Security
Keep your ICP account safe
Best practices for Internet Identity, device recovery, and protecting your Yoinx wallet & prize pots.
Passkeys protect you — recovery keeps you in.
Yoinx never holds your Internet Identity credentials. Sign-in uses passkeys (device biometrics / PIN) — not a crypto wallet seed you paste into websites. Recovery is separate: backup passkeys, an optional recovery phrase from II, and/or email recovery when enabled on identity.ic0.app.
Internet Identity (not a seed wallet)
- Passkeys sign you in with Face ID, Touch ID, Windows Hello, or a security key. The private key stays on the authenticator — Yoinx never sees it.
- Add more than one passkey/device in the II manage page so one lost phone doesn't lock you out.
- Optional recovery phrase from Internet Identity is a backup authenticator (historically 24 words) — write it offline. It is not the same as an ICP ledger seed, and you should never paste it into Yoinx or any random site.
- Email recovery (when registered on II) can help from a new device via a one-time code — still treat email as phishable; pair it with passkeys.
- Bookmark identity.ic0.app and yoinx.fun. Fake II popups are a common attack.
Devices & sessions
- Add this computer to the same Internet Identity on id.ai (or iCloud Keychain). Do not create a second II. Wallet shows only the connected session.
- If a phone or laptop is lost, remove that passkey from id.ai using a device you still have.
- Don't share recovery material between people. Your connected principal owns your wallet balance and wins.
Approvals & spends
- Check entry fee, table type, and pot size before you join or create a prize table.
- Review ICRC allowances if you deposit from an external wallet. Don't approve unlimited spends to unknown principals.
- Withdrawals go to a principal you choose — double-check the destination before confirming.
Play, pots & prizes
- Practice tables don't stake real ICP the same way prize pots do — know which mode you're in.
- Tools, coupons, and avatar purchases spend from your Yoinx balances — confirm amounts in Wallet before buying.
- Claim wins and shipping details only through official Yoinx flows or Support. We will never ask for your II recovery phrase.
- Report stuck tables or suspicious prompts via Support.
Backup checklist
- At least two passkeys / devices on your II.
- Recovery phrase (if you created one) written offline in two places — never in screenshots or chat.
- Email recovery registered only if you control that inbox.
- Know which principal holds your Yoinx wallet and unclaimed wins.
- Keep yoinx.fun bookmarked — phishing clones are common around play-to-earn.
Recovery lives with you
If you lose every passkey and every recovery method, neither Yoinx nor DFINITY support can “reset” your identity. Plan backups before you need them.
Quick guards
Never paste II recovery into apps
Register a second passkey
Email recovery only on identity.ic0.app
Double-check entry fees & withdrawals
Know practice vs prize-pot tables
Only withdraw to principals you control
Bookmark yoinx.fun + identity.ic0.app
Slap hard — but back up harder.