A signing device that never touches the internet, used with QR or SD transaction flows.

Addresses permitted to mint or trade early. Also a phishing lure word in fake mint sites.

A personal code shown in legitimate exchange emails so fakes are easier to spot.

An attacker who exploits for profit or disruption without disclosure.

Paid responsible disclosure for vulnerabilities, often via Immunefi in crypto.

An automatic pause when flows or losses exceed thresholds.

Multiple controls: audits, monitoring, limits, timelocks, and circuit breakers together.

Deceiving a user into authorizing account delegation to code that can exercise unintended control over the account.

Using a dedicated machine or phone for signing and a different one for browsing CT.

A vault-accounting attack in which manipulation of assets per share and rounding can cause a depositor to receive too few shares.

Actors posing as MetaMask, Ledger, or exchange support in DMs. Real support never needs your seed.

Mathematical proofs about contract behavior, complementary to audits and tests.

Operators who exploit then negotiate returns. Legal and ethical status is messy.

Fake handles that clone influencers or founders to push drainers or fake mints.

Pause guardians, war rooms, and user alerts planned before a hack, not during one.

Multi-party computation custody that splits signing so no single machine holds a full key.

Losses from compromised signer devices, fake UI, or social engineering rather than a smart-contract bug. Central to Bybit-era exchange thefts.

Tricking you into signing a bad transaction or handing over a seed via fake sites, DMs, or ads.

The romance-investment scam pattern that funnels victims into fake crypto platforms.

Caps on how fast value can leave a protocol, buying time during exploits.

A contract flaw where an external call re-enters before state updates, used in classic DeFi hacks.

Independent parties can rebuild the same binary from source, raising trust in wallet releases.

Long social engineering that ends in fake investment apps. A major fiat-to-crypto crime pattern.

Asking you to sign a typed-data message that grants operatorship or transfers assets.

Attackers port your phone number to intercept SMS 2FA. Use app or hardware 2FA for exchanges.

Compromising a dependency, CDN, or installer to reach many wallets at once.

A second step beyond the password. App or hardware keys beat SMS for exchange security.

A token allowance large enough to let a designated spender move present and potentially future balances without asking for another allowance each time.

A security researcher who reports or sometimes rescues funds under safe-harbor norms.

Exchange feature that restricts withdrawals to pre-approved addresses.