Crypto Scam Glossary

A scam where attackers use the same LLM-based fundraising agents that Web3 founders use for investor outreach — but pointed in reverse, to impersonate tier-1 VCs like Paradigm, 1kx, or Variant. The AI writes pitch-perfect emails in the exact cadence of a real associate, produces cloned term sheets, and coordinates deepfake calls, all to drain founder wallets or extract cap-table access.

Attackers assume the identity of a real venture capital partner — using their public LinkedIn history, portfolio companies, and writing style — to reach out to founders with fake investment offers. In 2026, LLMs made this scalable: one operator can now run 200 simultaneous 'partner' personas across Paradigm, a16z, 1kx, and Variant with consistent voice and backstory.

Cold-email sequences that mimic a real VC firm's opening line, meeting-request phrasing, subject-line pattern, and even the follow-up cadence (Tue 8:47am, Fri 4pm). The clone is trained on leaked or scraped legitimate outreach and is often indistinguishable from a genuine associate's first email — the giveaway is only in the payment step.

A convincing PDF that mimics a real VC's term sheet template — SAFE valuation cap, pro-rata rights, board observer clauses — used to pressure founders into a fast 'formation deposit' or a wallet-signing step. Often generated by AI from public template libraries and signed with a forged e-signature block matching the impersonated partner.

Targeted phishing aimed specifically at Web3 founders and their treasury signers, using investor-outreach framing (fake VC intro, due-diligence request, portfolio review) instead of generic 'wallet security' bait. The endgame is a signed token approval on the treasury multisig, a leaked SAFE cap-table, or a 'formation deposit' sent to an attacker wallet dressed as a partner escrow.

Automated pipelines that scrape Crunchbase, LinkedIn, Messari, and X (Twitter) to identify founders actively fundraising, then prioritize them by round size, chain, and treasury balance. Legitimate VCs use this to source deals faster; scammers use the identical pipeline to source *targets* — same tooling, opposite intent. The tell is which wallet the 'formation deposit' lands in.

A vulnerability a language model reports because the format of an audit report expects findings, not because the defect exists. It arrives with a severity label, a line reference and a remediation snippet, and none of them refer to anything in your code. OWASP files this class under LLM09 Misinformation: plausible, confident, wrong.

Scammer generates a lookalike address (matching first/last characters) and sends you a small transaction. When you copy from history, you send to the scammer's address.

A tiny transfer sent to your wallet to get your address into your history and make a fake sender look familiar. In address poisoning scams, the dust itself is bait — the real theft happens when you later copy the poisoned address by mistake.

A crypto address deliberately generated to match recognizable starting or ending characters. Legitimate users use them for branding; scammers use them to mimic a trusted address closely enough to fool someone copying from transaction history.

A high-traffic routing wallet used by payment processors, OTC desks, or trading aggregators to collect and forward funds. Because these wallets appear constantly in user histories, they are ideal targets for address poisoning campaigns that rely on visual familiarity.

Watching pending blockchain transactions in real time to identify valuable targets, active wallets, and repeated transfer patterns. Address poisoners use mempool monitoring to spot who is moving stablecoins, then send lookalike dust transactions before the next transfer.

Malware that monitors your clipboard and replaces copied crypto addresses with attacker-controlled addresses. Always verify the full address before sending.

Compromising a trusted dependency or tool that developers use. One malicious npm package update can compromise thousands of projects simultaneously.

Creating multiple fake identities to gain disproportionate influence in a network. Used to manipulate governance votes, fake social proof, or farm airdrops.

Exploiting a token contract to create unlimited tokens, then selling them before the price crashes. Often targets poorly audited DeFi protocols.

An attack that intercepts MFA tokens in real-time by proxying the victim's session through an attacker-controlled server. The victim thinks they're logging in normally — but the attacker captures both password AND the one-time code simultaneously. This is how ShinyHunters bypassed Figure's MFA.

Convincing a phone carrier to transfer your number to the attacker's SIM card. Once they have your number, they receive your 2FA codes, reset your passwords, and drain your accounts. Figure breach victims with exposed phone numbers are prime targets.

