> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-wallet/protecting-tokens.md).

# Protecting Your Tokens

Making sure you don't lose tokens in different instances

## **Never use these addresses to receive tokens**

This is Hinkal’s **smart contract address:** `0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4`

These are Hinkal’s **relayer addresses:** `0xE6bDF21Ecd55358aF595D3f5Eea912A8e82ECA5e`, `0xB8D5E90d8Baf0650e5b9D6bb988c6dd206F4BaaD`

* It’s a contract that holds ***everyone’s*** private funds.
* If tokens are sent there with a regular on-chain transfer, the relayer (which handles all transactions going in and out of the smart contract) will **not be able to identify the recipient, resulting in lost funds.**
* Hinkal cannot reverse these transactions and is **not liable for lost funds**.
* Anything you copy from a Blockchain scanner, a 3rd party dApp console, or elsewhere places you at risk of losing tokens.

### Only use addresses from inside Hinkal

Always receive funds using:

1. **Private Account** → Receive\
   QR Code / Copy Address / Private Payment Link

<figure><img src="https://400260740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUoGzqKrjqkoPsx76Zeb7%2Fuploads%2Fgit-blob-fa78399f8b48b246b647a61ecc14484dc0f95725%2FReceive%20-%20Private.png?alt=media" alt=""><figcaption></figcaption></figure>

2. **Public Account → Receive**\
   Copy Address

<figure><img src="https://400260740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUoGzqKrjqkoPsx76Zeb7%2Fuploads%2Fgit-blob-da9f4f3a42cdafa5ab6d9987ffdebcd0b6795d8e%2Fpublicreceive.png?alt=media" alt="" width="348"><figcaption></figcaption></figure>

You can switch between accounts in the Receive screen:

<figure><img src="https://400260740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUoGzqKrjqkoPsx76Zeb7%2Fuploads%2Fgit-blob-9ef043b6571da9d4a74c628ec07f0e04f7a28d38%2Fswitchreceive.png?alt=media" alt="" width="349"><figcaption></figcaption></figure>

### Scenario 1: On-ramp **with wallet connection**

<table><thead><tr><th width="354">WRONG</th><th width="347">CORRECT</th></tr></thead><tbody><tr><td>The on-ramp sees the Private account, so it pays the <strong>contract itself</strong>. Funds have no owner and will never appear in your Private balance.</td><td><strong>Connect your Public account instead.</strong> The Public account can accept regular on-chain transfers, just like any Ethereum address. Copy the address from the 'Receive' screen.</td></tr></tbody></table>

<figure><img src="https://400260740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUoGzqKrjqkoPsx76Zeb7%2Fuploads%2Fgit-blob-2e1283ed612cd9e205c3fb29b5f00719ee7c28b4%2Fimage%20(140).png?alt=media" alt=""><figcaption></figcaption></figure>

### Scenario 2: On-ramp **that asks for an address**

*(no wallet connection step, paste address)*

<table><thead><tr><th width="266">WRONG INPUT</th><th width="200">RESULT</th><th width="233">CORRECT INPUT</th></tr></thead><tbody><tr><td>You paste a smart contract address / private address.</td><td>Tokens stranded inside the contract, lost.</td><td><strong>Public address</strong> from <em>Receive → Copy Public address</em></td></tr></tbody></table>

<figure><img src="https://400260740-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUoGzqKrjqkoPsx76Zeb7%2Fuploads%2Fgit-blob-987ed3581b6b7e4916a1a68e851c5456b3cc144e%2Fimage%20(141).png?alt=media" alt=""><figcaption></figcaption></figure>

### Scenario 3: Someone sends to the contract address

If you share the contract’s 0x… string with a friend, their standard ERC-20 transfer will drop tokens into the contract with no recipient. **Funds lost.**

**Share to sender:**

1. **Private Account:**\
   **Private Payment Link, QR Code, or Private Address from 'RECEIVE' screen.**
2. **Public Account:**\
   **Public Address from 'RECEIVE' screen**

### Scenario 4: KYC or identity checks on dApps

Completing KYC with the **Private account** links your real-world info to the privacy contract.\
**Always switch to a Public account before submitting personal details.**

**Steps to stay safe**

1. Open extension → switch on top left bar → **Public**.
2. Confirm the top-right badge shows **Connected** next to Public.
3. Proceed with the dApp’s KYC flow.

## Quick Checklist before receiving or on-ramping

* **Receiving?** Copy the address from **Receive** inside Hinkal - never from a block explorer.
* **On-ramp?** Use the **Public address** or connect with the **Public account.**
* **KYC?** Public account only.
* **Friend paying you?** Send them your Private Payment Link, QR code, or Private Address or Public address.
* **Never** paste or share addresses from a blockchain scanner or dApp