Search the complete library or follow a topic from first principles to advanced operational security.
60 articles
Need a definition? Open the glossary
A crypto scam is a fraud that manipulates a person into authorising the loss of their own cryptocurrency, whether by sending funds to a criminal, revealing a seed phrase or login code, or signing a transaction that hands over spending power. Scams attack judgement rather than cryptography, which is why the defences are habits rather than software.
Address poisoning is a payment-redirection attack that plants attacker-controlled lookalike addresses in a victim's transaction history, using zero-value token events, counterfeit tokens or tiny transfers, so that a later copy from that history selects the attacker's address.
AI voice-clone and deepfake crypto scams are a form of impersonation fraud that uses generative models to copy the voice, face or writing of someone the target trusts, such as a relative, executive, support agent or celebrity, to press for an urgent crypto transfer or login codes.
The October 2025 liquidation cascade was a self-reinforcing deleveraging event in which a macro announcement triggered forced selling across a record-leveraged crypto derivatives market, and a venue-specific failure in collateral pricing converted an orderly decline into the largest liquidation in crypto history.
A custodial crypto exchange is a company that matches trades and holds customers' crypto-assets in wallets it controls, recording balances in its own ledger. Whether a balance is the customer's property or a debt the company owes depends on the account agreement and the law governing the contracting entity, and it is usually tested only if the company fails.
A crypto glossary explains the terms used to describe digital assets, blockchains, wallets, transactions, markets and on-chain applications. The most important distinction is between a record on a network and the authority to change it: the ledger records the asset, while keys, contracts or custodians determine who can act.
Chainalysis identified at least 14 billion US dollars of 2025 on-chain inflows to addresses classified as scams or fraud according to on-chain analysis, with the full total projected to exceed 17 billion as more illicit addresses are identified.
Crypto wallet security is a set of operational practices that keeps control of a self-custodied wallet's keys with its owner during everyday use. It covers five surfaces: the device that signs, the signatures granted to applications, the backups that restore access, the transfers sent, and the vendor software and firmware the wallet runs.
Overcollateralised DeFi lending, as run by Aave, Compound and Sky, is a form of crypto credit that runs on smart contracts and secures each loan with collateral worth more than the debt. The protocol scales the collateral's value by a liquidation threshold and compares it with the debt.
A guaranteed-return offer is an investment pitch promising a fixed, above-market return with little or no claimed risk. The SEC lists "high returns with little or no risk" first among its Ponzi scheme warning signs.
A crypto transaction is confirmed when it is included in a valid block on the chain a node currently considers canonical. One Bitcoin confirmation means inclusion in one block; further blocks add depth and reduce reorganisation risk. Ethereum also exposes explicit safe and finalised states.
Cryptocurrency works by combining cryptographic authorisation with a replicated ledger. A wallet builds an exact transaction and a private key, smart-account policy or signing quorum authorises it. Independent nodes check the transaction, block producers order valid transactions, and consensus rules select a canonical history.
Wallet recovery is the set of mechanisms that restore signing authority after loss: a device failing, a phrase burning, an owner forgetting, or an owner dying.
To buy cryptocurrency more safely, first set a strict loss limit, verify the exact legal entity in an official regulator register, secure both your exchange and email accounts with phishing-resistant authentication, compare the full cost before placing a small order, keep records, and withdraw only after checking the asset, network, destination and any required memo or tag.
Keeping crypto safe means controlling who can move your assets and making sure that someone is always you. In practice it is five disciplines working together: securing the accounts around your crypto with strong authentication, choosing custody so no single secret or company can lose everything, verifying what you sign before you sign it, limiting what strangers can learn abo…
Crypto incident response is the sequence of actions that limits damage after assets or access are compromised: diagnose the type of breach, evacuate remaining funds from a clean device, revoke or freeze what the attacker can still use, secure surrounding accounts, report to platforms and law enforcement, and rebuild in a safer structure.
A wallet drainer is criminal infrastructure, typically rented as a service, that steals through usable authority: a new authorisation the owner is deceived into signing, a signature made with an already-stolen key, or a permission granted long ago to a spender that later turns hostile.
Stablecoin regulation is a body of law that governs who may issue a token pegged to an official currency, what assets must back it, who may redeem it and on what terms, what the issuer must disclose, and which supervisor can act. Each regime binds only firms within its scope, once it commences.
The blockchain ecosystem is a collection of independent networks that each record transactions in a separate ledger under separate rules. They vary in how they reach agreement, whether they run programs, how often they add blocks, what they charge and how many operators would have to collude to corrupt or halt them.