An attack where keys are generated in bulk ahead of time from a suspected weak pattern, their addresses derived, and the chain monitored for any of them receiving funds. Cheap to run, patient by nature: some drained wallets were funded years before the sweep. Precomputed keys do not expire, so rotating away from a suspect device is the only fix.

Malware whose job is harvesting credentials: browser-extension wallet data, seed-phrase files, exchange session cookies and saved passwords. Cracked tools and 'special software' downloads have long been one of its most reliable delivery channels.

A subscription criminal toolkit model (Drainer-as-a-Service) documented by Chainalysis and TRM Labs, in which a developer builds drainer contracts and phishing templates and rents them to affiliates who run the campaigns. ScamSniffer named Angel, Pink, and Inferno as active drainer services in 2024.

An exploit abusing Uniswap's Permit2 contract — a single off-chain signature grants the attacker permission to move tokens later, with no on-chain transaction visible at signing time. Hardware wallets show only opaque hex data, making it nearly invisible to victims.

When a wallet (especially hardware like Ledger/Trezor) shows only raw hex bytes instead of human-readable transaction details. Users approve operations they cannot understand — the core vulnerability Phantom exploited via Permit2 to bypass even cold storage.

A phishing operation that impersonates a legitimate upcoming token airdrop (LayerZero, zkSync, Linea, Scroll, Berachain) using cloned landing pages, typosquat domains, and paid X ads. The 'Claim' button triggers a malicious approval signature instead of granting tokens. ScamSniffer tracked 47 such campaigns drained $100M from 18,200 wallets in Q1 2026.

A subscription criminal business model where toolkit authors sell ready-made drainer kits in Telegram for $300-$500. The kit ships with cloned landing pages, malicious smart contract code, wallet integration, and a real-time admin dashboard. Buyers keep ~80% of drained funds; toolkit authors keep ~20%. Lowered the technical barrier for fake airdrops to near-zero in 2026.

A near-identical lookalike domain registered to impersonate a legitimate project — for example a hyphen inserted into the real name, or 'claim-' bolted onto a token ticker on a cheap TLD (illustrative patterns, not registered domains). Operators pair the domain with cloned visuals and X ads to make victims trust the page within seconds. 89% of fake-airdrop victims in Q1 2026 reported the URL 'looked exactly right' before clicking.

When a fake airdrop drainer doesn't need a fresh signature because the victim already granted unlimited token approval to a routine DeFi protocol months earlier. The drainer contract calls transferFrom(victim, operator, balance) using the dormant approval. The largest single $1.4M drain in Q1 2026 happened this way — set in 2025, exploited in 2026.

The defensive habit of periodically reviewing and revoking unlimited token approvals using tools like Revoke.cash or Etherscan's Token Approvals tab. Without revocation, every approval ever granted remains active forever — a dormant attack surface. ScamSniffer estimates 60% of Q1 2026 fake-airdrop losses could have been prevented by quarterly revocation hygiene.

State that gets changed while a smart account is only supposed to be checking whether an operation is allowed. Approvals granted during validation never reach a confirmation screen, so the user sees an ordinary successful transaction and an allowance he never agreed to.

Collecting token approvals from many wallets quietly, then coming back later to spend them in one pass. Nothing looks stolen while the permissions accumulate, which is why the gap between the harvest and the drain can be days.

Registering package names that AI assistants hallucinate, so the next developer who follows the suggestion installs the attacker's code. The USENIX Security 2025 study of 576,000 generated code samples found 19.7% of recommended dependencies did not exist and catalogued about 205,000 unique invented names that recur across runs.

A real, exploitable defect created by applying a fix for a problem that never existed — a reentrancy guard removed as 'redundant', an access modifier widened to silence a phantom finding, a checked call swapped for an unchecked one. The diff is small, sounds reassuring, and is merged in minutes.

A token deployed with the name, symbol and decimals of a real asset such as Tether USD, but at a different contract address. Wallets display it correctly because they were built to display whatever the contract declares; the only identity a token has is its contract address.

Using a token's free-text name and symbol fields to imitate a trusted asset. A symbol is a label, not a permission or an endorsement, so 'USDT' in a wallet proves nothing until the contract address matches the issuer's published one.

A document giving someone permission to WITHDRAW money from YOUR account — not a payment, but a key. Scammers use it to drain business accounts after victims sign 'investment contracts'.

