooms, take the extra second. Scams work on urgency and flattery, and both of them dissolve if you simply wait an hour.

If you suspect something is wrong with your wallet, move your assets to a fresh one immediately and sort out the details afterwards. If you spot a scam, post it in the server — the CommUnity and the 🔋 by $DOOD™ network work hard to keep things transparent, and a single screenshot in the right channel routinely saves someone else their collection.

We keep each other safe by being slightly less polite to strangers and slightly more generous with warnings. Come find the rooms where that happens at XRPL Home community.