A stablecoin peg holds a token near its reference price through routes to convert it at or near par. Approved customers redeem under issuer terms, any holder of an in-scope EU e-money token can by law, vault owners repay their own debt, and some contracts let any holder redeem or swap. A price off par invites a trade until the gap is below its cost.
A crypto wallet backup is a set of recovery materials that restores access to funds when the working wallet fails. It has three layers: the secret material the wallet's design requires, a written note on how the setup works, and the devices, shares or people the design depends on.
A crypto transfer is a signed instruction that moves an asset on one blockchain; once confirmed, the network generally cannot reverse it. It arrives only when three fields match what the recipient controls: the address identifies the recipient, the network identifies the ledger, and, at custodial destinations that pool customers, a memo or tag identifies the account.
Safer stablecoin use is a set of operational practices that reduce, without removing, the risks a stablecoin keeps after its design has reduced volatility against a reference asset.
Institutional crypto custody is a security and governance system that safeguards digital asset keys for organisations. It combines hardware isolation, distributed signing through MPC or multisignature, tiered storage, policy engines enforcing approvals and limits, independent audits and insurance, designed so that no single person, device or event should be able to lose or mov…
On-chain privacy is the degree to which blockchain activity can be linked to a real-world identity. Transparent blockchains publish every transaction, amount, address and timestamp forever, so privacy rests entirely on unlinkability: keeping addresses unconnected to each other and to a name.
Oracle risk is a design risk that arises whenever an automated system acts on a price it cannot check for itself. An on-chain lending market relies on its oracle, and a centralised exchange's margin engine relies on an internal index the exchange computes.
A wrench attack is a physical attack on a crypto holder that replaces hacking with force: robbery, home invasion, kidnapping or extortion aimed at making the victim hand over keys or authorise transfers. The name comes from a security comic's observation that a five-dollar wrench beats expensive cryptography by hitting the person instead of the maths.
A relationship investment scam is investment fraud that begins with a relationship. A scammer, usually making contact out of the blue online, builds trust and then steers the person into depositing money, often crypto, on a counterfeit trading platform. It shows invented gains and may pay out a small early withdrawal.
A private key is secret signing material that can authorise actions under a blockchain account or spending policy. A public key is mathematically derived from it and lets the network verify signatures without learning the secret. A wallet address is a network-specific identifier derived from a key, script, contract or program rule.
Proof of work and proof of stake are mainly Sybil-resistance and block-proposer mechanisms inside larger consensus systems. Bitcoin links block production to computational work and selects the valid chain with the most accumulated work. Ethereum links proposal and voting weight to bonded ETH, uses LMD-GHOST fork choice and finalises checkpoints with Casper FFG.
A smart contract audit is a structured expert review of contract code that hunts for known vulnerability classes, deviations from specification and dangerous patterns before deployment. It is a point-in-time assessment of one code version under stated assumptions.
A stablecoin failure mode is a pattern of breakdown that stops a token being turned back into its reference value. A fiat-backed coin can break when the path to its reserves freezes through a bank failure, gated redemption or weekend closure. An algorithmic coin can break when its own defence mechanism destroys its backing.
The Crypto Loss Report is a periodically updated taxonomy of the ways crypto holders actually lose assets, ordered by evidence rather than by fear.
The State of Crypto Self-Custody is a periodically updated research report that measures how crypto holders custody their assets: the share of value held in holders' own keys versus exchanges, custodians and funds, the number of people involved, the events that move them between models, and the technology they use.
A stablecoin comparison is a side-by-side reading of dollar tokens that records, for each one, what backs it, how that backing is evidenced, who can redeem directly with the issuer, which legal entity issues it and what has gone wrong before.
The Exchange Failure Index is a sourced register that records eight custodial crypto platform failures from 2014 to 2022 as examples, classifying each by its initial trigger and what followed, setting out the sums, how the law treated customer claims and what customers recovered, in what form and over what time.
The Stablecoin Adoption Report is a dated research assembly that quotes public measurements of stablecoin use, naming for each the instrument behind it, its reference date, its denominator and its limits.
The Wallet Vulnerability Ledger is a dated register of documented security failures in crypto wallet software, hardware and their distribution channels that records, for each incident, the affected products and versions, the disclosure date, the technical root cause, the patched status, any reported impact with its source, and a confidence label, so that implementation risk can be assessed from published evidence.
Threshold cryptography distributes a cryptographic operation across several parties so no single party can act alone. In a t-of-n threshold signature, any authorised set of at least t participants can jointly produce one ordinary signature under one group public key, while fewer than t should not recover the signing key.
Two-factor authentication is an account security method that requires two independent proofs of identity before granting access: typically something you know, such as a password, plus something you have, such as a phone, an authenticator app or a hardware key. It protects an account even when the password leaks.
