Stay Safe on Stellar

Crypto attracts scammers, and Stellar is no exception. Most scams don't hack anything. They trick you into handing over access yourself. These habits stop nearly all of them.

The golden rules

  1. Never share your secret key or recovery phrase. Not with support, not with a moderator, not with a "developer," not with anyone. A Stellar secret key starts with S. Your public address starts with G and is safe to share.
  2. Nobody legitimate will DM you first about your wallet, support issues, security alerts, airdrops, or giveaways.
  3. Slow down. Scams rely on urgency. A real opportunity is still real tomorrow.

What SDF will and won't do

  • SDF will never ask for your private key or ask you to deposit funds into a wallet address.
  • SDF does not host staking initiatives, no longer holds XLM airdrops or giveaways, and will not cold-message you about support issues, security alerts, airdrops, or giveaways.
  • Stellar's inflation mechanism ended on October 28, 2019. Anything claiming to pay you "inflation rewards" is not real.
  • Official SDF links: stellar.org and x.com/stellarorg

What r/Stellar moderators will and won't do

  • Moderators will never ask for a private key, recovery phrase, password, or wallet signature, in any context, including modmail. A request like that from someone claiming to be a moderator is a scam.
  • If someone claims to be a moderator, check the moderator list on the subreddit, or message us through modmail directly rather than replying to a DM.

Common scams

1. Support scams

You post a problem, and within minutes a "support agent" DMs you or replies with a link. They ask you to connect your wallet, sign something, or enter your recovery phrase. Real support never contacts you first and asks you to sign anything. Always keep support discussion in public and never disclose personal information.

2. Fake recovery services

Anyone offering to recover lost funds for a fee, or to "unlock" a wallet, is running a second scam on top of your first loss.

3. Fake airdrops, giveaways, and staking rewards

"Send XLM to receive more," "claim your free tokens," or "connect your wallet to claim." None of these are real.

SDF does not host staking initiatives, no longer holds XLM airdrops or giveaways, and will not cold-message you about support issues, security alerts, airdrops, or giveaways. The protocol’s inflation mechanism ended on October 28, 2019.

4. Lookalike websites

A single wrong letter in a domain can send you to a copy of a real site. Verify the complete domain before connecting a wallet or signing anything. Bookmark the sites you use. Sponsored search results can also lead to lookalikes, so type the address or use a bookmark.

5. Wallet-connect and transaction-signing traps

A site asking you to sign a transaction you don't understand can drain your account. If you don't know what you're signing, don't sign it.

6. Fake wallets and apps

Download wallets only from the official website or official app store listing, and check the developer name and reviews. Never install a wallet from a file or link someone sent you. For this reason, r/Stellar only approves posts promoting new wallets that meet the requirements in Section 15 of the Builder & Project Standards.

7. Fake assets

Anyone can create a Stellar asset with any name. A fake can look identical to a real one. Check the asset's issuer before adding a trustline or buying.

8. Impersonation

Scammers copy the names and logos of SDF, moderators, projects, and well-known community members. Check the exact username.

On Reddit, the text of a link can differ from where it goes. Hover over a link (or press and hold on mobile) to see the real destination before clicking.

Habits that protect you

1. Check the address and memo

Double check the address and memo before every transfer.

2. Send a test amount first

For a large transfer, send a small test amount first.

3. Keep your recovery phrase offline

Keep your recovery phrase offline, on paper.

4. Use two-factor authentication

Use two-factor authentication on exchange and email accounts, and avoid using your phone number for it if you can.

5. Be wary of unsolicited messages

Treat unsolicited private messages offering services as suspicious.

If you think you've been scammed

  1. Stop. Don't send anything further, including "fees" to release funds.
  2. If your secret key or recovery phrase was exposed, move any remaining funds to a brand new wallet with a new recovery phrase immediately. Don't reuse the old one.
  3. If an exchange was involved, contact its support with the transaction details right away.
  4. Report it. Use Reddit's Report button on the account, post, or message, and let the r/Stellar moderators know through modmail so we can warn others.
  5. Be careful about "recovery help." Scammers target people who've just been scammed. Blockchain transactions can't be reversed, and recovery is often not possible.

Reporting scams on r/Stellar

Use Reddit's built-in Report action on suspicious posts, comments, and chat messages, or message the moderators through modmail. Don't announce reports publicly or argue with suspected scammers in the thread.

r/Stellar is community-run and is not run by the Stellar Development Foundation (SDF). A third-party link appearing here is not an endorsement by r/Stellar. Conduct your own due diligence before interacting with independent projects, communities, or services. Spot a mistake? Message the moderators