# Onchain Diary — Full Content Index

> Complete index of all Web3 glossary terms and articles on Onchain Diary.
> Total: 232 glossary terms, 117 articles.

## Featured Guide
- [Tools](/tools/) — free onchain security tools hub: BIP-39 wordlist, Anti-Scam Yellow Paper + quiz, Security Persona Test, MCP server for AI assistants (bilingual)
- [Airdrop Safety: The Complete Guide](/airdrop-safety/) — how fake airdrops work and how to claim real ones safely
- [Crypto Scam Recovery Help: The Victim's Road Map](/recovery-help/) — first-24-hours emergency runbook, how to report (IC3 + exchange freeze requests), tracing stolen funds on-chain, what real recovery looks like, fake recovery services
- [币被骗了怎么办：受害者行动路线图](/zh/recovery-help/) — 中文版：黄金 24 小时止损、报案与止付、链上追踪、追回真实路径、二次收割骗局识别
- [Onchain Anti-Scam Yellow Paper 链上防骗黄皮书](/yellowpaper/) — bilingual (en/zh) systematic manual: scam taxonomy, forensics primer, layered defense (free PDF; LaTeX source: github.com/UZEN-Labs/antifraud-yellowpaper)
- [Onchain Security MBTI](/security-mbti/) — 16-scenario persona test: four axes, 16 personas, safety score (interactive, bilingual)

## Articles
- [Bitcoin Blackmail Emails Explained: The Password Is Real, the Video Is Not](/articles/bitcoin-blackmail-email-scam/) — An email shows an old password you actually used, claims malware recorded you through your webcam, and gives a Bitcoin address with a 48-hour countdown. Here is what on-chain research and FBI guidance say about these campaigns, the 2026 named-crew upgrade that adds real breach data, and exactly what to do in the first hour.
- [FMMR Mining Scam: A Fake Pool Farmed 151 Wallets for Over 1.5M USDC — and the Permits Are Still Live Until 2030](/articles/fmmr-fake-mining-pool-scam/) — A victim in China was groomed on Bilibili by a 'medical aesthetics professional' persona and led into a fake mining pool called Onchain at fmmrvip.click. His first 300 USDC deposit withdrew fine. Then three harvests in three weeks. On-chain forensics match his story line by line — including the cruelest detail: the 2,513 USDC his 'friend' chipped in was wired from the scam's own treasury three minutes before it reached him.
- [The Ledger–CryptoBilis Hack: How Buying a Trusted Reseller Became the Attack](/articles/ledger-cryptobilis-supply-chain-hack/) — An authorized Ledger reseller was secretly acquired, its devices implanted, and an estimated $72M–$90M drained from buyers. The full timeline of a textbook supply-chain takeover.
- [Fake Crypto Job Offers Explained: The $1.5B Hack That Started With One Recruiter Message](/articles/fake-crypto-job-offer-scams/) — How fake crypto job offers work: the Bybit/Safe breach, malicious coding tests, and the red flags every Web3 job seeker should know.
- [The $86M 'Ledger Hack': What the On-Chain Evidence Actually Shows](/articles/ledger-drain-address-poisoning/) — We independently traced the 10 flagged theft addresses in the October 9 Ledger wallet-draining reports. Verifiable losses: ~$27M — and Ledger's own response now points to a tampered-device supply chain, not a firmware breach.
- [Abstract Chain Is Shutting Down: Bridge Out Before December 15 or Lose Access](/articles/abstract-chain-shutdown-migration-guide/) — Igloo Inc., the parent of Pudgy Penguins, is shutting down its Abstract L2 on December 15, 2026. Funds not bridged out by then become inaccessible. Official exit routes, the fake-migration scam wave, and how this differs from Blast.
- [Crypto Task Scams Explained: How Easy-Money Jobs Turn Your Wallet Into a Money Mule](/articles/crypto-task-scam-money-mule/) — The task scam pays you first — that is the product. How the like-and-earn funnel documented by the FBI escalates into frozen withdrawals, and how the 'merchant account' job quietly turns your wallet into a laundering pipe for other victims' money.
- [Fake Crypto Support Scams Explained: Why Support That Contacts You First Is Always Fake](/articles/fake-customer-support-scams/) — The FBI-documented scam where 'exchange employees' call you about an account problem. How the fake-admin funnel works, the three ways it ends — phishing, a malicious signature, or remote access — and the one rule that filters all of it.
- [MetaMask Infrastructure Incident Explained: Why Your Wallet Was Never at Risk](/articles/metamask-infrastructure-incident-explained/) — MetaMask disclosed a security incident on September 30 that hit part of its Ethereum validator infrastructure. Around 17,000 validators holding roughly 523,000 ETH began exiting, and one researcher traced about 0.36 ETH in skimmed rewards. Yet wallets and funds were never exposed — because of how Ethereum splits validator keys from withdrawal keys. Here is the timeline, the architecture, and what actually deserves your attention.
- [Blast L2 Is Shutting Down: How to Withdraw Safely Before October 26](/articles/blast-l2-shutdown-withdrawal-guide/) — Blast announced on October 2, 2026 that it is winding down its Ethereum L2. Users have until October 26 to withdraw through the normal interface. Full timeline, the L1 bridge-contract path after the deadline, and the scam wave every shutdown attracts.
- [NEAR Intents Hack Explained: How a Signed-Note Bug Drained $3.87M](/articles/near-intents-hack-explained/) — NEAR Intents lost $3.87 million on October 1, 2026 when a bug in its Omni deposit-and-withdrawal system let an attacker withdraw funds with valid signed notes. Full timeline, where the money went, and why no user signature could have prevented it.
- [ClickFix Scam Explained: How a Fake CAPTCHA Drains Crypto Wallets](/articles/clickfix-fake-captcha-scam-explained/) — ClickFix shows you a fake CAPTCHA, then talks you into pasting one command into Run or Terminal. Here is the full chain, the on-chain dead drop, and what it does to wallets.
- [GIWA Fake RPC Scam: Full Forensics of a 771-ETH Fake Bridge Built From Verified Code](/articles/giwa-fake-rpc-bridge-scam-explained/) — 1331 depositors, 771 ETH, 14 hours. How a proxy pointing at verified OptimismPortal2 source, a fake RPC, and a coordinated distribution push drained users bridging to a mainnet that doesn't exist.
- [Bitget Hack Explained: $387M Moved Without a Single Private Key Stolen](/articles/bitget-hot-wallet-hack-explained/) — Bitget lost $387.5M (initially reported as $351.6M) when attackers spoofed transaction data inside its wallet backend. How the signing-layer attack worked, where the funds went, and what users should watch for.
- [Magic Eden Exploit Explained: A Dead Marketplace, Living Approvals, and a $5.7M Whitehat Rescue](/articles/magic-eden-payment-processor-exploit/) — NFTs left wallets for 0 ETH on September 25. The vulnerable contract was one Magic Eden stopped using in October 2024, but the approvals users gave it never expired.