A person who unknowingly processes stolen money through their accounts. In SEPA scams, the 'debtor' becomes the fall guy when police investigate — their signature is on all the documents.

Digital money that uses cryptography for security. Not controlled by banks or governments. Bitcoin was the first cryptocurrency, created in 2009.

The first and most valuable cryptocurrency. Created by Satoshi Nakamoto in 2009. Limited to 21 million coins. Often called 'digital gold'.

The second-largest cryptocurrency. Unlike Bitcoin, it can run smart contracts — programs that execute automatically. Most DeFi and NFTs run on Ethereum.

A digital ledger that records all transactions across a network. Each 'block' is linked to the previous one, making it nearly impossible to alter history.

Software or hardware that stores your cryptocurrency. It holds your private keys which prove you own your coins. Lose the keys, lose the coins.

A platform where you buy, sell, and trade cryptocurrency. Examples: Binance, Coinbase, Kraken. Centralized exchanges hold your funds; decentralized ones don't.

A cryptocurrency pegged to a stable asset like USD. USDT and USDC are the most popular. Designed to avoid the volatility of Bitcoin and Ethereum.

Crypto slang for 'hold' — originated from a typo. Means holding your cryptocurrency long-term instead of selling during price drops.

A settled blockchain transfer that no operator, bank or court can undo. Cash-to-crypto payments are irreversible and authorised by the sender, which is why refunds effectively do not exist.

Specific numbered bars set aside for one owner, which cannot be lent, pledged or counted twice. Allocation is only meaningful when the serial numbers and the custodian can be inspected.

The London bullion market standard for a gold bar: 350–430 fine troy ounces at a minimum fineness of 995, produced by a refiner on a public accreditation list. The standard applies to bars, never to tokens or apps.

The unit gold is priced and tokenised in: 31.1035 grams of pure metal. One metric tonne is roughly 32,150 fine troy ounces, which caps how many one-ounce tokens a claimed tonne can back.

Evidence that the assets behind a token exist, published by a named firm with a date, a scope and a method. A logo on a PDF with no accountant's name and no date proves nothing at all.

Under the EU's MiCA framework, a token whose value references an asset such as gold or a basket of currencies. Offering one to the European public requires an authorised issuer and a published white paper.

An asset that costs money to hold and produces no income. Gold has storage and insurance costs and pays no coupon, rent or dividend, so any fixed yield on bullion must be funded from somewhere else.

A physical or financial asset — property, treasuries, commodities — represented by a token. The token is only ever as strong as the legal claim documented behind it.

A company created to hold one asset, such as a single building. Token holders normally own a share of this company rather than the property, so its registration and creditor ranking decide what they recover.

Rent after vacancy, taxes, insurance, maintenance, management and platform fees, divided by the price paid. Net residential yields sit in low single digits in most Western cities.

The notice US issuers normally file for an exempt private securities offering, searchable free of charge in the SEC's EDGAR database. An offering marketed in the US with no filing anywhere is unreported, not exempt.

A public search of who is registered as a property's owner and what charges are secured against it. If the registered owner is not the vehicle selling the tokens, the token has no path to the building.

Infrastructure that transfers tokens between different blockchains by locking assets on one chain and minting equivalents on another. Bridges hold billions in locked funds, making them the highest-value targets in DeFi — responsible for $2.8B+ in losses since 2021.

When an attacker obtains the private key controlling a smart contract or wallet. In the IoTeX ioTube bridge hack, a compromised private key gave the attacker full control over $8.8M in locked bridge funds — no exploit code needed.

A wallet requiring multiple private keys to authorize transactions (e.g., 3-of-5). Designed to prevent single points of failure. IoTeX's ioTube bridge used a multisig — but when enough signers were compromised, the 'safety net' became the attack vector.

The process of validating that a message from one blockchain is authentic before executing it on another. CrossCurve's bridge failed to properly verify cross-chain messages, allowing an attacker to forge withdrawal proofs and drain $3M in liquidity.

Illegitimately withdrawing all tokens from a liquidity pool by exploiting contract vulnerabilities. In the CrossCurve exploit, the attacker used forged cross-chain messages to drain pools across multiple chains in under 15 minutes.

