Keep Your Crypto Safe
Self-custody puts you in charge, and that turns out to be simple: a few habits cover almost everything. Here they are, along with the scams you'll actually meet, what THAT will never ask you for, and what to do if something goes wrong.
The rules
Four Rules That Keep You Safe
Learn them once. Everything else on this page is a variation on one of these.
Nobody genuine asks for your recovery phrase.
Not THAT, not support, not an app, not someone in your messages. Anyone who asks is trying to take your crypto.
Paper, not screenshots.
Photos sync to the cloud on their own. Write the words on paper and keep it somewhere only you can reach.
“You’ve been hacked” messages are the scam.
A text or email saying your wallet is compromised exists to get your recovery phrase. Don’t tap the link. Open the THAT app directly.
Lock your wallet with Face ID or a PIN.
It’s off by default. Switch it on in Settings → Security, so only you can open your wallet or approve a payment.
From us
What THAT Will Never Do
If a message claiming to be from THAT does any of these, it isn't from THAT. The only way to reach us is through this website.
Ask for your recovery phrase or private key, in any form, for any reason.
Ask you to send crypto anywhere to “verify”, “unlock” or “activate” your wallet.
Send you a link to “secure”, “re-verify” or “sync” your wallet.
Offer to recover lost funds for a fee. Nobody can, including us.
Need us? Contact THAT — never through a chat, a reply or a message that found you first.
How people lose crypto
The Scams You'll Actually Meet
Most are easy to spot once you've seen them once. Every one of them needs you to do something: share your phrase, tap a link, or send money first.
Fake support
- How it arrives
- You post a question somewhere public, and “support” messages you first — on Telegram, X, Instagram or by email — offering to help.
- The tell
- They ask for your recovery phrase, ask you to “validate” your wallet on a website, or want to screen-share.
- Instead
- Real support never messages first and never needs your phrase. Ignore them, and reach us only through this website.
“Your wallet has been compromised”
- How it arrives
- A text, email or pop-up says your wallet is at risk and gives you a link to “secure” it.
- The tell
- The link leads to a page that asks for your recovery phrase — the one thing a genuine page never needs.
- Instead
- Don’t tap it. Open the THAT app directly. If your wallet works and your balance is there, nothing was wrong.
Lookalike websites
- How it arrives
- A search ad or a shared link leads to a page that looks like a wallet, a bridge or a swap, with a slightly different address.
- The tell
- It asks you to “import”, “connect” or “sync” your wallet by typing your recovery phrase.
- Instead
- Your phrase is typed exactly once: into the THAT app, when you restore a wallet on a new phone. Never into a website.
Giveaways and doubling
- How it arrives
- A post, livestream or message promises to double whatever you send, or to airdrop tokens once you “confirm” with a small payment.
- The tell
- Money has to leave your wallet first. No genuine giveaway works that way.
- Instead
- Nothing you send comes back. Close it.
Address poisoning
- How it arrives
- Someone sends a tiny, worthless amount to your wallet from an address made to look like one you use, so it appears in your history.
- The tell
- Copying an address from your transaction history instead of from the person or business you’re paying.
- Instead
- Pay businesses by scanning their QR code in the app, and take addresses from the recipient directly. Check the first and last few characters before you confirm.
“Guaranteed” returns
- How it arrives
- Someone you met online — a new friend, a trading mentor, a romance — introduces you to a platform with steady, guaranteed profits.
- The tell
- Deposits are easy and withdrawals need a fee, a tax, or “one more” payment first.
- Instead
- No genuine investment is guaranteed, and no genuine platform charges you to withdraw your own money. Stop sending, and report it.
If something has gone wrong
What to Do, in Order
Nobody can reverse a crypto transaction, so the goal is to protect what's left and stop the next one.
If your recovery phrase may have been seen
Treat the wallet as compromised. In the THAT app, create a new wallet (Wallet, then Create a New Wallet), back it up on paper, and send everything from the old wallet to the new one now. Then stop using the old one.
If you sent crypto to the wrong place
Transactions can't be reversed by anyone, including THAT. If you paid a business, contact them directly: they can send it back. If it went to a scammer, the money is gone, and the useful thing now is to report it so the next person is warned.
If you paid from a bank account or card
Call your bank straight away and ask them to stop or trace the payment. Speed matters here.
Report it
Scamwatch (the ACCC) for any scam, and ReportCyber if money or crypto was taken. IDCARE gives free support if your identity may be at risk. And tell us, so we can warn others.
Staying Safe — Questions
Someone from “THAT support” messaged me. Is it real?+
No. THAT doesn't message people first, doesn't run support in Telegram, X or Instagram chats, and never asks for your recovery phrase. Anyone who says they're from THAT and asks for it is trying to steal your crypto. Don't reply; block and report them. If you need us, use the contact page on this website.
I typed my recovery phrase into a website. What now?+
Treat the wallet as compromised, even if nothing has happened yet. In the THAT app, create a new wallet (Wallet tab, then Create a New Wallet), back it up on paper, and send everything from the old wallet to the new one straight away. Then stop using the old wallet for good.
Can THAT freeze, recover or reset my wallet?+
No. Your recovery phrase is created on your phone and never sent to us, so we can't see it, reset it, freeze your wallet or move your funds. That is what keeps your crypto yours. It also means your paper backup is the only way back in if your phone is lost.
Is my wallet address safe to share?+
Yes. Your wallet address (it starts with 0x) is how people send you crypto, like an account number, and it can't be used to take anything. Your recovery phrase is the opposite: it is the key to everything in the wallet, and it is never shared with anyone.
Is THAT a hot wallet?+
Yes, in the usual sense: it's a software wallet on a phone that is online, which is what makes it useful for paying in the real world. Your keys are created on your phone, stored encrypted and device-bound, and never leave it; switching on Face ID / PIN adds a second lock. For large amounts you intend to hold for years, a hardware wallet kept offline is the more conservative choice.
I've been scammed. Who do I tell?+
Report it to Scamwatch (scamwatch.gov.au) and, if money or crypto was taken, to ReportCyber at cyber.gov.au. If you paid from a bank account or card, call your bank now. IDCARE (idcare.org) offers free support if your identity may be at risk. And tell us through the contact page, so we can warn others. Crypto transactions can't be reversed, so reporting is about stopping the scammer, not getting the funds back.
Set Up Right, Once
The guide walks you through creating your THAT wallet, backing it up on paper and locking it with Face ID, in about ten minutes.