- [Wallet Drained? What You Can Actually Do After a Drainer Attack](/articles/after-wallet-drainer-what-now/) — A drainer took your tokens or NFTs through a malicious signature. What still works — revocation, reporting, the recovery-scam second wave — and what does not.
- [Where Pig Butchering Money Actually Goes: Tracing a $73 Million Laundering Pipeline](/articles/pig-butchering-crypto-tracing/) — A pig butchering 'investment platform' shows you fake gains while your money is already moving. Inside a fully documented $73 million laundering pipeline: shell company bank accounts, a Bahamian bank, conversion to USDT, and a wallet that received $341 million. What each hop looks like on-chain, where tracing dies, and the evidence chain that actually gets cases worked.
- [FomoPeek Malware: How a Read-Only Whale Tracker Stole iOS Private Keys](/articles/fomopeek-app-malware-explained/) — FomoPeek passed App Store review as a read-only whale tracker, then shipped an iOS kernel exploit that decrypts the Keychain. Timeline, forensics, victim steps.
- [zkSNARKs Auction Cleared 12,000 ZEC. Here Is What the Winners Actually Hold](/articles/zksnarks-auction-what-bidders-bought/) — Zcash's zkSNARKs identity auction drew 16,971 bids and cleared at 1.5 ZEC; the secondary floor sits near 2 ZEC on Zilkroad. But with ZSA not on mainnet, ownership lives in a database — and the market data is unverifiable by design.
- [Zcash Cold Storage: How to Store ZEC Offline in 2026](/articles/zcash-cold-storage-guide/) — ZEC holders moving funds off exchanges face a fork in the road: transparent addresses work on any hardware wallet, shielded addresses mostly don't. What Trezor and Ledger actually support, three working cold-storage setups, and the scams targeting new Zcash users.
- [BNB Chain Token Safety: How to Avoid Scams on Binance's Chain](/articles/bnb-chain-token-safety/) — The SQUID token let people buy but never sell, and it ran on BNB Chain. Learn the specific scam patterns on BSC and the exact steps to verify any BEP-20 token before you buy.
- [Polygon Token Safety: How to Avoid Scams on the MATIC Chain](/articles/polygon-token-safety/) — Polygon's low fees and Ethereum association attract legitimate DeFi and every clone-token scam that follows. The exact steps to verify any Polygon token before you buy.
- [Zcash Whitelist Season: One Takes Your ZEC, One Takes Your Identity Map](/articles/zcash-whitelist-what-you-hand-over/) — ZecBit charged for a testnet NFT and left a 0.1 ZEC complaint in its wake. zaddr.net is free and asks for almost nothing. The second one is the more interesting case. Here is what each model actually collects.
- [Arc Mainnet Day-One Risks: Copycat Tokens and Fake Airdrops in the First Hours](/articles/arc-mainnet-day-one-risks/) — Arc, Circle's stablecoin L1, is live. One hour of on-chain data already shows duplicate-ticker copycats, +6,475% pumps, and fake-airdrop warnings. A field guide with real numbers.
- [Hormuz Strait Crypto Toll Scams: Fake 'Safe Passage' Messages, Explained](/articles/hormuz-strait-crypto-scam/) — As the Strait of Hormuz crisis drags on, shipping companies are receiving messages that promise safe transit in exchange for Bitcoin or USDT — sent by people impersonating Iranian officials. This is the rare crypto scam aimed at shipmasters and charterers rather than retail investors, and it works because Iran really is charging crypto tolls. How the extortion messages work, what's real and what's fake in the maritime payment landscape, how firms like TRM Labs trace the flows, and the verification checklist for anyone in logistics receiving a crypto transit demand.
- [Khabib's Crypto Deals, Explained: Gyms, NFTs, and the "Regulated Tokenization" Pitch](/articles/khabib-crypto-deals-explained/) — Searches for 'Khabib crypto scam' are spiking — but the honest answer is more interesting than a yes or no. Khabib Nurmagomedov's crypto history runs from GoMining's 'hashrate-backed' NFTs (2023) to a papakha NFT drop that drew backlash, to a Dubai deal with MultiBank Group promising a $10B 'regulated tokenized sports ecosystem' of 30+ gyms on the Mavryk blockchain. This guide separates what's documented from what's debated, explains what 'regulated tokenization' actually promises, and gives you the seven-question checklist for evaluating any celebrity token deal — the same one that would have flagged every celebrity coin that imploded.
- [The Telegram Crypto Pitch, Read Back to the Scammer: A Real Chat, Dissected Line by Line](/articles/telegram-crypto-pitch-script/) — A real Telegram solicitation captured this week: a stranger pitching a token 'launching tonight at 19:00 on Sushi, Base.' We annotate every beat of the script — and what happened when we pitched the same script back at him.
- [How to Report a Crypto Scam: IC3, Exchange Freeze Requests, and What Actually Happens After You File](/articles/how-to-report-crypto-scam/) — A field guide to reporting stolen crypto: how to assemble the evidence package, file the FBI IC3 complaint field by field, send exchange freeze requests that get read, and what to realistically expect after you hit submit.
- [Public Key vs Private Key vs Wallet Address: The Difference Scammers Hope You Never Learn](/articles/public-key-private-key-wallet-address/) — Every wallet scam that has ever worked relies on one thing: the victim not knowing which of the three wallet strings does what. The one-way chain from seed phrase to private key to public key to address, what leaking each one actually costs you, and the four attack patterns — fake verification, seed-phrase phishing, blind signing, and address poisoning — that exist only because people blur these boundaries.
- [Unbacked Mint Attacks: How Fake Receipts Drained Liquid Network and Symbiosis](/articles/unbacked-mint-attacks-explained/) — In one week of September 2026, two protocols lost real Bitcoin to the same trick: minting unbacked wrapped assets with fake deposit receipts. A field dissection of the Liquid Network and Symbiosis exploits.
- [Why You Should Never Generate a Seed Phrase Online](/articles/seed-phrase-generator-risk/) — Online seed phrase generators are one of two things: a phishing tool that logs or pre-loads the phrase it hands you, or a negligent service that produces unauditable randomness over an untrusted channel. How legitimate wallets generate phrases on-device, why the browser can't be trusted with creation, the chatbot variant of the same trap, and the burned-phrase protocol if you've already used one.
- [How to Store a Seed Phrase: Steel, Paper, Copies, and Inheritance](/articles/seed-phrase-storage/) — A seed phrase survives only if its backup survives everything you can't control — fire, flood, theft, a curious visitor, and your own memory. This guide covers the baseline that most people get wrong (paper done properly), why metal backups exist and what they actually protect against, the mistakes that turn a backup into a leak (photos, clouds, password managers, chat apps), how many copies to keep and where, and the inheritance problem that kills more crypto than thieves do. Companion piece to our guide on why seed phrases must never be generated online.
