🛡 Enterprise · Web3 Security Awareness

Live market data · 6 questions · ~2 minutes

Web3 & Crypto Security Awareness Survey

Measure your security blind spots across Web3 and crypto.
Complete all questions to unlock the full knowledge base and claim your airdrop reward.

🎁

Complete the survey, get an airdrop token reward Issued after all 6 questions · no wallet connection required

AIRDROP

6

Questions

5

Modules

Airdrop

On completion

For internal security awareness education only. Not investment advice.
This page never connects a wallet, never asks for your seed phrase or private key, and never collects wallet addresses.

Before you start · 60 sec

Fundamentals

Take one minute to learn the key terms

No wallet actions involved. Understanding these terms will make the questions easier.

🔑

Seed phrase / Private key

A private key is a secret string that controls a single address. A seed phrase (12 or 24 words) can derive the private keys of all your addresses — it is the master key to your wallet. Whoever holds it controls all your funds.

👛

Self-custody wallet vs. Exchange

An exchange (e.g. Coinbase) holds assets for you under its own account. In a self-custody wallet (e.g. MetaMask, Trust Wallet), the seed phrase is yours and you are fully responsible for your own security.

⛓️

Blockchain

A public, tamper-proof ledger. All transactions are visible to everyone and cannot be deleted. Funds sent to the wrong address or stolen by a scammer cannot be recovered — that is the biggest difference from a bank.

🎛️

DApp & Smart contract

A DApp is an app running on the blockchain (e.g. a decentralized exchange). A smart contract is a program that executes automatically — no support desk, no manual review. Code runs exactly as written.

🔓

Token approval

When using a DApp, you allow it to “access your tokens” — this is an approval. Many DApps request an unlimited approval, meaning the contract can move your entire balance of that token at any time — a key focus of this survey.

⛽

Gas fees

Every on-chain action (transfer, approval, revoke) requires a network fee called gas, paid in the chain's native coin (e.g. ETH, BNB).

Web2 (Banks, Big Tech)

Your account and assets are held by a company. Lost password? Recoverable. Fraud? You can dispute and freeze.

Web3 (Wallets, DApps, on-chain assets)

No account — just an address. The address is controlled by a private key; lose the key and you lose the funds forever.
No support desk. No one can “recover” or “freeze” anything for you.
Transactions are irreversible. Once confirmed on-chain, no one can undo them.
You are 100% responsible for your own security. That is exactly what this survey helps you build.

ℹ️ Don't worry if some terms are new. Every question explains the reasoning behind it, so you learn as you go.

1/6 knowledge points unlocked

Q1 of 6

How long have you held crypto assets?

Whatever stage you're at, one rule never changes: your seed phrase is the master key to your wallet, and no legitimate service, support agent, or website will ever ask you for it.

If you have ever screenshotted your seed phrase on your iPhone, delete it now and switch to an offline handwritten backup.

⚠️iPhone Photos sync through iCloud — a screenshot may already have left your device.

Module 1: Seed Phrases & Private Keys

1.1 Private key vs. seed phrase: why the seed phrase is the “master key”

A private key is a 256-bit random number that controls a single address.
A seed phrase (12 or 24 words) can derive unlimited private keys — it is the master key to all your wallets.
Leaking a private key = losing one address. Leaking a seed phrase = losing everything under that phrase, across all addresses.

1.2 Three things you must never do on an iPhone

Screenshot your seed phrase: iPhone Photos sync to iCloud by default — the screenshot may already have left your device.
Store it in Photos or Notes: if Notes has iCloud sync on, it carries the same cloud-leak risk.
Send it through any chat app: WeChat, Telegram, iMessage, email — none of these channels is safe.

1.3 How to back it up correctly (offline, handwritten)

Use a paper seed-phrase card. Write it by hand — never print, never photograph.
Verify it 3 times to make sure every word and its order are correct.
Store it in at least two physically separate locations (e.g. home safe + bank vault).
Tell no one where it is stored — not even family.

2/6 knowledge points unlocked

Q2 of 6

How do you mainly manage your crypto assets today?

3/6 knowledge points unlocked

Q3 of 6

If you've ever used a DApp or website and granted it “access to your tokens,” did you know that approval may never expire automatically?