A node responsible for confirming cross-chain transactions are legitimate before releasing funds. When validators are centralized or poorly secured, one compromise can unlock the entire bridge treasury. The IoTeX exploit targeted this weak link.

A Solidity guard (e.g., `onlyOwner`, `onlyRelayer`) that restricts who can call a privileged function. The Hyperbridge exploit happened because the `mint()` helper on the Ethereum-side TokenGateway shipped without one — any address could call it and forge $1.2B of unbacked wDOT.

The contract entry point that creates wrapped tokens on a destination chain after a cross-chain message is verified. It is meant to be callable only by an authenticated relayer with a valid consensus proof. When this function is exposed publicly — as it was on Hyperbridge — minting becomes a free printer.

Wrapped tokens created on one chain without a corresponding locked or burned balance on the source chain. They have no real collateral — only what the open market will pay before realising the supply is fake. The attacker minted 1,000,000,000 unbacked wDOT but cashed out only $237k before Uniswap liquidity collapsed.

An attack on the Ethereum-side contracts that wrap Polkadot's XCM (Cross-Consensus Messaging) traffic. Real DOT on Polkadot is never touched; the loss lands on Ethereum holders of the wrapped asset and the DEX pools that priced it. Hyperbridge was the first headline case at the billion-dollar paper-value scale.

Fraudulent attempts to obtain sensitive information by disguising as a trustworthy entity. In crypto, often targets seed phrases, private keys, or exchange credentials.

A fraud where returns for earlier investors are paid using capital from newer investors, not from legitimate profits. Collapses when new deposits can't cover promised returns.

When project developers abandon a project and run away with investor funds. Common in DeFi and new token launches.

Long-term romance or friendship scam where victims are 'fattened up' with fake relationships before being convinced to invest in fraudulent crypto platforms.

No legitimate investment guarantees returns. Crypto markets are volatile. Anyone promising fixed daily/weekly profits is running a Ponzi or exit scam.

The mathematical foundation of Bitcoin and Ethereum key pairs. Uses the secp256k1 curve. Provides security without the computational overhead of RSA.

One-way mathematical function converting any input to a fixed-size output. SHA-256 secures Bitcoin. Keccak-256 secures Ethereum. Collisions are computationally infeasible.

Data structure used in blockchains where each leaf node is a transaction hash, and parent nodes are hashes of their children. Enables efficient verification of large datasets.

Cryptographic method to prove you know something without revealing what you know. Powers privacy coins like Zcash and scaling solutions like zkSync.

Technique where multiple parties jointly compute a function over their inputs without revealing them. Used in institutional-grade wallet security to split private keys.

The raw randomness a wallet collects before turning it into a private key or seed phrase. Good sources are chip noise, sensor jitter and timing variation. Bad sources are clocks, counters or a hardware generator that fails silently. A weak key looks identical to a strong one from the outside, which is why entropy is the only part of wallet security a user cannot verify after the fact.

A defect in how a wallet creates keys, usually biased or insufficient entropy, that shrinks the space of possible keys from astronomically large to searchable. An attacker who works out the bias can recreate keys on his own hardware and spend from the resulting addresses without ever touching the victim's device. Offline storage offers no protection against it.

The BIP-32 and BIP-39 rule that one seed produces every address a wallet will ever use, in a fixed order. Excellent for backups: one phrase restores everything. Dangerous when the seed is weak, because a single guessable number exposes the whole account tree, including unspent change addresses.

Self-executing code on a blockchain that runs when conditions are met. Powers DeFi, NFTs, and most of modern crypto. Can be exploited if poorly written.

Permission granted to a smart contract to spend your tokens. Malicious approvals can drain entire wallets. Always review what you're approving.

When you approve a contract to spend an unlimited amount of your tokens. Malicious contracts use this to drain everything, not just what you intended to spend.

A collection of tokens locked in a smart contract that enables trading on decentralized exchanges. Scammers create fake pools, then drain the liquidity (rug pull).

Lending or staking crypto to earn interest. Legitimate yields are 5-20% APY. Scam platforms promise 100%+ daily returns — those are Ponzi schemes.

Malware hidden in npm package.json postinstall scripts. Runs automatically when you execute npm install, scanning for wallet data and private keys.