- [Where Stolen Crypto Goes Dark: Privacy Pools and What Tracing Can Still Do](/articles/stolen-crypto-privacy-pools/) — Stolen funds usually end their trail in a privacy layer. How mixers, Zcash shielded pools, and viewing keys change crypto fund tracing, and what victims can still realistically do.
- [When 'Encrypted' Is Just a Word: A 3-Step Reality Check for Crypto Privacy Claims](/articles/encrypted-claims-reality-check/) — A privacy-branded crypto project claimed its identities were encrypted. The page source told a different story. Here is the three-step check anyone can run before trusting a privacy claim.
- [Infostealer Malware Explained: How Stolen Sessions Drain Crypto Accounts](/articles/infostealer-malware-crypto-attacks/) — Infostealers grab browser cookies, saved passwords, and wallet vaults in seconds. The full crypto kill chain, the 2025 takedowns, and the defenses that work.
- [Crypto Stolen? The First 24 Hours: A Step-by-Step Emergency Runbook](/articles/stolen-crypto-first-24-hours/) — Your wallet was drained or your exchange account emptied. What you do in the next 24 hours decides whether the theft is survivable: triage the intrusion type, secure remaining assets in the right order, build the evidence package, and get freeze requests out before funds reach a mixer.
- [Airdrop Snapshot Scams: Why 'Verify Your Wallet Before the Deadline' Is Always Phishing](/articles/airdrop-snapshot-verification-scams/) — Real airdrop snapshots record on-chain state at a block height — no action from you, ever. Scam campaigns invert that mechanic with countdown timers and 'verify your wallet' pages riding real project announcements. How snapshots actually work, the deadline-pressure playbook, zombie campaigns that outlive their projects, and the rule that eligibility can always be checked without connecting a wallet.
- [Hardware Wallet Scams Explained: Fake Devices, Phishing Letters, and the Setup Traps](/articles/hardware-wallet-scams-explained/) — Hardware wallets are sold as the safest way to store crypto — until the purchase itself becomes the attack. Here are the six scam patterns, real cases, and a buy-side checklist.
- [Fake Crypto Wallet Apps: How Scam Wallets in App Stores Steal Funds](/articles/fake-crypto-wallet-apps/) — Fake wallet apps and malicious browser extensions pass app store review, carry five-star reviews, and harvest seed phrases from the first 'import' screen. How the distribution works, the four theft mechanisms hidden inside fake wallets, why store presence proves nothing, and the verification steps before trusting any wallet with funds.
- [Crypto Scams on X, Telegram, and Email: The Full Attack Chain Explained](/articles/social-media-crypto-scam-playbook/) — Fake moderator DMs that install Windows malware, Telegram friends who slowly sell you a honeypot, airdrop emails from lookalike domains — how the social engineering playbook works at each step.
- [How to Read a Smart Contract Audit Report: A Practical Guide](/articles/how-to-read-a-smart-contract-audit-report/) — An audit badge tells you almost nothing on its own. Learn how to read scope, severity levels, and fix statuses in a smart contract audit report — and spot the projects that only look audited.
- [Telegram Airdrop Bot Scams: How Tap-to-Earn Games Drain Real Wallets](/articles/telegram-airdrop-bot-scams/) — Tap-to-earn games like Notcoin, DOGS, and Hamster Kombat onboarded tens of millions of Telegram users to crypto airdrops — and scammers industrialized fake bots and mini-apps to hunt them. The five scam patterns inside Telegram airdrop bots, how legitimate campaigns actually work, and the checks that separate a real bot from a wallet drainer.
- [SIM Swap Attacks Explained: How Phone Number Theft Drains Crypto Accounts](/articles/sim-swap-attacks-explained/) — SIM swapping lets attackers take over your phone number, then your exchange accounts. Here's the full attack chain, real cases, and the defenses that actually stop it.
- [Clipboard Hijacking Malware Explained: When Copy-Paste Steals Your Crypto](/articles/clipboard-hijacking-malware-explained/) — Clipboard hijackers silently swap the wallet address you copy for one controlled by the attacker. We explain how the malware works, the documented campaigns from the 2.3-million-address 2018 operation to modern clipboard-injector kits, and the two-second habit that defeats all of them.
- [Pig Butchering Scams Explained: The On-Chain Anatomy of Romance Investment Fraud](/articles/pig-butchering-scams-explained/) — Pig butchering is the single highest-loss cybercrime category in the FBI's IC3 data. We break down how the grooming funnel works, what the fake trading platforms actually do to your deposits, and what the money trail looks like on-chain.
- [How to Detect NFT Wash Trading: A Practical On-Chain Workflow](/articles/how-to-detect-nft-wash-trading/) — NFT wash trading fakes volume and floor prices to bait organic buyers. This guide gives a step-by-step detection workflow — token ID recycling, funding forensics, round-trip cost math — with the on-chain signals that hold up.
- [Anatomy of the Biggest Airdrop Scams: How Fake Claim Sites Actually Work](/articles/biggest-airdrop-scams-anatomy/) — Fake airdrop claim sites drained $494M from users in 2024 alone. We take apart the biggest operations — Inferno Drainer's 16,000-domain network, the $1.25M Polygon NFT airdrop phishing wave, and the Cointelegraph pop-up attack — to show the machine behind the losses.
- [How Stolen Crypto Is Actually Recovered: The Real Process Behind the Headlines](/articles/how-stolen-crypto-is-recovered/) — Crypto transactions can't be reversed — yet law enforcement has recovered billions in stolen crypto. Here's the actual recovery pipeline, real cases, and what victims should do in the first 48 hours.
- [How to Claim an Airdrop Safely: The Burner Wallet Workflow](/articles/how-to-claim-airdrops-safely/) — A step-by-step claim workflow that survives fake sites and hijacked channels: verify the announcement independently, decide the URL before the frenzy, claim with a dedicated wallet, read the signature, then revoke approvals after. The habits, in order of leverage.
- [The Airdrop Safety Checklist: 12 Checks Before You Connect a Wallet](/articles/airdrop-safety-checklist/) — Every airdrop safety check from our series in one printable list — source verification, URL discipline, contract inspection, signature reading, wallet isolation, and post-claim cleanup. Run it top to bottom; any single failed check is a stop.
- [EIP-7702 Airdrop Phishing: One Signature, Total Wallet Control](/articles/eip-7702-airdrop-phishing/) — Ethereum's Pectra upgrade gave EOAs optional contract code via EIP-7702 delegation — and drainer kits adopted it within weeks. The first documented victim lost about $147,000 to a single malicious 7702 batched transaction in May 2025. How the delegation attack works, how it appears in your wallet, and why claim pages are the main delivery vector.
- [Testnet Airdrop Safety: How to Farm Testnets Without Getting Drained](/articles/testnet-airdrop-safety/) — Testnet airdrop farming is the cheapest retroactive airdrop strategy — and scammers know it. Here's how testnet drainers differ from mainnet ones, which risks are real (fake testnet sites, seed phrase harvesters, mainnet contract bait-and-switch), and a safe workflow for every testnet season.
