Docs › Guides

Security & phishing

How to make sure you are on the real Beluga, what we will never ask for, and how to keep your own funds safe.

Official addresses

Beluga runs only on beluga.to. Copies of swap sites on look-alike domains replace the deposit address with their own, and a deposit sent there is gone. Check the address bar before you send anything, and bookmark the real site. Our only account on X (Twitter) is @BelugaExchange.

What we will never do

• Ask for your seed phrase, private keys, wallet files or passwords.
• Ask for a "verification payment", a test transaction or a fee to release funds.
• Message you first, on any platform.
• Change a deposit address after the order shows it.

Anyone who does any of this is not us. Report it to support.

Checks before you send

• Deposit address: copy it with the Copy button and compare the first and last characters after pasting. Some malware swaps addresses in the clipboard.
• Payout address: make sure it is yours and on the right network. Payouts can't be reversed.
• Hyperliquid address: a wallet you control, never an exchange deposit address.
• Network: send each coin on its own network: Bitcoin on Bitcoin, Monero on Monero, SOL on Solana, and ETH, USDC, USDT and DAI on Ethereum (not on another chain). A deposit on the wrong network may be lost.

Privacy tips

• Use a fresh receiving address for each order.
• Hyperliquid is a public ledger: anyone can see an address's balances and transfers, including XMR2 credits and redemptions.
• The site keeps only your theme and last five order IDs in your browser. Clear the site data to remove them.

Found a vulnerability?

Please tell us privately at [email protected] before publishing, with enough detail to reproduce it. Don't test against other users' orders or funds.