Security and official channels

Our official channels

Any official social media accounts are linked from the footer of hodlchip.com; an account that is not linked there is not ours. We never use social media or chat apps for support or payments.

How to verify a payment page

Run through these checks every time, before you send anything:

1. Check the domain. The address bar must show exactly hodlchip.com as the domain, over a secure https connection. Look-alikes such as hodlchip.com.example.net or hodlchip-pay.com are fake. If you arrived from a link in an email or message, type hodlchip.com/track-order yourself and open your order from there instead.
2. Check what you are paying with. The coin and network on the page must be the ones you chose at checkout.
3. Check the page. A genuine payment page shows the exact amount to send, a deposit address, a QR code and a countdown, and updates on its own once your payment confirms.
4. Check the address format. Bitcoin addresses start with bc1, 1 or 3; ETH and USDT-ERC20 addresses with 0x; USDT-TRC20 addresses with T.
5. Check that the address is new. Every order gets its own address. Never pay an address from an earlier order, an expired payment or a message.
6. Check after pasting. Compare the first and last characters of the address in your wallet with the payment page. Clipboard malware can replace a copied address with another one.

What our staff never ask for

• Your seed phrase or recovery phrase, or any part of it
• Your private keys, wallet files, PIN or passwords
• Remote access to your computer or phone, through any screen-sharing or remote-control software
• A payment to any address that is not shown on a payment page at hodlchip.com
• That you connect your wallet to a website or "verify" it
• Card or bank details, which we do not accept

What we may ask for, and what is safe to share: your order number, the email address used for the order, transaction IDs, photos of a product or parcel, serial numbers, and a refund address of your choice.

How we protect you

• hodlchip.com is served only over encrypted https connections.
• Each order gets a fresh deposit address, used for that order only.
• Customer accounts are optional. Passwords are stored only as Argon2id hashes, sign-in can require a code from an authenticator app, and we send no sign-in or reset links to phish: a forgotten password is handled by our support team once the request is checked. See Your account: sign-in, security and access.
• We keep only the data needed to deliver your order, with no tracking cookies, analytics trackers or advertising pixels.

Report phishing or a security issue

1. Email support@hodlchip.com with the subject Phishing.
2. Include the web address or sender address, screenshots, and when and where you saw it. If you can, forward suspicious emails as an attachment, which keeps the technical headers intact.
3. Do not interact any further with the sender or the website.

Reports of security vulnerabilities on hodlchip.com go to the same address. If your report contains sensitive details, ask for encrypted email first, as described below.

Encrypted email (PGP)

Encrypted email is available on request. We have not published a PGP key yet, so if you need to send us something sensitive, such as details of a security issue, first write to support@hodlchip.com and ask for encrypted email; we will arrange it with you by reply.

Because we do not publish a key, a key presented as HodlChip's on a key server or a third-party website is not ours. And never send a seed phrase or private key, even encrypted: we never need them.