How to swap crypto in Discord safely

Swapping tokens without leaving a Discord server is convenient, and that convenience is exactly what scammers copy. Fake "swap" and "verify" bots are among the most common ways people lose wallets in crypto communities.

This guide explains how a legitimate non-custodial swap bot works, the red flags that give fakes away, and what to check before you sign anything.

How a non-custodial swap bot works

A safe swap bot never touches your funds. The flow looks like this:

1. You type a command such as /swap base ETH USDC 0.05.
2. The bot asks a public DEX aggregator (for example KyberSwap on EVM chains or Jupiter on Solana) for the best route and shows you a quote: what you'll receive, the minimum after slippage, price impact and any fee.
3. It gives you a link to a signing page. There you connect your own wallet (MetaMask, Rabby, Phantom and so on), review the transaction and sign it yourself.
4. The swap settles on-chain from your wallet. The bot never has your keys, so it can't move anything you didn't sign.

The bot is a quoting tool, and your wallet is the only thing that can move funds. Anything that breaks that model is a red flag.

Red flags that mean "walk away"

• It asks for your seed phrase or private key, in a DM, a form, a "wallet sync" page or a "validation" step. No legitimate service ever needs it, so a request for it is always a scam.
• It DMs you first, especially claiming to be "support" after you posted a question.
• The signing link isn't on the project's own domain, or the domain is a near miss (an extra letter, a different ending, unusual characters).
• It asks for an unlimited token approval when you only want to swap a fixed amount.
• It asks for a signature that isn't a swap, such as setApprovalForAll, a "permit" for tokens you aren't swapping, or a message you can't read.
• There's pressure: "verify in 10 minutes or lose access", "limited airdrop" and similar urgency.

Before you sign: a five-point check

1. Domain. Open the signing page from the bot's own button and check the address bar. Bookmark the real one.
2. What you're approving. On EVM chains, swapping an ERC-20 token usually needs an approval first. Check the spender and the amount. An exact approval (only the amount you're swapping) limits the damage if that contract is ever exploited. ChainHop's signing page only asks for exact approvals.
3. Minimum received and slippage. For large, liquid pairs, 0.5–1% slippage is usually enough. High slippage invites sandwich attacks, where a bot trades just before and after you at your expense.
4. Price impact. If the quote shows several percent of price impact, the pool is thin. Swap a smaller amount or wait.
5. Your wallet's simulation. Wallets like Phantom and Rabby simulate the transaction and show the balance changes. If what they show doesn't match the quote, cancel.

Check the token, not just the swap

A perfect swap into a malicious token still loses money. Before buying something new, check the token itself: can the team mint more, freeze your balance or change taxes? Our guide on how to check a token before you buy walks through it. In Discord, ChainHop's /scan and Solswift's /token run these checks for you.

Clean up old approvals

Approvals don't expire. If you've used a lot of dApps, review them now and then with a tool such as revoke.cash or your block explorer's token approval checker, and revoke anything you no longer use.

How ChainHop and Solswift handle this

• Non-custodial. Quotes come from KyberSwap (ChainHop, 7 EVM chains), LI.FI for bridges, and Jupiter (Solswift, Solana). You sign everything in your own wallet.
• Fees shown upfront. Same-chain swaps include a 1% fee that supports ScriptSmith. It's shown in the quote and on the signing page before you sign, and it's applied through each aggregator's official fee parameters.
• Private quotes. Quotes are only visible to you unless a server admin turns on public quotes.
• No seed phrases, ever. If anyone claiming to be us asks for one, it's a scam. Report them to your server's moderators.