So going through my weekly check of my accounts to catch airdrops, I noticed two new coins on my polygon wallet. NFTsprites and Taocoin.  Now Nftsprites seemed a bit wierd, but looks to be related to NFTs. Only issue I found was the original NFTsprites is on the ETH network, and I have this as matic drop. Can't view it. If anyone knows more drop me a comment. I will be investigating this one a bit closer later on. 

The second one Taocoin started raising my scammer senses. It is a new coin, that you can stake. Cool. It has no front end. Umm, ok, not really cool. Oh they have a step by step guide on how to stake. Fine lets have a look. Huh, a 5 member community on reddit created a week ago. 

OK lets see how much worst this can get. On to github. A two week old account.  There it states they airdropped this to all users of quickswap. So that's how they got my address. Lets look through the instructions. Seems to be alot of copying and pasting code. Then the bit that stood out.

To Stake TAO:

Export ENV variables:

export MNEMONIC = "mountain clouds ... "

export STAKE=<stake amount in TAO>

That's right, you need to type in your complete MNEMONIC phrase. Your seed phrase. The one every wallet I have has stressed never to tell anyone, not even family members.  The one I am meant to print out, laminate and store off site in case of fire so I can retrieve my wallet. 

After I found this bit, I thought I should warn others so the community can spread the warning.  Now maybe this is a overreaction, and this is a perfectly innocent and viable way to stake coin on the matic network, but their code calling it a mnemonic phrase doesn't change the fact I can only think of one thing a 12 phrase code can be, and that is your seed phrase.  If I got the wrong end of the stick, let me know in the comments, I always enjoy learning something new.