- [Airdrop Scam Checker: Verify Any Airdrop On-Chain in 5 Steps](/articles/airdrop-scam-checker/) — Before you connect a wallet to any airdrop claim site, run it through an on-chain checklist: contract age, deployer history, holder distribution, approval permissions, and domain verification. Here's the exact 5-step verification workflow with free tools — no paid scanners needed.
- [Airdrop Signature Scams: Why the Claim Button Is the Dangerous Part](/articles/airdrop-signature-scams/) — Fake airdrop pages do not steal your seed phrase — they harvest signatures. A plain-English comparison of the four signature types a claim site can request (token approvals, permit2, permit signatures, eth_sign) and exactly what each one lets an attacker do to your wallet.
- [Airdrop Eligibility Checker Phishing: How Fake Checkers Harvest Wallets](/articles/airdrop-eligibility-checker-phishing/) — Every airdrop season spawns hundreds of 'check your eligibility' sites — and most of them are phishing. How fake checkers work (wallet-connect harvesting, seed phrase 'verification', signature-on-check), why lookalike domains are registered weeks before the real announcement, and how to verify eligibility without connecting anything.
- [How to Audit Your Own Wallet: A Step-by-Step On-Chain Security Review](/articles/how-to-audit-your-wallet-activity/) — Your wallet's transaction history reveals every contract you've touched, every approval you've signed, and every signature you've given. Here's how to audit your own wallet activity using free on-chain tools.
- [Token Taxes Explained: How Buy/Sell Fees Work and When They Become a Trap](/articles/token-taxes-explained/) — Token taxes (buy/sell fees) are common in DeFi. Learn how they work, why legitimate projects use them, how scammers weaponize them as hidden honeypots, and how to check tax rates before buying.
- [Unsolicited Airdrop Tokens in Your Wallet: The Claim Trap Explained](/articles/unsolicited-airdrop-tokens/) — Tokens and NFTs appearing in your wallet that you never signed up for are not gifts — they are bait. How airdrop-bait spam works (fake claim sites, 'import token' tricks, dusting, and address poisoning), what happens if you interact, and the only correct response.
- [How Fake Airdrops Reach You: Hijacked Accounts, Discord Bots, and Compromised News Sites](/articles/fake-airdrop-distribution-channels/) — Fake airdrop sites do not find victims by luck. They arrive through five proven channels — hijacked X accounts, Discord and Telegram bots, paid search ads, fake live streams, and compromised media sites like the June 2025 Cointelegraph incident. Here is how each channel works and where it breaks.
- [Crypto Recovery Scams Explained: How Fake Recovery Services Target Scam Victims](/articles/crypto-recovery-scams-explained/) — Lost crypto to a scam? Recovery scammers are watching. Learn how fake 'fund recovery' services target victims and the red flags that expose them.
- [Arbitrum Token Safety: How to Avoid Scams on Arbitrum](/articles/arbitrum-token-safety/) — Arbitrum's low fees and growing DeFi ecosystem attract scammers. Learn the specific risks of buying tokens on Arbitrum and the exact steps to verify any token before you invest.
- [Solana Token Safety: How to Avoid Scams on Solana](/articles/solana-token-safety/) — Solana's low fees and memecoin culture attract scammers. Learn the specific risks of buying SPL tokens on Solana and the exact steps to verify any token before you invest.
- [Base Chain Token Safety: How to Avoid Scams on Coinbase's Layer 2](/articles/base-chain-token-safety/) — Base's low fees attract developers and scammers alike. Learn the specific risks of buying tokens on Base L2 and the exact steps to verify any token before you invest.
- [How to Check if Liquidity Is Locked: A Step-by-Step Guide for Token Buyers](/articles/how-to-check-liquidity-locked/) — Unlocked liquidity means developers can pull all funds at any time. Learn how to verify liquidity locks, read lock contracts, and avoid rug pulls before you buy.
- [Crypto Dusting Attacks Explained: How Tiny Transactions Expose Your Identity](/articles/crypto-dusting-attacks-explained/) — Dusting attacks send tiny amounts of crypto to thousands of wallets to trace transactions and de-anonymize users. Learn how they work and how to protect yourself.
- [Blind Signing Explained: The Hidden Risk in Every Hardware Wallet Transaction](/articles/blind-signing-explained/) — Blind signing lets hardware wallets approve complex smart contract interactions without showing what they do. It's the reason users lose millions after confirming transactions they couldn't read. Learn what blind signing is, why wallets force you to use it, and how to protect yourself.
- [ETH sign Phishing Explained: The Deprecated Method Still Draining Wallets](/articles/eth-sign-phishing-explained/) — eth_sign is the most dangerous signing method in Ethereum — it can sign raw transactions that drain your entire wallet. Despite being deprecated by most wallets, scammers still weaponize it. Learn how eth_sign phishing works, why it's different from personal_sign, and how to know if your wallet is vulnerable.
- [How to Prevent Wallet Drainer Attacks: A Complete Defense Framework](/articles/how-to-prevent-wallet-drainers/) — Knowing how to spot a wallet drainer isn't enough — you need active defenses that stop attacks before they happen. From wallet segregation to approval hygiene to real-time monitoring, learn the full stack of preventive measures that keep your assets safe.
- [Infinite Approval Explained: Why Unlimited Token Approvals Are a Ticking Time Bomb](/articles/infinite-approval-explained/) — Every time you approve a token swap, you may be granting unlimited spending permission to a smart contract. Infinite approvals are the silent vulnerability in most DeFi wallets. Learn why unlimited approvals exist, how attackers exploit them, and how to audit and revoke dangerous approvals.
- [Permit2 Phishing Explained: How One Free Signature Can Drain an Entire Wallet](/articles/permit2-exploit-explained/) — Uniswap's Permit2 contract lets you approve tokens with a single signature — but scammers weaponize it to drain entire wallets. Learn how the Permit2 universal approval works, why it's more dangerous than standard ERC-20 approvals, and how to protect yourself.
- [Crypto Signature Scams: How One Signature Can Drain Your Wallet](/articles/signature-scam-explained/) — Crypto signature scams trick users into signing malicious messages that look harmless. From fake verification prompts to disguised permit signatures, learn every variant of signature-based attacks and how to verify what you're actually signing.
- [Wash Trading Detection: How to Spot Fake Volume on DEXs and NFT Markets](/articles/wash-trading-detection-explained/) — Wash trading inflates up to 80% of volume on some crypto platforms. Learn how to detect fake trading volume using on-chain analysis — wallet pair analysis, volume-to-liquidity ratios, and time-pattern detection.