A GitHub repo containing hidden malware disguised as a coding test. When you run npm install, it silently extracts wallet credentials and sends them to attacker servers.

Urgency prevents verification. Real companies have multi-stage processes. Scammers need you to run malicious code before you start asking 'can I verify this on your official website?'

An attacker-controlled copy of a development tool that can ignore the visible source code and return malicious bytecode. A familiar interface does not prove the output matches the input.

In scam contexts: A dashboard showing fake numbers. There is no bot. No algorithm. Just a SQL query that adds 1% to your balance daily until withdrawals exceed deposits.

Code designed to transfer wallet assets to an operator. In fake trading-bot tutorials, victims may deploy and fund the drainer themselves instead of signing a conventional token approval.

Deliberately choosing foreign law and arbitration (e.g., Hungarian law for a Spanish contract) to make legal action prohibitively expensive and inconvenient for victims.

A contract clause making YOU personally certify that funds are legal 'under penalty of perjury'. If the money is dirty, you've signed your own confession. The scammer walks free.

Professional criminal syndicates using Mandarin-language infrastructure to launder stolen crypto. Emerged during COVID when physical smuggling routes shut down. Now process 20% of all illicit crypto flows — $16.1B in 2025 alone.

An encrypted-messaging marketplace where criminals buy and sell laundering services, stolen data, and fraud tools. The 'guarantee' is that the marketplace holds funds until both parties confirm. Think Amazon — for crime.

An unlicensed money service business wearing a legitimate exchange as a skin suit. Processes illicit funds through the larger exchange's accounts, hiding dirty money in normal transaction volume.

The primary laundering technique. Send $1M to one wallet, 'peel' off $10K to a new address, send the rest forward. Repeat 100 times. Each peel goes to a different cash-out point. Like peeling an onion — and it makes investigators cry the same way.

The largest documented illicit marketplace. Cambodia-based. $70B+ in volume. FinCEN designated it a 'primary money laundering concern.' When Tether froze their wallets, they launched their own stablecoin. USDH. When the cops close the door, build your own door.

Licensed casino intermediary turned money laundering on-ramp. Chinese nationals deposit yuan, operators convert to Macao casino chips, chips become USDT, USDT flows to encrypted messaging marketplaces. Clean money exits in a different country.

Fenced compounds in Cambodia, Myanmar, and Laos where trafficking victims are forced to run pig butchering scams under threat of violence. 100,000+ people trapped. The stolen funds flow directly to CMLN laundering networks.

The end-to-end infrastructure connecting scam compounds to cash-out points. Victims are groomed in compounds, funds flow through USDT OTC desks, then into casino junkets or shell companies. Each stage is operated by a different criminal cell.

Unlicensed over-the-counter brokers who convert stolen USDT into fiat currency or clean crypto. They operate on encrypted messaging platforms, charge 1-5% fees, and process millions daily with no KYC. The backbone of CMLN cash-out operations.

A laundering channel where illicit crypto is converted to casino chips via junket operators in Macau or Southeast Asia, gambled minimally, then cashed out as 'winnings.' Huione Group's casino connections processed billions through this method.

A scammer fiction used to describe Bitcoin supposedly 'tainted' by criminal activity. Used to justify fake discounts that make no economic sense. It's an advance-fee fraud scam.

Over-the-counter trading scams where criminals promise discounted cryptocurrency through private deals. Always ends with victims paying fees for Bitcoin that never arrives.

A fake 'verification' procedure in OTC scams where victims are asked to send small amounts of Bitcoin to prove they have funds. The scammer pockets these 'tests' and requests more.

Fabricated jargon with no basis in Bitcoin transactions. Scammers invented the term because it sounds technical and creates a 2-3 hour window where victims wait, invested, not asking questions.

A specific small-value advance-fee used to prove a victim's willingness to pay before escalating to larger 'fees'. The precise amount sounds professional but is completely arbitrary.

A fake fee scammers claim is required to 'register' your wallet for large transactions. No legitimate blockchain or service requires this.

Physical-world jargon used in OTC cash scams to manufacture high-stakes 'cash for BTC' narratives. The safe house doesn't exist.

