Staying Safe: Security Practices for Stablecoin Transactions

Most losses are not exotic

Onchain transfers are final. There is no chargeback, no bank to call, and no reversal. That makes the failure modes different from card fraud: the losses that actually happen are rarely clever attacks on cryptography. They are a deposit sent on the wrong chain, an address pasted from the wrong place, or a convincing person in a direct message.

All three are avoidable with habits that take seconds.

Check the chain before you send

The most common expensive mistake, and the easiest to prevent.

• Confirm the chain in your sending wallet, not just the address. Stablecoins sent on a chain the recipient does not watch can be very hard or impossible to recover.
• Minisend accepts a broad but specific list: USDC across 19 EVM chains, USDT across 15, and both tokens on Solana. Broad is not universal. If you are sending from somewhere unusual, check the list first.
• Solana uses a different address. Solana is not an EVM chain, so it cannot share the 0x string. Sending Solana assets to your 0x address is not a recoverable mistake. Use the Solana address issued alongside it.
• Send a small amount first when you are using a new route. An order clears from 0.50 USDC, so a live test costs cents.

Verify the address, every time

• Copy, never retype. A single wrong character sends funds somewhere unrecoverable.
• Check the first and last four characters after pasting. Clipboard-hijacking malware substitutes a similar-looking address, and those first and last characters are what it cannot match.
• Scan the QR code from the app where possible. It removes the clipboard from the process entirely.

Protect the wallet you send from

• Never share a seed phrase or private key. No legitimate service asks for one. Not support, not verification, not a migration, not an airdrop.
• Use a hardware wallet for large balances. The cost is trivial against what it protects.
• Revoke stale token approvals. Contracts you approved once keep that permission until you remove it.
• Keep wallet software current. Most wallet compromises exploit something already patched.

The scams that actually circulate

• Fake support. Real support never sends the first message. If someone reaches out unprompted offering to fix a stuck transaction, that is the scam. Minisend support runs through the channels linked from the app.
• Lookalike sites. Bookmark the real URL — app.minisend.xyz — and use only the bookmark. Search-ad phishing pages rank above real sites more often than you would expect.
• Rates that are too good. A rate noticeably better than the market is bait. Minisend shows the live rate and the fee before you confirm, and applies no second spread afterwards.
• Manufactured urgency. "Your account will be frozen in ten minutes" is a pressure technique, not a policy. Nothing legitimate requires you to act before you can check.

What Minisend does on its side

Stated specifically rather than as reassurance:

• The off-ramp is non-custodial. USDC moves from your balance directly into settlement. There is no custodial lock-in, and deposit addresses behave like wallets you control.
• API keys are stored as SHA-256 hashes and compared in constant time. A key is displayed once and cannot be recovered afterwards, including by us.
• Webhooks are signed with HMAC-SHA256 over the raw request body, retried five times with exponential backoff, and logged with their delivery history.
• Rate limits are enforced atomically, not per instance, so they cannot be bypassed by spreading requests across servers. Payment prompts are capped at five per phone number per ten minutes.
• HSTS is enforced site-wide and a strict Content Security Policy is applied.
• Transactions are monitored in real time across every supported chain.
• The rate and fee are shown before confirmation. You approve a number you have already seen.

If something goes wrong

Contact support through the channel linked in the app, with your order reference. Do not accept help from anyone who contacts you first, on any platform, however plausible. If a payment debited but the order did not complete, the reference is logged and the funds are traceable.

Security is shared. Minisend builds the rails to be safe; the habits above close the gap that infrastructure cannot reach.