- [Crypto Airdrop Scams Explained: How to Spot and Avoid Fake Airdrops](/articles/crypto-airdrop-scams-explained/) — Airdrop scams have stolen over $100M from users through fake claim sites, permit phishing, and malicious token airdrops. Learn how these scams work and how to verify legitimate airdrops using on-chain analysis.
- [Token Unlocks Explained: How Vesting Schedules Move Markets and How to Track Them](/articles/token-unlocks-explained/) — Token unlocks release billions in previously locked tokens each year, creating predictable sell pressure and price volatility. Learn how vesting schedules work, why unlocks move prices, and how to track upcoming unlock events using on-chain data.
- [DeFi Yield Farming Risks: How to Evaluate Opportunities Safely](/articles/defi-yield-farming-risks/) — Yield farming can generate 50%+ APY — or wipe out your entire deposit. Learn the six major risks of DeFi yield farming, how to evaluate protocols before depositing, and red flags that separate sustainable yields from traps.
- [ERC-20 Token Security Check: A Developer's Guide to Auditing Any Token Contract](/articles/erc20-token-security-check/) — Learn how to audit ERC-20 token contracts for hidden risks — transfer restrictions, mint functions, proxy upgrades, allowance abuse, and event log manipulation. Includes code patterns for each attack vector.
- [Is This Token a Scam? How to Check Any Crypto Token Before Buying](/articles/is-this-token-a-scam/) — Before you buy any token, run this 6-step on-chain safety check. Source verification, liquidity locks, holder distribution, hidden mint functions, tax checks, and transaction history — all using free tools.
- [How to Track Stolen Crypto: A Guide to Blockchain Forensics](/articles/how-to-track-stolen-crypto/) — Cryptocurrency theft is traceable because blockchains are public ledgers. Learn how blockchain forensics works, the tracing methods investigators use, how thieves try to hide with mixers and chain-hopping, and what to do if your crypto is stolen.
- [AI-Powered Crypto Scams in 2026: How Artificial Intelligence Became the Top Attack Weapon](/articles/ai-powered-crypto-scams-2026/) — AI now writes phishing messages, clones websites, and generates deepfakes for crypto scams. Learn how AI-driven attacks work and how to protect yourself.
- [DeFi Liquidation Cascades Explained: How Cascading Liquidations Trigger Market Crashes](/articles/defi-liquidation-cascades-explained/) — Liquidation cascades occur when forced liquidations in DeFi lending protocols trigger a chain reaction of further liquidations, collapsing collateral values and amplifying price drops. Learn how liquidation mechanics work in Aave and Compound, why cascading liquidations caused the 2022 DeFi crisis, how to detect liquidation cascades on-chain, and how to protect your positions from cascading liquidation risk.
- [Kelp DAO Hack Explained: How a 1-of-1 DVN Configuration Let Attackers Forge $292M in Fake rsETH](/articles/kelp-dao-hack-explained/) — The largest DeFi hack of 2026: how attackers exploited Kelp DAO's LayerZero bridge configuration to mint $292M in unbacked rsETH in under an hour.
- [NPM Supply Chain Attacks: How Compromised Packages Are Stealing Crypto Wallets in 2026](/articles/npm-supply-chain-attacks-2026/) — From Axios to Injective SDK, npm supply chain attacks are the fastest-growing threat to crypto developers. Here is how they work and how to defend your team.
- [Slippage Attacks Explained: How MEV Bots Exploit Price Movement During Transaction Execution](/articles/slippage-attacks-explained/) — Slippage attacks exploit the delay between when a user submits a transaction and when it executes on-chain. MEV bots monitor the mempool, front-run large trades, and manipulate token prices to extract value from unsuspecting traders. Learn how sandwich attacks work, why slippage tolerance settings matter, the Wormhole and Cream Finance incidents, and how to protect yourself when trading on decentralized exchanges.
- [Proxy Contract Upgrade Attacks Explained: How Upgrade Patterns Became Attack Vectors](/articles/proxy-upgrade-attacks-explained/) — Proxy contract upgrade attacks exploit the separation between a proxy contract and its logic implementation — when an attacker gains control of the upgrade function, they can replace trusted logic with malicious code and drain every contract in the system. Learn how the Parity Wallet multi-sig freeze, the Wormhole initialization bug, and the Uranium Finance 72x bug worked — why delegatecall is dangerous, how storage slot collisions enable hidden exploits, and what the UUPS vs Transparent vs Beacon proxy patterns mean for security.
- [Integer Overflow and Underflow Attacks Explained: How Math Bugs Broke Smart Contracts](/articles/integer-overflow-attacks-explained/) — Integer overflow and underflow attacks exploit how the EVM handles arithmetic — when a number exceeds its maximum or drops below zero, it wraps around silently. Attackers used this to mint quadrillions of tokens, bypass balance checks, and drain contracts. Learn how the BEC token incident, the SMT hack, and the Poolz exploit worked — why Solidity 0.8.0 changed everything with built-in overflow checks, and why some contracts are still vulnerable today.
- [Bridge Attacks Explained: How Cross-Chain Bridges Became Crypto's Biggest Vulnerability](/articles/bridge-attacks-explained/) — Cross-chain bridges move billions in value between blockchains — and attackers have stolen over $2.5 billion from them. Learn how bridge attacks work: validator key theft, fake deposit exploits, signature threshold manipulation, and the design flaws that make bridges the single most exploited category in Web3 security.
- [Sybil Attacks Explained: How Fake Identities Undermine Decentralized Systems](/articles/sybil-attacks-explained/) — A Sybil attack creates fake identities to gain disproportionate influence over a decentralized network. Learn how Sybil attacks target voting, airdrops, staking, and reputation systems — how bots, multi-wallet farming, and AI agents amplify the threat, and how networks fight back with proof-of-personhood, stake-based voting, and behavioral analysis.
- [Access Control Attacks Explained: How Broken Permissions Let Attackers Drain Smart Contracts](/articles/access-control-attacks-explained/) — Access control attacks exploit smart contracts with missing or incorrect permission checks — letting unauthorized users mint tokens, drain funds, or seize ownership. Learn how these attacks work, common vulnerability patterns like missing onlyOwner and tx.origin misuse, how to detect them, and how to protect your contracts.
- [Front-Running Attacks Explained: How Predatory Traders Profit from Your Pending Transactions](/articles/front-running-attacks-explained/) — A front-running attack exploits the transparency of the public mempool — attackers see your pending transaction, then submit their own with higher gas to get processed first. Learn how front-running works, how it differs from sandwich attacks, why it is so hard to eliminate, and how to protect yourself.
- [Governance Attacks Explained: How Attackers Exploit DAO Voting to Steal Millions](/articles/governance-attacks-explained/) — A governance attack exploits weaknesses in a DAO's voting mechanism to pass malicious proposals — draining treasuries, minting tokens, or seizing control of protocol parameters. Learn the five main attack vectors: flash loan voting, delegation hijacking, proposal smuggling, parameter manipulation, and contract upgrade exploitation.