A staged prop in Dubai OTC scams where scammers promise 'armored car delivery' of cash Dirhams. The vehicle exists. The money inside it does not. Pure set dressing to justify a 25,000 AED logistics fee.

A manipulation tactic where each stage of an OTC deal introduces a new fee — compliance, logistics, insurance, AML clearance. Each fee is small enough to seem reasonable. Together they drain you before any trade happens.

An artificial deadline imposed by scammers — usually 24-48 hours — to force victims to send funds before verifying. 'The rate expires at midnight.' It doesn't. But your money does.

The non-negotiable principle in legitimate OTC deals: never release crypto until physical cash is verified in hand. Every scam in our Dubai investigation violated this rule. Every single one.

Creating a near-identical copy of someone's messaging account — same name, photo, bio — to impersonate them. In OTC fraud, clones contact real exchanges posing as the victim. No hacking required: just a new account and 90 seconds of copying.

A social engineering attack where a person — not malware — sits between two parties, relaying and altering messages in real time. Both sides believe they're communicating directly. The attacker controls the conversation, substituting wallet addresses or payment details.

A technique where a scammer forwards a small test payment from their own wallet to the victim, making it appear as if the legitimate counterparty sent it. The victim 'verifies' the transaction and approves the full transfer — which goes to the scammer's address.

Registering a username nearly identical to the target's — using extra underscores, Cyrillic character swaps, or added periods. In a busy group chat, 'trader_alex' vs 'trader__alex' goes unnoticed. The display name matches perfectly; only the handle differs by one invisible character.

Techniques to trace cryptocurrency transactions and link wallets to real identities. Companies like Chainalysis help law enforcement track stolen funds and money laundering.

Service that breaks the transaction trail by mixing multiple users' funds. Tornado Cash was sanctioned by US Treasury. Using mixers can flag your wallet.

Sending tiny amounts of crypto to many wallets to track their activity. When you spend the 'dust' with other funds, attackers can link your addresses together.

How a blockchain agrees on the true state of the ledger. Proof-of-Work (Bitcoin) uses mining. Proof-of-Stake (Ethereum) uses validators. Each has security tradeoffs.

When a single entity controls majority of network hashpower or stake, enabling double-spending and transaction censorship. More practical on smaller chains.

Profit miners/validators can extract by reordering, inserting, or censoring transactions. Front-running, sandwich attacks, and liquidation sniping are MEV strategies.

The unit measuring computational effort on Ethereum. Each operation costs gas. High network demand = higher gas prices = more expensive transactions.

The waiting room for unconfirmed transactions. Attackers monitor mempools for profitable front-running opportunities. Private transaction services bypass this exposure.

A bidding war in the Bitcoin mempool. RBF (BIP-125) lets an unconfirmed transaction be replaced by a version paying a higher fee, and miners take the richer one. During cold wallet drains, attackers used it against victims who tried to rescue their remaining balance: every rescue attempt was replaced by a higher-fee sweep, paid for with the stolen coins.

An Ethereum standard that lets a wallet be a smart contract instead of a bare private key. It enables batching, social recovery, session keys and sponsored gas. The cost is a longer path: a transaction now passes through a bundler, an entry point contract, the account and sometimes a paymaster, and every hop is code that can be wrong.

The contract that pays gas on your behalf so a transaction feels free. It is invoked during validation, which is exactly why a malicious or over-scoped paymaster is dangerous: if it can change state while validating, it can set token approvals in the attacker's favour without any wallet prompt.

The off-chain actor that collects user operations from an alternative mempool, packs them together and submits them to the entry point contract on chain. It decides what gets included and in which order, so it sees your intent before the network does.

The ERC-4337 replacement for a normal transaction. It carries the call data, gas limits, the signature and, optionally, paymaster data. Sign one and you are approving a whole pipeline, not a single transfer, which is why the fine print matters more than the amount.

A limited key that lets an app act for you for a while without asking every time. Useful for trading and automation, and a standing permission that outlives the transaction that created it. Scope it, time-box it, and revoke it when the session is over.

A contract where YOUR details are complete but the recipient's fields are deliberately empty. Not 'to be filled later' — designed to hide who's taking your money until it's gone.

