A DeFi Safety Checklist

Most DeFi losses at the individual level don't come from exotic protocol failures — they come from operational mistakes: signing a malicious transaction on a fake site, leaving old token approvals open, or not noticing a position drifting toward liquidation. The fix is not more knowledge but more routine. This guide is that routine: what to check before you connect, before you sign, while a position is open, and on a regular maintenance schedule.

Before You Touch a Protocol: Vetting

Ten minutes of checking before your first deposit filters out most disasters.

Verify you're on the real site. Phishing clones of DeFi front-ends are the single most common way individuals lose funds — attackers buy search ads, register lookalike domains, and hijack project Discord and X accounts to post fake links. Get the URL once from two independent sources (the project's documented domain and a tracker like DefiLlama), then bookmark it and only ever enter through the bookmark. Never through search results, never through a link in a DM, chat, or "support" reply.
Check scale and age. On an aggregator, look at the protocol's TVL and how long it has operated. Nothing magical happens at any threshold, but a contract that has held nine figures for two years has survived real attack pressure; a week-old fork has not. Size your exposure to that difference.
Look for audits and a bug bounty — then discount them. Multiple audits from known firms and a live bug bounty are table stakes for serious protocols. Their absence is disqualifying; their presence is not proof of safety.
Identify the admin keys. Skim the docs for who can upgrade contracts and whether upgrades sit behind a timelock. A protocol whose team multisig can change the rules instantly requires more trust than one with a 48-hour delay and a public governance process.
Understand the yield before you chase it. If you can't explain in one sentence who is paying the yield and why, you haven't finished vetting. Outsized APY is a risk signal, not a bargain.

Before Every Signature: Approvals and Transaction Hygiene

Everything in DeFi happens through transactions you sign, which makes the signing moment your last line of defense.

Read what the wallet actually shows. Modern wallets simulate transactions and display what will leave your wallet and what will arrive. Slow down and read it. A swap should show tokens out and tokens in; if a "claim reward" interaction shows your NFTs or tokens leaving, stop.
Treat token approvals as standing risk. Before a contract can move your tokens, you grant it an approval. Interfaces historically requested unlimited approvals for convenience — meaning that contract (or whoever exploits it later) can move your entire balance of that token, forever, until you revoke. Prefer wallets and interfaces that let you set an exact approval amount, and use it for anything beyond routine interactions with major protocols.
Beware off-chain signatures too. Not every dangerous signature is a transaction. Signature-based approvals and order signatures (the mechanism behind many wallet-drainer kits) cost no gas and can authorize transfers later. A site asking you to sign something you don't understand — especially long hexadecimal or structured data with someone else's address as the spender or operator — is a stop-and-research moment.
Send a test transaction for new routes. First time bridging somewhere, first withdrawal to a new address, first interaction with a new protocol: send a small amount, confirm it arrives and behaves, then send the rest. The extra fee is the cheapest insurance in crypto.
Segment your wallets. Keep a hot wallet with limited funds for active DeFi and experimentation, and a separate cold wallet — ideally hardware-backed — that holds long-term assets and never connects to random dApps. A drained hot wallet should be an annoyance, not a catastrophe. (Wallet setup itself is covered in depth in the security path.)

While Positions Are Open: Monitoring

DeFi positions are not savings accounts; they change state while you sleep.

Know your liquidation math. If you've borrowed, write down your liquidation price and health factor, and set the alert before you need it. Portfolio trackers (DeBank, Zapper, and protocol-native dashboards) show health factors; several services can push alerts when a health factor drops below a threshold you choose. A realistic buffer matters: a position that liquidates on a 25% price drop is not conservative in a market that regularly does that in a day.
Watch pegs you depend on. If your position holds, borrows, or LPs a stablecoin, liquid staking token, or wrapped asset, a depeg changes your risk instantly. A quick glance at the peg is part of checking the position.
Follow the protocol's announcement channel. Exploits, pause events, migration notices, and governance proposals that affect your position appear there first. For anything holding a meaningful share of your funds, this is monitoring, not fandom. Governance timelocks only protect users who are watching.
Recheck yield reality monthly. Emissions taper, incentives end, pool composition shifts. The position you entered at 12% APY may now pay 3% while carrying the same risk — at which point the trade you made no longer exists and deserves a fresh decision.

The Recurring Maintenance Routine

Put an actual recurring reminder in your calendar; memory is not a system.

Monthly (15-30 minutes):

Review and revoke approvals. Use a reputable approval-management tool — Revoke.cash is the widely used standard, and Etherscan offers a token-approval checker — to list every contract still authorized to move your tokens, on every chain you use. Revoke anything you're not actively using, unlimited approvals to protocols you tried once, and everything granted to contracts you don't recognize. Each revocation costs a small gas fee; on L2s this is pennies.
Inventory positions. List every protocol currently holding your funds, on every chain. Positions you forgot about are unmonitored risk — orphaned LP positions and dust deposits accumulate surprisingly fast.
Check position health. Health factors, peg status, current real yield versus what you signed up for.

Quarterly:

Prune. Exit positions too small to monitor profitably, consolidate dust, close accounts on protocols you've stopped using.
Re-vet your largest exposures. Has the protocol's TVL collapsed? Team departed? Admin keys changed? Audit findings published? The vetting you did at entry decays.
Rehearse recovery. Confirm your seed phrase backups are where they should be and that you can actually restore access — before an emergency tests it for you.

When Something Goes Wrong

Decide the playbook before you're panicking.

If a protocol you use is exploited: withdraw what's withdrawable if the exploit is ongoing, revoke your approvals to the affected contracts immediately, and rely on the protocol's official channel — not Discord DMs — for next steps. Anyone who DMs you offering recovery help is a second scammer; that pattern is near-universal.
If you signed something malicious: move remaining assets from that wallet to a clean one immediately, starting with the most valuable and most liquid. Then revoke approvals from the compromised wallet. Assume the wallet is permanently burned.
Accept the limits of recovery. On-chain transfers are final. Realistic post-incident actions are containment and reporting — there is no support line that reverses transactions, and any service claiming otherwise is a scam.

Key Takeaways

Individual DeFi losses are mostly operational — phishing, stale approvals, unwatched positions — so a routine protects you more than any single piece of knowledge.
Enter protocols only through bookmarks, vet scale, age, audits, and admin keys before depositing, and be able to say who pays the yield.
Read every signature, prefer exact over unlimited approvals, test new routes with small amounts, and keep experimental funds in a wallet whose loss you can shrug off.
Open positions need active monitoring: liquidation alerts, peg checks, and the protocol's announcement channel.
Run a monthly approval-revocation and position-inventory routine, and decide your incident playbook before you need it — after the exploit is too late to plan.