- [Reentrancy Attacks Explained: The Smart Contract Vulnerability That Started It All](/articles/reentrancy-attacks-explained/) — Reentrancy is the most famous smart contract vulnerability in blockchain history — the attack that drained The DAO in 2016 and nearly broke Ethereum. Learn how reentrancy works mechanically, why it is still dangerous today, the different attack patterns, and how the checks-effects-interactions pattern prevents it.
- [Rug Pulls Explained: How Liquidity Pulls and Hidden Mint Functions Drain Your Wallet](/articles/rug-pulls-explained/) — A rug pull is when a crypto project's developers suddenly remove all liquidity from their token's trading pool or abandon the project after collecting investor funds. Learn the three main types of rug pulls — liquidity pulls, hidden mint functions, and sell restrictions — how they work mechanically, famous cases, and how to detect them before you buy.
- [Flash Loan Attacks Explained: How Borrowed Billions Exploit DeFi](/articles/flash-loan-attacks-explained/) — Flash loans let anyone borrow unlimited capital with zero collateral — as long as it's repaid in the same transaction. This unique DeFi primitive has become the weapon of choice for attackers. Learn how flash loan attacks work, why they're so dangerous, and how to identify protocols vulnerable to them.
- [Sandwich Attacks Explained: How MEV Bots Front-Run and Back-Run Your Trades](/articles/sandwich-attacks-explained/) — Sandwich attacks are the most common MEV exploit on decentralized exchanges. An MEV bot watches your pending trade in the mempool, buys before you to push the price up, then sells immediately after — profiting from the price difference you created. Learn how sandwich attacks work mechanically, why slippage tolerance matters, and how to protect yourself.
- [Oracle Manipulation Attacks in DeFi: How Price Feeds Get Exploited](/articles/oracle-manipulation-defi/) — Oracle manipulation is one of the most devastating attack vectors in DeFi — attackers use flash loans to warp price feeds, then exploit protocols that trust them. Learn how these attacks work, how to spot risky oracle setups, and what on-chain indicators to check before depositing.
- [DeFi Protocol Red Flags: How to Spot Risky Protocols Before You Deposit](/articles/defi-protocol-red-flags/) — Not all DeFi protocols are safe. Learn the technical and economic red flags — unaudited contracts, suspicious tokenomics, liquidity traps, and governance risks — that signal a protocol may not be trustworthy.
- [How to Avoid Crypto Phishing Scams: A Complete Defense Guide](/articles/how-to-avoid-crypto-phishing-scams/) — Crypto phishing scams have stolen over $1 billion from wallet users. Learn how phishing sites, malicious approvals, and fake airdrops work — and how to protect your wallet with practical defenses.
- [Address Poisoning Attacks: How They Work and How to Avoid Them](/articles/address-poisoning-attacks-explained/) — Address poisoning tricks users into sending funds to scammer-controlled addresses that look identical to their frequent contacts. Learn how the attack works, real examples, and how to protect yourself.
- [How to Spot Wallet Drainers: A Field Guide to Malicious dApps](/articles/how-to-spot-wallet-drainers/) — Wallet drainers steal millions by tricking users into signing malicious transactions. Learn to identify drainer sites, understand their techniques, and build habits that keep your assets safe.
- [Cross-Chain Bridge Security: Understanding and Analyzing Bridge Risks](/articles/bridge-security-explained/) — Blockchain bridges are the #1 target for hackers, with over $2.8 billion stolen. Learn how cross-chain bridges work, why they fail, and how to assess bridge security before trusting them with your assets.
- [Token Approval Safety: How to Audit and Revoke Smart Contract Permissions](/articles/token-approval-safety/) — Every token approval grants a smart contract permission to move your tokens. Learn how token approvals work, why unlimited approvals are dangerous, and how to audit and revoke them before they're exploited.
- [Address Risk Scoring: How to Read the Signs of a Dangerous Wallet](/articles/address-risk-scoring-explained/) — Learn how address risk scoring works — phishing associations, sanctions, money laundering links, and smart contract interactions. Spot dangerous wallets before you interact.
- [How to Verify a Token Before Buying: A Complete On-Chain Safety Checklist](/articles/how-to-verify-a-token-before-buying/) — Before buying any token, run this on-chain safety checklist — contract source verification, liquidity locks, holder distribution, tax checks, and honeypot detection. Free tools included.
- [How to Spot Rug Pulls and Honeypots On-Chain Before You Lose Money](/articles/spotting-rug-pulls-and-honeypots/) — Rug pulls and honeypots drain millions from crypto users every year. Learn the on-chain red flags — liquidity locks, contract permissions, token supply — that reveal scams before you invest.
- [MEV Explained: Maximal Extractable Value and How It Affects Your Transactions](/articles/mev-explained/) — MEV is the hidden tax on every DeFi transaction. Learn how maximal extractable value works, who profits from it, and how to protect yourself from sandwich attacks and front-running.
- [Building Your On-Chain Analysis Workflow: A Complete Tool Stack Guide](/articles/on-chain-analysis-workflow/) — A step-by-step workflow for on-chain analysis — from beginner to practitioner. Covers tools, daily routines, alerting, and how to turn raw blockchain data into actionable insights.
- [Stablecoin Depegging: What It Means and How to Spot the Signs On-Chain](/articles/stablecoin-depegging/) — When a stablecoin loses its peg, millions can vanish in minutes. Learn how depegging works, what causes it, and how to spot early warning signs using on-chain data.
- [How to Analyze Token Distribution: Concentration, Whales, and Risk](/articles/analyzing-token-distribution/) — Token distribution tells you who holds the power. Learn how to assess concentration, spot whale risk, and evaluate whether a token's supply is healthy or dangerous.
- [Reading Smart Contract Events and Logs: A Practical Guide](/articles/reading-smart-contract-events/) — Smart contract events and logs are the on-chain record of everything that happens in a DeFi protocol. Learn how to read, filter, and analyze them for on-chain analysis.
- [Token Flow Analysis: Following the Money Trail on the Blockchain](/articles/token-flow-analysis/) — Token flow analysis traces how tokens move between wallets, exchanges, and protocols over time. Learn the methodology, tools, and patterns that reveal what's really happening behind the scenes.
- [Exchange Inflows & Outflows: What They Tell You About Market Sentiment](/articles/exchange-inflows-and-outflows/) — When tokens move to or from exchanges in large volumes, it signals market sentiment. Learn how to read exchange inflows and outflows as on-chain indicators.
- [How to Track Whale Wallets: Free Tools and Methodology](/articles/how-to-track-whale-wallets/) — Whale wallets move markets. Learn how to identify, label, and track large crypto holders using free tools — from finding smart money to setting up real-time alerts.
- [On-Chain Indicators That Matter: MVRV, NVT, SOPR & More Explained](/articles/on-chain-indicators/) — On-chain indicators like MVRV, NVT, SOPR, and the Puell Multiple help you assess whether a crypto asset is overvalued or undervalued. Learn what each metric means and how to use it.