Crypto risk is the set of ways a blockchain system can cause loss despite its cryptography working correctly. It spans code (smart-contract bugs and upgrade keys), inputs (oracle and dependency manipulation), infrastructure (bridge validator sets and operator signing), and markets (leverage, liquidity and reflexive liquidation cascades).
A key storage model is the arrangement that decides where a wallet's signing authority lives and what must be compromised, lost or coerced for assets to move. Software wallets hold keys on a connected device, trading safety for convenience. Hardware wallets isolate keys in a dedicated device designed to sign internally and keep key material inside.
A blockchain is a distributed ledger that records ordered transactions or state changes in blocks. Each block normally references its predecessor and contains cryptographic commitments to its data. Nodes independently validate proposed blocks and use consensus and fork-choice rules to decide which history to accept.
A seed phrase, also called a recovery phrase, is a sequence of words, twelve to twenty-four under the BIP39 standard, that encodes the entropy from which a wallet mathematically derives its private keys.
Bitcoin is a peer-to-peer electronic cash and settlement system launched in 2009. It records ownership on a public blockchain and uses proof of work plus independently validating nodes to prevent double-spending without a bank. Its native asset, bitcoin (BTC), is issued on a declining schedule that approaches 21 million units.
Cryptocurrency is a class of digital assets whose ownership and transfer are recorded on a cryptographically secured distributed ledger. A wallet or custodian uses private keys to authorise transactions, while network participants validate and order them under shared rules.
A multisignature wallet is a custody arrangement that requires a threshold of independent keys, m of n, to authorise any transaction, enforced by the blockchain itself through a script or smart contract.
A dApp, or decentralised application, is an application whose core logic runs as smart contracts on a blockchain, reached through a front end such as a website, governed by whoever can change its contracts, often reliant on off-chain services and used through a wallet. The front end can only propose actions.
A network fee is the price a sender attaches to a blockchain transaction to have it included and executed, set by demand for the chain's limited block space; who receives it depends on the chain.
A crypto wallet is a key-management tool that generates addresses for receiving crypto, signs transactions to send it, and shows balances by reading the blockchain. The assets stay on the chain; the wallet holds the keys, or in some designs key shares, that authorise moving them. The word also covers custodial accounts, where a company holds the keys on the customer's behalf.
A smart contract is a program that runs on a blockchain under that chain's rules, holds assets and transfers them when a transaction calls it and its coded conditions are met. Every validator executes the same code against the same data, so no operator approves each step.
A stablecoin is a blockchain token that aims to hold a steady value, usually one US dollar, by resting on issuer-held reserves, surplus crypto locked in contracts, hedged positions or supply rules. Its holder owns the token; the right to redeem it is separate.
Blind signing is a way of approving a crypto transaction or message that commits the signer's key to data the signer cannot read or check. It happens when a wallet cannot decode the request and shows raw data, or when compromised software describes the request as something it is not. The approval then depends on trusting whoever built the request.
DeFi (decentralised finance) is a category of financial applications that runs trading, lending and derivatives as smart contracts on public blockchains. Users keep custody of their assets until a contract's rules move them. Many public markets accept any address that meets those rules, while other contracts check an allowlist, a role or an identity credential first.
Proof of reserves is a disclosure practice that lets a custodial platform prove control of on-chain addresses and, in stronger versions, commit cryptographically to its customer liabilities, so each customer can check their own inclusion and an accountant, often under agreed-upon procedures, can compare the totals. It evidences asset control and inclusion at one snapshot.
Staking is a form of participation in a proof-of-stake network that commits the network's own coin behind a validator, directly or through an intermediary, so that the stake helps propose and confirm blocks. The protocol pays participating stake a share of issuance and unburned transaction fees, in that coin, at a rate its formulas set.
A crypto reward is a token payment with an identifiable source: a protocol paying for network security, borrowers paying interest, traders paying swap fees, a project distributing promotional tokens, or a company promising a rate it sets.
A custody model is the arrangement that decides who controls the key able to move your crypto. Custodial services hold keys on your behalf, so you rely on the company. Single-key self-custody puts one key, and its seed phrase backup, entirely in your hands.
A cross-chain bridge is an interoperability system that moves value or messages between blockchains that cannot read each other. Typical designs lock assets in a contract on the source chain and mint a representation on the destination, with a verification layer, validators, a multisig, a light client or a proof system, attesting that the lock really happened.
Know-your-customer (KYC) is an anti-money-laundering control that requires regulated financial businesses to identify and verify their customers; where a jurisdiction's law covers crypto businesses, it applies to exchanges alongside record-keeping, transaction monitoring and suspicious-activity reporting. Each jurisdiction sets its own duties, thresholds and start dates.
No articles match this search yet.