Contract permissions have no expiration date. If you granted an approval, the contract can still use it years later.

More importantly: disconnecting your wallet from a project does not remove the permission. Even after you stop visiting a site, the token approval you granted stays active. That's why many people see assets moved months after they “stopped using” a DApp.

Module 2: Approval Self-Audit

2.1 What a token approval is, and why “unlimited” is dangerous

To use a DApp, it asks you to approve “access to your tokens.”
Many DApps request an unlimited approval by default, meaning the contract can move your entire balance of that token at any time.
If the contract is hacked or has a backdoor, your entire balance of that token can be swept in one transaction.

2.2 Check approvals with revoke.cash or Etherscan Token Approval Checker (iPhone steps)

Open revoke.cash in iPhone Safari.
Tap “Connect Wallet” and choose your wallet (MetaMask, Trust Wallet, etc.).
The connection is read-only — no signature, no seed phrase required.
The page lists all contracts you've approved. Handle anything marked “Unlimited” first.
Tap “Revoke,” confirm the gas fee, and wait for the transaction to confirm.
Repeat this review every 3 months.

2.3 Revoking costs gas — but not revoking costs more

Revoking an approval requires a gas fee, which varies with network congestion.
The risk of not revoking: if the contract is hacked, your entire balance of that token can be moved.
The trade-off: one gas fee vs. your whole balance.

4/6 knowledge points unlocked

Q4 of 6

Which of the following have you encountered on your iPhone?

5/6 knowledge points unlocked

Q5 of 6

Which statement about “revoking a token approval” is correct?

The correct answer is B. Revoking token access requires a transaction fee (gas), which can take anywhere from a minute to a few minutes depending on the network.

On the other options: disconnecting is not the same as revoking; and revoking does not affect your staking, pools, or lending positions — you keep your positions and continue to earn rewards.

revoke.cash

Open in iPhone Safari

Connect Wallet → MetaMask READ-ONLY

UNISWAP · USDC · USDT Unlimited

Revoke → confirm gas fee 0.0012 ETH

UNISWAP approval Revoked ✓

Open revoke.cash in iPhone Safari

Open revoke.cash in iPhone Safari, connect your wallet, and select the contract to revoke. You never enter a seed phrase at any point.

1. Open the tool

Visit revoke.cash in iPhone Safari, or use Etherscan's Token Approval Checker.

2. Connect your wallet (read-only)

Tap Connect Wallet and choose your wallet. Connecting never asks for a signature or your seed phrase — just confirm the wallet type.

3. Find unlimited approvals

Handle contracts marked Unlimited first — these carry the highest risk.

4. Revoke and confirm the gas fee

Tap Revoke and confirm the gas fee in your wallet. Once the transaction is on-chain, the status becomes Revoked.

5. Make it a habit

Review your approval list every 3 months.

6/6 knowledge points unlocked

Q6 of 6

If you had to check your wallet for a “security blind spot” right now, which is your biggest uncertainty?

The 6 questions you just completed cover the three traps iPhone users fall into most often: seed-phrase leaks, unlimited approvals, and fake airdrops.

Below is the full knowledge framework you unlocked, plus the final piece: what to do first if the worst has already happened.

Calculating your security blind-spot score…

Module 5: Incident Response

5.1 First step when you suspect a seed-phrase leak

Immediately create a new wallet and generate a new seed phrase.
Move remaining assets to the new wallet address.
Do not use the old wallet address to receive any new assets.
If assets were already moved, record the transaction hash and report to the relevant exchange and law enforcement.

5.2 How to move remaining assets with a new wallet (gas-fee notes)

Before moving, make sure the new wallet has enough gas (ETH, BNB, etc.).
If the old wallet still holds gas, move that to the new wallet first.
Don't move everything at once — send a small test amount first.
Once confirmed, move the remaining assets.

5.3 Common “support” scam scripts, decoded

What the scammer says	The truth
“Your account is abnormal; verify your seed phrase.”	No legitimate support agent ever asks for your seed phrase.
“We need you to approve a contract to fix the issue.”	This tricks you into signing a malicious contract.
“Send a gas fee to this address first.”	This is a direct theft of funds.
“Act now, or your account will be frozen.”	Manufactured urgency so you don't have time to think.