- [Wallet Labels: How to Identify Who Owns What on the Blockchain](/articles/wallet-labels/) — Wallet labels help you identify exchange wallets, smart contracts, whales, and team addresses on block explorers. Learn how to read and use them for on-chain analysis.
- [How to Read a Blockchain Explorer: Etherscan Step by Step](/articles/how-to-read-a-blockchain-explorer/) — A block explorer is your primary window into the blockchain. Learn to read addresses, transactions, smart contracts, and event logs on Etherscan — explained for absolute beginners.
- [What Is On-Chain Analysis? A Complete Beginner's Guide](/articles/what-is-on-chain-analysis/) — On-chain analysis is the practice of reading blockchain data to understand market trends, track money flow, and identify risks. Here's everything you need to get started.
- [Understanding Gas Fees: Why Transactions Cost What They Cost](/articles/understanding-gas-fees/) — A deep dive into how gas fees work on Ethereum and L2s, what factors drive prices, and how to minimize your costs.

## Glossary — Complete Index

### Consensus
- [Byzantine Fault Tolerance](/glossary/bft/) — A property of distributed systems that can continue operating correctly even when up to one-third of participants act maliciously or fail arbitrarily.
- [Finality](/glossary/finality/) — The point at which a blockchain transaction becomes irreversible, guaranteeing it will not be reversed or altered by future blocks.
- [Proof of Stake (PoS)](/glossary/proof-of-stake/) — A consensus mechanism where validators are chosen to produce blocks based on the amount of cryptocurrency they have staked.
- [Proof of Work (PoW)](/glossary/proof-of-work/) — A consensus mechanism where miners compete to solve cryptographic puzzles to validate blocks, securing the network through computational energy.
- [Slashing](/glossary/slashing/) — The punishment mechanism in proof-of-stake where validators lose staked funds for proven misbehavior or attacks.
- [Validator](/glossary/validator/) — A network participant in proof-of-stake blockchains who proposes and attests blocks in exchange for rewards.

### DeFi
- [Algorithmic Stablecoin](/glossary/algorithmic-stablecoin/) — A stablecoin that maintains its peg through algorithmic mint/burn and incentive mechanics rather than fiat or crypto collateral.
- [AMM (Automated Market Maker)](/glossary/amm/) — A protocol that prices assets algorithmically using a liquidity pool, replacing traditional order books.
- [APR (Annual Percentage Rate)](/glossary/apr/) — The yearly interest rate earned or paid on crypto assets, expressed as a simple (non-compounding) percentage.
- [APY (Annual Percentage Yield)](/glossary/apy/) — The effective annual rate of return on an investment, accounting for compounding interest.
- [Block Builder](/glossary/block-builder/) — A specialized entity in Ethereum's PBS system that constructs optimized blocks from MEV searcher bundles and competes to have their block selected by validators.
- [Bridge](/glossary/bridge/) — A protocol that enables assets and data to move between different blockchain networks.
- [Collateral Factor](/glossary/collateral-factor/) — The percentage of an asset's value a lending protocol lets you borrow against — for example, 75% means $100 of collateral backs up to $75 of borrowing.
- [Cross-Chain Bridge](/glossary/cross-chain-bridge/) — A protocol that transfers assets and messages between independent blockchains, typically by locking assets on one chain and minting representations on another.
- [DeFi (Decentralized Finance)](/glossary/defi/) — Financial services built on blockchain smart contracts that operate without intermediaries, including lending, borrowing, trading, and yield generation.
- [DEX (Decentralized Exchange)](/glossary/dex/) — A peer-to-peer marketplace for trading cryptocurrencies without intermediaries, using smart contracts instead of order books.
- [EigenLayer (Restaking)](/glossary/eigenlayer/) — The leading Ethereum restaking protocol that lets staked ETH be reused to secure additional services (AVSs) for extra yield and extra risk.
- [Flash Loan](/glossary/flash-loan/) — An uncollateralized loan that must be borrowed and repaid within a single blockchain transaction.
- [Flashbots](/glossary/flashbots/) — A research and development organization that created a private transaction relay system to reduce MEV's negative impact on Ethereum users.
- [Impermanent Loss](/glossary/impermanent-loss/) — The temporary loss liquidity providers face when token prices diverge from their deposit ratio.
- [Interest Rate Model](/glossary/interest-rate-model/) — The algorithmic function a lending protocol uses to set borrow and supply rates based on how much of the pool's liquidity is currently borrowed.
- [Lending Protocol](/glossary/lending-protocol/) — A DeFi platform where users can lend crypto to earn interest or borrow against crypto collateral.
- [Liquid Staking](/glossary/liquid-staking/) — Staking ETH through a protocol that issues a liquid token (LST) representing your staked position, enabling DeFi use without unbonding.
- [Liquidation](/glossary/liquidation/) — The forced sale of collateral when a borrower's loan position falls below the required collateralization ratio.
- [Liquidity Mining](/glossary/liquidity-mining/) — A DeFi incentive program that distributes protocol tokens to users who supply liquidity or use a protocol, rewarding early participation.
- [Liquidity Pool](/glossary/liquidity-pool/) — A smart contract holding token reserves that enables decentralized trading without an order book.
- [Liquidity Provider](/glossary/liquidity-provider/) — A user who deposits tokens into a liquidity pool in exchange for trading fees and LP tokens.
- [Maximal Extractable Value (MEV)](/glossary/mev/) — The profit extractable by reordering, including, or excluding transactions within a block.
- [MEV Bot](/glossary/mev-bot/) — Automated software that monitors the blockchain mempool for profitable trading opportunities, executing arbitrage, liquidation, and sandwich attacks within milliseconds.
- [Oracle](/glossary/oracle/) — A service that delivers off-chain real-world data (prices, weather, sports results) to on-chain smart contracts.
- [Overcollateralization](/glossary/overcollateralization/) — The practice of pledging collateral worth more than the borrowed amount, required by DeFi lending protocols to secure loans.
- [Price Impact](/glossary/price-impact/) — The percentage change in an asset's market price caused by a single trade's size relative to the available liquidity in an automated market maker pool.
- [Real-World Assets (RWA)](/glossary/rwa/) — Physical or traditional financial assets tokenized on a blockchain, bringing off-chain value (real estate, treasuries, commodities) on-chain.
- [Reserve Factor](/glossary/reserve-factor/) — The share of interest paid by borrowers that a lending protocol redirects to its own reserve treasury rather than to suppliers.
- [Restaking](/glossary/restaking/) — Restaking ETH to secure additional protocols beyond Ethereum consensus, earning extra rewards but taking on additional slashing risk.
- [Searcher (MEV)](/glossary/searcher/) — An automated bot or operator that monitors the blockchain for MEV opportunities and submits optimized transaction bundles to block builders.
- [Slippage](/glossary/slippage/) — The difference between the expected price of a trade and the actual executed price.