A trust graphic claiming a project was reviewed by an AI tool. There is no named firm, no scope, no methodology, no signature and no liability behind it, and nothing in a listing or aggregator flow verifies that any tool was ever run. On a scam launch page it does one job: converting hesitation into a deposit.

A sequence of small payments each justified by the previous one — licence, then activation key, then 'network energy', then a server slot. No single amount looks unreasonable against the promised payoff, which is exactly why the total does.

The second harvest. After a loss, a 'recovery expert' appears offering to trace or unlock the funds for an upfront fee. It frequently targets the same victim list as the original fraud, because that list is already proven to pay.

A physical machine, often called a crypto ATM, that takes banknotes and sends cryptocurrency to a scanned address. It is one-way and final: there is no reversal, no chargeback and no counterparty holding the funds.

Skipping the cryptography and applying physical pressure to the person holding the keys — extortion, home invasion, kidnapping. Its prerequisite is a shortlist of names, addresses and proven balances, which is exactly what an identity-plus-ledger leak produces.

A small first payment framed as a test that the channel works. Its real job is to convert doubt into compliance, after which the requested amounts climb.

A wallet destination hidden inside a QR code supplied by the scammer. The victim cannot read the address, so scanning it is sending money to a stranger by definition.

A pool of money held to make distributions look punctual. Rent arrives monthly and unevenly, so daily guaranteed payouts need a float — and in a fraud that float is the deposits of the newest buyers.

A 12-24 word recovery phrase that grants full access to your cryptocurrency wallet. Never share it. Legitimate services will never ask for it.

A cryptographic key that proves ownership and allows spending of cryptocurrency. Anyone with your private key controls your funds. Never share it.

Your wallet's 'receiving' address. Like an email address for crypto — safe to share when receiving funds. It's derived from your private key.

A security layer requiring two forms of verification. Prefer authenticator apps over SMS. Scammers often try to social-engineer 2FA codes from victims.

Physical device storing private keys offline. Scammers send fake 'replacement' letters claiming your device is compromised, asking you to enter your seed phrase on a phishing site.

An extra secret, defined in BIP-39, combined with the seed words to derive a completely different wallet. Because you choose it yourself, a compromised or predictable seed alone is not enough to spend your funds. The trade-off is unforgiving: lose the passphrase and the coins are gone, so it must be backed up separately from the words.

Spreading balances or multisig signers across hardware from different manufacturers so that one vendor's firmware or key generation failure cannot take everything. A two-of-three quorum built from two brands turns a catastrophic single-vendor flaw into an inconvenience and a migration.

How much noise a detection tool produces per real finding. It sounds like a statistic and behaves like a budget: in published tests of GPT-4 and Claude against 52 audited DeFi protocols, the settings that surfaced most genuine vulnerabilities produced roughly thirty-nine invented ones alongside each real one, which turns senior review time into triage.

The section of a real audit that states what was examined and, more importantly, what was not: the commit hash, the contracts in scope, the assumptions made and the components excluded. Generated reports never carry one, because a scope is a promise and a model cannot make promises.

The reproducible transaction sequence or failing test that demonstrates a vulnerability is real. It is the cheapest filter against machine-written security reports: a genuine finding comes with one, and a hallucinated finding dissolves into generalities the moment you ask.

Unauthorized access to sensitive user data. In crypto, leaked emails and addresses enable targeted phishing attacks against known crypto holders.

Any data that can identify a specific individual: full name, home address, date of birth, phone number, email. ShinyHunters exfiltrated 2.5 GB of PII from Figure Technology — enough to fuel identity theft, SIM swaps, and targeted phishing for years.

The unauthorized transfer of data out of an organization. ShinyHunters extracted 2.5 GB from Figure Technology in under 30 minutes — faster than most companies can detect an anomaly, let alone respond. By the time anyone noticed, the data was on a Tor leak site.

A malicious build process that deploys different machine-readable contract code from the source shown to the user. The wallet signs the substituted binary, not the reassuring text on screen.

Exploiting protocol logic using uncollateralized loans that must be repaid in one transaction. Attackers manipulate prices, drain liquidity, and repay — all atomically.

Exploit where a malicious contract repeatedly calls back into the victim contract before the first execution completes. Caused the 2016 DAO hack ($60M loss). Modern variants target cross-chain bridges and DeFi lending pools.

