Wallet Safety for BOOF Players

Before you connect or deposit

• Type boof.gg yourself or use a bookmark created after checking the domain.
• Treat look-alike domains, sponsored results, shortened links, giveaways, and unsolicited direct messages as higher risk.
• Use a separate wallet appropriate for the activity and avoid depositing more value than you can afford to lose.
• Confirm the wallet extension or app came from its official publisher.
• Do not deposit until legal eligibility, operator identity, custody terms, privacy terms, and support escalation are clear enough for your situation.

Connection and custody are different

A message signature can establish a BOOF session without moving assets. A deposit transaction transfers an asset to a BOOF treasury and creates a custodial account balance. Once deposited, the asset is no longer controlled solely by your external wallet; return depends on BOOF’s ledger, treasury, security, and withdrawal process.

Joining, betting, and standing at a Poker table should operate on the existing custodial balance without a new on-chain transaction for each action. Stop if a table action produces an unexpected wallet transaction request.

Read every signature request

A plain message signature and a transaction signature are different. Before approving a transaction, read the domain, network, destination, asset, amount, fee, and program interactions. Cancel any prompt you did not initiate or cannot explain.

Do not rely on a familiar logo, a green check, simulation alone, or a person claiming to be support. If a wallet cannot explain the instructions, blind signing carries material risk.

What legitimate support will never need

• Your recovery phrase or seed phrase.
• Your private key.
• A remote-screen session that exposes wallet secrets.
• A transfer to “validate,” “synchronize,” or “unlock” a custodial balance.
• A signature for a transaction unrelated to the issue you opened.

Connections, approvals, and address checks

Disconnecting a site blocks future interaction through that connection, but it does not necessarily revoke token approvals or undo signed transactions. Review connected apps and permissions with independently trusted tools.

Blockchain transfers can be irreversible. Verify the full address, network, asset, and mint—not only the first and last characters. Read the current treasury address from the official cashier immediately before a deposit.

After a suspected compromise

• Stop signing and disconnect the affected device from suspicious sites.
• From a trusted device, create a fresh wallet using official software if secrets may be exposed.
• Move remaining self-custodied assets only after independently checking the destination and transaction.
• Review recent transactions and permissions; preserve addresses, signatures, screenshots, and times.
• Report impersonation through official wallet-provider and platform channels.
• Assume a revealed recovery phrase or private key can no longer be made secret.

Security has limits

Hardware wallets, separate wallets, simulation, allowlists, and address checks can reduce specific risks, but none removes malware, deception, custody, operational, legal, smart-contract, network, or user-error risk. A successful withdrawal in the past is not a promise that a later request will succeed or arrive on the same timeline.