🎉 Survey complete · Reward issued

Congratulations — your airdrop token reward has been sent

Below is your security blind-spot score and the full Web3 & crypto security knowledge base you unlocked.

🎁

Airdrop token reward issued This is an internal security-awareness survey; the reward is a demo issuance — no wallet connection required.

DONE

Knowledge points you've unlocked

✓ Module 1 · Seed phrases & private keys ✓ Module 2 · Approval self-audit ✓ Module 3 · Airdrops & phishing ✓ Module 4 · iPhone-specific risks ✓ Module 5 · Incident response

Module 1 · Seed phrases & private keys

The seed phrase is the master key to all addresses; a leak means losing everything. Never screenshot it, never put it in Photos/Notes, never send it through chat. Write it by hand, verify 3 times, store it in physically separate locations.

Module 2 · Approval self-audit

Token approvals have no expiration, and disconnecting is not revoking. Use revoke.cash to review and revoke unlimited approvals — every 3 months.

Module 3 · Airdrops & phishing

Anyone can airdrop tokens/NFTs to you. Red flags: asks for your seed phrase, asks you to send crypto to verify, a countdown timer, a misspelled domain, or an unverified social account.

Module 4 · iPhone-specific risks

Enterprise-signed apps can bypass review to implant malicious code; iCloud syncs screenshots; only download wallets from the App Store and enable automatic updates.

Module 5 · Incident response

Suspect a leak? Create a new wallet → move remaining assets → stop using the old address. Have gas ready, and send a small test amount first.

Email me the full guide (PDF)

Optional. We'll send only this one PDF, use it for nothing else, and you can unsubscribe anytime.

For internal Web3 security-awareness education only. Not investment advice. This page never connects a wallet, never asks for your seed phrase or private key, and never collects wallet addresses.
Always perform security actions on your own device and through official channels; before moving assets, send a small test amount first.

Web3 & Crypto Security Awareness Survey

Take one minute to learn the key terms

Seed phrase / Private key

Self-custody wallet vs. Exchange

Blockchain

DApp & Smart contract

Token approval

Gas fees

Web2 (Banks, Big Tech)

Web3 (Wallets, DApps, on-chain assets)

How long have you held crypto assets?

Module 1: Seed Phrases & Private Keys

1.1 Private key vs. seed phrase: why the seed phrase is the “master key”

1.2 Three things you must never do on an iPhone

1.3 How to back it up correctly (offline, handwritten)

How do you mainly manage your crypto assets today?

Module 4: iPhone-Specific Risks

4.1 Configuration profiles and enterprise-signed apps

4.2 Updating your wallet app and iOS the right way

4.3 iCloud sync and the seed-phrase screenshot problem

If you've ever used a DApp or website and granted it “access to your tokens,” did you know that approval may never expire automatically?

Module 2: Approval Self-Audit

2.1 What a token approval is, and why “unlimited” is dangerous

2.2 Check approvals with revoke.cash or Etherscan Token Approval Checker (iPhone steps)

2.3 Revoking costs gas — but not revoking costs more

Which of the following have you encountered on your iPhone?

Module 3: Airdrops & Phishing

3.1 Why you should never tap surprise NFTs/tokens in your wallet

3.2 The 5 red flags of a fake airdrop

3.3 Spotting phishing sites in iPhone Safari

Which statement about “revoking a token approval” is correct?

1. Open the tool

2. Connect your wallet (read-only)

3. Find unlimited approvals

4. Revoke and confirm the gas fee

5. Make it a habit

If you had to check your wallet for a “security blind spot” right now, which is your biggest uncertainty?

Module 5: Incident Response

5.1 First step when you suspect a seed-phrase leak

5.2 How to move remaining assets with a new wallet (gas-fee notes)

5.3 Common “support” scam scripts, decoded

Congratulations — your airdrop token reward has been sent

Knowledge points you've unlocked

Module 1 · Seed phrases & private keys

Module 2 · Approval self-audit

Module 3 · Airdrops & phishing

Module 4 · iPhone-specific risks

Module 5 · Incident response

Email me the full guide (PDF)