Crypto Security FAQ — Custody, Losses, and What Actually Protects You

Can stolen or mistakenly sent crypto be recovered?

Generally no. Blockchain transactions are irreversible by design — there is no intermediary with authority to reverse them, no chargeback, and no fraud department.

Narrow exceptions exist: funds sent to an exchange-controlled address may sometimes be recoverable through that exchange's support, and some tokens have privileged functions an issuer could theoretically use. Neither applies to an ordinary self-custody transfer.

Treat anyone offering paid recovery of on-chain funds as running a second fraud. That approach specifically targets people who have just lost money.

Is self-custody safer than keeping funds on an exchange?

Neither is universally safer. They relocate risk.

Self-custody removes counterparty risk — no operator can be hacked, become insolvent, or freeze your account. You take on key-management risk instead, with no password reset and no recovery.

Exchange custody provides account recovery and support, and makes you a creditor of the operator.

The right answer depends on the amount, your operational discipline, and what you are doing. Many people reasonably use both: exchange balances for active trading, self-custody for holdings.

What matters is knowing which model each holding is in, and not assuming protections carry across. Exchange 2FA does nothing for a self-custody wallet.

What actually causes most crypto losses?

In rough order:

Authorisation mistakes — a malicious token approval, or signing a transaction without reading it. No key theft involved; permission was granted.
Social engineering — fake support, impersonated staff, urgent opportunities, recovery fraud.
Key handling — a seed phrase stored somewhere convenient and later accessed, or lost with no backup.
Wrong destination — right amount, wrong address or wrong network.

Broken cryptography does not feature. Defensive effort belongs where the losses actually occur.

Does two-factor authentication protect my crypto?

It protects your exchange account, not your crypto generally.

2FA closes the stolen-password path. It does nothing about a self-custody wallet, a malicious on-chain approval, or malware on the device you log in from. Real-time phishing can also relay a code to the real site as you type it — the gap that passkeys close, since a passkey is bound to the domain and cannot be handed to a lookalike.

Enable it. Do not mistake it for complete protection.

Will CoinDock ever ask for my seed phrase?

No. Never, under any circumstances.

No legitimate service has any use for it. A seed phrase grants complete control of a wallet, so anyone asking for it — support, an administrator, a verification tool, a migration process — is attempting theft. There are no exceptions and no legitimate scenarios.

CoinDock will also never contact you first requesting a payment, an approval, or a credential; never send an invoice as an address in a message (invoices appear in your authenticated account); and never guarantee a price or return.

Is an audited token safe?

An audit is evidence that competent people looked, and a record of what they found. It is not a guarantee.

Audited contracts have been exploited. More importantly, an audit cannot prevent liquidity removal or supply dumping, because neither is a code defect — a contract can be flawless while the project rugs.

When reading one, check which version was audited, whether it is the deployed one, whether findings were resolved, and who performed it. "Audited" with no auditor named is not evidence.

Does renounced ownership mean a token is safe?

Not by itself. Renouncing Ownable does not necessarily remove other privileged roles — a contract can retain separate admin, minter, or pauser roles that survive renunciation.

Check the roles that actually exist rather than accepting the headline claim. See how to verify a smart contract.

Renunciation also cuts both ways: it removes the owner's ability to fix a bug or pause during an exploit.

How do I check a token before buying it?

Roughly ten minutes of work: get the contract address from a source the project controls, confirm source code is verified, check privileged functions and who controls them, look at holder concentration, confirm any claimed liquidity lock on-chain, and measure bid-side depth so you know you could sell.

Unverified source on an unfamiliar token is sufficient reason to decline.

What is the single most effective thing I can do?

Two things, both structural — they work without requiring you to correctly identify threats:

Separate wallets by purpose. A vault that never touches contracts, a trading wallet, and a burner for anything unfamiliar. Your most likely mistake then costs you a burner.
Always initiate contact yourself. Type domains; never follow links or respond to approaches. This defeats fake support, phishing, listing fraud, and recovery fraud simultaneously.

Crypto Security — Frequently Asked Questions