How to Use a DEX Safely: 7 Rules for Self-Custody Trading

Disclosure: This article is information and opinion, not financial advice. See our full disclaimer.

One in five crypto trades now happens on a decentralized exchange. The DEX share of spot volume hit an all-time high above 21% late last year, and Europe’s MiCA shakeout just pushed a fresh wave of people on-chain, many for the first time, chasing the assets their regulated venues delisted.

Here’s what nobody tells that wave: a DEX gives you total control and zero customer support. There’s no “contact us”, no chargeback, no compliance officer to email. Every mistake is final, and the scam economy around DEXs is built specifically to farm newcomers making their first swap.

The good news: the entire danger surface comes down to seven habits. I’ve made a couple of these mistakes myself with small money, which is the only tuition worth paying. Learn them here instead.

The short version

A DEX lets you trade straight from your own wallet with no account and no custodian. Stay safe by bookmarking the real site, verifying every token’s contract address, approving only what you’re spending, reading before you sign, setting slippage manually, double-checking full addresses, and trading from a small hot wallet while your holdings live in cold storage. Nothing on a DEX can be undone.

What you’re actually doing on a DEX

On Uniswap, PancakeSwap, Aerodrome, Raydium, or any of the thousand-plus venues tracked today, there’s no company holding your coins. Your wallet talks directly to a smart contract, the swap executes on-chain, and the assets never leave your custody until the moment of trade.

That removes the entire category of risk this site usually covers: no exchange to freeze withdrawals, no FTX-style balance-sheet surprise. In exchange, you inherit every risk personally: the wrong website, the wrong token, the wrong signature. Different risks, not fewer. Respect the trade.

Rule 1: Bookmark the real site, arrive only by bookmark

Fake DEX frontends are the oldest trick on-chain: lookalike domains, poisoned search ads, even hijacked DNS on real projects. The page looks identical because it’s a clone of the real interface with one change, where your money goes.

Verify the URL once, character by character, from the project’s official channels. Bookmark it. Arrive by bookmark forever, never by search ad, never by a link someone sent you. This one habit deletes the most common attack outright.

Rule 2: Verify the token contract, not the ticker

Anyone can create a token named anything. Every popular ticker has dozens of counterfeits sitting in DEX search results, plus honeypots: tokens coded so you can buy but never sell.

The only identity a token has is its contract address. Copy it from the project’s official site or its CoinGecko/CoinMarketCap listing, paste it into the DEX, and confirm the interface shows the same address before swapping. Ticker plus logo means nothing. Address means everything.

Rule 3: Approve only what you’re spending

Before a DEX can swap your token, you grant its contract an approval, and interfaces historically default to unlimited. An unlimited approval to a malicious or later-exploited contract means everything of that token in your wallet can be drained, today or in two years.

Set approvals to the exact amount when the wallet offers it. And run an occasional cleanup at revoke.cash, which shows every approval your wallet has ever granted and lets you cancel the stale ones. Ten minutes a quarter, and old permissions stop being a time bomb.

Rule 4: Read before you sign, especially “free” signatures

The modern drainer doesn’t ask for a transaction. It asks for a signature: a gasless message (often abusing permit-style approvals) that feels harmless because nothing leaves your wallet when you sign. The theft comes minutes later, executed with the permission you just gave.

The rule: a signature request appearing when you expected a simple action, or from a site you just clicked into for a “claim” or an “airdrop”, is a stop sign. If you can’t say what a signature does, decline it. Legitimate protocols survive your caution. Drainers don’t.

Rule 5: Set slippage yourself, and mind the depth

Slippage tolerance is how far the price may move against you before your trade reverts. Left high, it’s an open invitation to sandwich bots that front-run your swap and pocket the difference. For major pairs, 0.1% to 0.5% is plenty; if a trade only executes at 5%+ slippage, the pool is telling you its liquidity can’t handle your size.

Check the price impact readout before confirming, and for thin tokens, split large swaps or use an aggregator that routes across venues. The mechanics of pool depth are the same ones behind impermanent loss: shallow water, bigger waves.

Rule 6: Check the full address, every time

Address poisoning is uncomfortably clever: scammers send dust from addresses crafted to match the first and last characters of ones you’ve used, betting you’ll copy the wrong entry from your history. First-and-last-four verification, the habit everyone has, is exactly what it exploits.

Verify more of the address than feels necessary, use your wallet’s address book for repeat destinations, and send a test amount before any large transfer. Related habit: ignore mystery tokens that appear in your wallet. Interacting with scam airdrops is how several of the traps above get sprung.

Rule 7: Trade from a hot wallet, live from a cold one

The structural rule that caps every other mistake: keep a small hot wallet for DEX activity, funded with only what you’re actively trading, while long-term holdings sit in a hardware wallet that never touches a DEX frontend.

Then even a worst case (a malicious signature, a drained approval, a poisoned address) costs you the trading float, not the stack. Sizing the blast radius in advance is the same logic as position sizing: decide what a mistake may cost before making one.

FAQ

Are DEXs safe to use?

The leading DEX contracts have processed trillions in volume and are among the most battle-tested code in crypto. The practical risk sits almost entirely at the user layer: fake frontends, counterfeit tokens, malicious approvals, and phishing signatures. The seven habits above address the user layer, which is the one you control.

Do decentralized exchanges have KYC?

Generally no: you connect a wallet and trade, with no account or identity check, since no custodian ever holds your funds. That’s also why there’s no support desk and no recourse. Your local tax obligations still apply to on-chain trades exactly as they do elsewhere.

What is a token approval and why does it matter?

An approval is on-chain permission for a contract to move a token from your wallet, required before any DEX can swap it. Unlimited approvals to a malicious or later-exploited contract can drain your entire balance of that token, which is why capping amounts and periodically revoking old approvals matters.

Is a DEX safer than a centralized exchange?

Different, not simply safer. A DEX removes custodial risk (no company can freeze or lose your funds) but hands you personal responsibility for every click and signature, plus smart contract risk. A licensed centralized exchange offers recourse and simplicity at the cost of trusting a custodian. Many experienced users deliberately use both for different jobs.

Why did my DEX trade fail but still cost gas?

On most chains, a reverted transaction still consumed computation, so the network fee is spent even though the swap didn’t execute. Common causes: slippage tolerance set below the market’s movement, insufficient gas limits, or racing a fast-moving pool. Adjust and retry; the failed trade didn’t move your tokens.