How We Protect Your Wallet Session

Before you connect or deposit

• Type boof.gg yourself or use a bookmark you created after checking the domain.
• Treat look-alike domains, sponsored results, shortened links, giveaways, and unsolicited direct messages as higher risk.
• Use a separate wallet appropriate for this activity, and do not deposit more than you can afford to lose.
• Install your wallet extension or app only from its official publisher.
• Do not deposit until our operator identity, eligibility rules, custody terms, privacy terms, and support route are clear enough for your situation.

Connecting is different from depositing

When you sign a plain message, we can use it to authenticate your BOOF session without moving an asset. When you approve a deposit transaction, you transfer an asset to our treasury and we credit a custodial account balance.

After a deposit, the asset is no longer controlled solely by your external wallet. You depend on our ledger, treasury security, and withdrawal process to receive it back.

We process Poker buy-ins, bets, and standing through your existing custodial balance. Cancel and investigate an unexpected wallet transaction request during a table action.

Read every request before you sign

A message signature and a transaction signature do different things. Before approving a transaction, check the domain, network, destination, asset, amount, fee, and program interactions. Cancel any prompt you did not start or cannot explain.

A familiar logo, green check, simulation, or person claiming to represent BOOF is not enough. If your wallet cannot explain the instructions, do not sign them.

We will never ask for your wallet secrets

• We will never ask for your recovery phrase or seed phrase.
• We will never ask for your private key.
• We will never ask for a remote-screen session that exposes wallet secrets.
• We will never ask you to send funds to validate, synchronize, or unlock a custodial balance.
• We will never ask you to sign an unrelated transaction to resolve an issue.

Connections, approvals, and addresses

Disconnecting your wallet stops BOOF from requesting new signatures through that connection. It does not invalidate a signed BOOF session already stored in your browser; that session can remain valid until it expires. On a shared or untrusted browser, clear boof.gg site data as well. Disconnecting also does not necessarily revoke token approvals or undo a transaction you already signed. Review connected apps and permissions with independently trusted tools.

A blockchain transfer can be irreversible. Verify the full address, network, asset, and mint, not only the first and last characters. Read our current treasury address from the BOOF deposit screen immediately before a deposit.

If you suspect a compromise

• Stop signing and disconnect the affected device from suspicious sites.
• From a trusted device, create a fresh wallet with official software if your secrets may be exposed.
• Move remaining self-custodied assets only after independently checking the destination and transaction.
• Review recent transactions and permissions. Preserve addresses, signatures, screenshots, and times.
• Report impersonation through official wallet-provider and BOOF channels published on their official domains.
• Treat a revealed recovery phrase or private key as permanently compromised.

What these precautions cannot guarantee

Hardware wallets, separate wallets, simulation, allowlists, and address checks can reduce specific risks. They cannot remove malware, deception, custody, operational, legal, smart-contract, network, or user-error risk. A successful withdrawal does not guarantee that a later request will succeed or arrive on the same timeline.

We have not yet published a verified public support route on boof.gg. Do not rely on direct messages claiming to provide BOOF support.