Attack targeting the data feeds DeFi protocols rely on. By manipulating the oracle price, attackers can borrow against inflated collateral or trigger unfair liquidations.

Smart contract pattern allowing upgrades by changing the implementation contract. Malicious owners can upgrade to a drainer contract, stealing all deposited funds. IoTeX's ioTube bridge used upgradeable proxy contracts — the compromised key allowed the attacker to redirect the implementation.

Delay mechanism requiring waiting period before executing sensitive operations. Good projects have 24-72h timelocks so users can exit before malicious upgrades take effect.

Voice phishing - phone call scams where attackers impersonate exchange support or security teams to extract account credentials or 2FA codes.

Technique where scammers send messages that appear to come from legitimate sources like Binance or Coinbase. The sender ID can be faked to match official support numbers.

Fake urgency to prevent research. There is no limit — the message tells everyone '500 spots.' They're pressuring you to click before thinking.

A phishing page designed to get you to connect your wallet. The 'verification' always passes — because they're not verifying you, they're accessing your assets.

AI-generated synthetic media that manipulates appearance or voice. Used in fake job interviews and impersonation scams to appear as legitimate recruiters or executives.

Manipulating people — not code — to bypass security. ShinyHunters breached Figure Technology's $5.3B fintech empire with one phone call impersonating IT support. No exploit kit needed when a human picks up the phone.

Systematically gathering employee usernames, roles, and contact info from public sources like LinkedIn. ShinyHunters used this to identify the perfect target at Figure — an employee with VPN access and a phone number. Research before the attack, not during.

A caller poses as police, a court, a tax office or a federal investigator and demands payment or the 'protection' of your savings. Real agencies never phone to collect money at a crypto kiosk.

A channel that lets law enforcement obtain customer data without a warrant when there is an immediate risk to life. Speed is the point, which is exactly why fraudulent EDRs sent from compromised agency mailboxes work so well.

Fraud targeted at older victims, usually by phone and borrowed authority. In 2025 people over fifty filed more than half of all US crypto-kiosk complaints, with reported losses above $302 million.

An email standard (RFC 7489) that checks whether a message's visible sender domain lines up with SPF and DKIM results. It authenticates a domain, never a person's authority — mail from a compromised account inside a real agency passes it perfectly.

The liveness photo taken while holding an identity document, proving that face and paper match. Once leaked it becomes an onboarding kit for accounts opened in your name, and unlike a password it cannot be rotated.

Analysis that groups Bitcoin addresses into one wallet using common-input-ownership and change-output heuristics. One address tied to a named person is therefore a thread, not a dot: it unwinds much of that person's on-chain history.

The legal basis that lets a regulated firm disclose your personal data — and often delay telling you — when a competent authority asks. The same rule that protects real investigations silences the one person who would spot a fake instantly.

Code that lets a privileged address create new tokens. If the issuer keeps that key, supply becomes a decision instead of a consequence of deposits, and one-to-one backing cannot survive it.

A fake token created to mimic real USDT. It has the same name and logo but a different mint address. Worth exactly $0 because Tether didn't issue it.

A red flag where scammers explain why their fake token doesn't appear automatically. Real USDT shows up in major wallets without manual addition.

Fake free token distributions designed to steal wallet access. The 'claim' transaction is actually a malicious approval that drains your wallet.

A deceptive button in airdrop scams disguised as a claim. When you sign, you give the scammer's contract permission to move ALL your tokens without further authorization.

A token designed to let you buy but not sell. The smart contract blocks sales while allowing purchases, trapping your funds forever.

A smart contract that allows token purchases but reverts every sell transaction. The code contains hidden modifiers — like onlyOwner on transfer — that make it impossible for anyone except the deployer to sell.

An automated script that monitors a wallet address and instantly drains any incoming funds — including gas deposits. Victims are told to 'send BNB for gas fees' to unlock their tokens, but the bot sweeps it in seconds.

Adding a scam token to your wallet by pasting its contract address. The token mimics a real project's name and logo but has no value and is designed to steal your funds through honeypot mechanics.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.

A concept documented in our investigation. See the full case study for detailed analysis and real-world examples.