- [Stablecoin Reserve](/glossary/stablecoin-reserve/) — The assets backing a stablecoin's value, held by the issuer as collateral to guarantee redemption at the pegged price.
- [Staking](/glossary/staking/) — Locking cryptocurrency to secure a proof-of-stake network and earn rewards in return.
- [Staking Pool](/glossary/staking-pool/) — A service that combines many users' stake into a single validator set, letting small holders participate in proof-of-stake rewards without the minimum 32 ETH.
- [Total Value Locked (TVL)](/glossary/tvl/) — The total amount of assets deposited in a DeFi protocol, the key metric for measuring adoption.
- [TWAP (Time-Weighted Average Price)](/glossary/twap/) — A pricing method that averages an asset's price over a specified time period, used to reduce slippage in large trades and resist oracle manipulation.
- [Wrapped BTC (WBTC)](/glossary/wrapped-btc/) — An ERC-20 token representing Bitcoin on Ethereum, backed 1:1 by BTC held by a centralized custodian under a merchant-custodian model.
- [Wrapped ETH (WETH)](/glossary/wrapped-eth/) — An ERC-20 token representing native ETH 1:1, enabling ETH to interact with smart contracts and DeFi protocols that require the ERC-20 standard.
- [Wrapped Token](/glossary/wrapped-token/) — A tokenized version of a cryptocurrency on a different blockchain, backed 1:1 by the original asset held in reserve.
- [Yield Aggregator](/glossary/yield-aggregator/) — A DeFi protocol that automatically moves deposited funds across yield sources and compounds rewards to maximize returns for users.
- [Yield Farming](/glossary/yield-farming/) — Strategically providing liquidity to DeFi protocols in exchange for token rewards, interest, and trading fees.

### General
- [Airdrop](/glossary/airdrop/) — The distribution of free cryptocurrency tokens to wallet addresses, used to bootstrap adoption, reward early users, or decentralize governance.
- [Arbitrage](/glossary/arbitrage/) — The practice of profiting from price differences of the same asset across different markets or exchanges, a core mechanic in crypto trading and MEV.
- [Base Fee](/glossary/base-fee/) — The protocol-determined minimum gas price on Ethereum post-EIP-1559, which automatically adjusts based on network demand and is permanently burned.
- [Blob (EIP-4844)](/glossary/blob/) — A new data storage type on Ethereum introduced by EIP-4844 (Proto-Danksharding) that provides cheaper storage for Layer 2 rollup data.
- [Block](/glossary/block/) — A container holding a batch of verified transactions, linked to previous blocks to form a chain.
- [Block Confirmation](/glossary/block-confirmation/) — The number of blocks added to a chain after your transaction's block, reducing the probability of reversal.
- [Block Explorer](/glossary/block-explorer/) — A web-based search engine for blockchain data, allowing anyone to look up transactions, addresses, blocks, and smart contract interactions.
- [Burn Address](/glossary/burn-address/) — A cryptographic address with no known private key, used to permanently destroy cryptocurrency tokens by making them unspendable.
- [CBDC (Central Bank Digital Currency)](/glossary/cbdc/) — A digital form of sovereign currency issued and controlled directly by a central bank.
- [CEX (Centralized Exchange)](/glossary/cex/) — A cryptocurrency trading platform operated by a central entity that holds custody of user funds, such as Binance, Coinbase, or Kraken.
- [Cliff (Vesting)](/glossary/cliff/) — A lockup period at the start of a vesting schedule during which no tokens are released, ensuring long-term commitment from team and investors.
- [Consensus Mechanism](/glossary/consensus-mechanism/) — The algorithm that enables distributed nodes in a blockchain network to agree on the state of the ledger without trusting each other.
- [Copy Trading](/glossary/copy-trading/) — A feature that automatically replicates another trader's positions in your account, popular on both CEXs and DEXs for following successful or 'smart money' wallets.
- [Decentralized Application (DApp)](/glossary/dapp/) — An application whose backend runs on a decentralized blockchain network instead of centralized servers.
- [Difficulty Adjustment](/glossary/difficulty-adjustment/) — The protocol mechanism that automatically recalibrates how hard it is to mine a new block, keeping block production rate stable.
- [EIP-1559](/glossary/eip-1559/) — An Ethereum improvement proposal that reformed gas fee pricing by introducing a base fee that is burned, making ETH potentially deflationary.
- [Epoch](/glossary/epoch/) — A unit of time in Ethereum's Proof of Stake system consisting of 32 slots (6.4 minutes), used for validator committee assignments and finality checkpoints.
- [Fork](/glossary/fork/) — A change to a blockchain's protocol rules that creates a divergence in the network, either resulting in two separate chains or a unified upgrade.
- [Fraud Proof](/glossary/fraud-proof/) — A cryptographic guarantee used in optimistic rollups where anyone can challenge an invalid state transition by submitting evidence of fraud.
- [Gas Fee](/glossary/gas-fee/) — The cost of executing a transaction on a blockchain, paid to validators or miners.
- [Gas Limit](/glossary/gas-limit/) — The maximum amount of gas units a user is willing to spend on a single transaction, acting as a safety cap against runaway computation costs.
- [Gas War](/glossary/gas-war/) — A situation where users compete for limited block space by bidding increasingly higher gas prices, often during popular NFT mints or token launches.
- [Hash](/glossary/hash/) — A fixed-length digital fingerprint produced by a one-way mathematical function, fundamental to blockchain security and integrity.
- [Hash Rate](/glossary/hash-rate/) — A measure of computational power securing a Proof-of-Work blockchain, typically expressed in trillions of hashes per second (TH/s).
- [ICO (Initial Coin Offering)](/glossary/ico/) — A fundraising method where a project sells new cryptocurrency tokens to early investors, similar to an IPO but largely unregulated in its early years.
- [IDO (Initial DEX Offering)](/glossary/ido/) — A token sale conducted on a decentralized exchange, allowing projects to raise funds and distribute tokens without a centralized intermediary.
- [Intent-Based Architecture](/glossary/intent-based-architecture/) — A paradigm where users express what they want ('intents') rather than how to execute, letting solvers compete to find the best path.
- [KYC (Know Your Customer)](/glossary/kyc/) — The identity verification process required by regulated crypto platforms to comply with anti-money laundering laws, involving document submission and sometimes biometric checks.
- [Launchpad](/glossary/launchpad/) — A platform that curates, hosts, and facilitates token sales for new crypto projects, providing vetting and distribution infrastructure.
- [LayerZero](/glossary/layerzero/) — An omnichain interoperability protocol enabling cross-chain messaging and token transfers, compromised in the $292M Kelp DAO exploit via a forged message.
- [Light Client](/glossary/light-client/) — A lightweight blockchain node that verifies only block headers and specific transactions, enabling wallets and mobile apps to interact without downloading the full chain.
- [Mainnet](/glossary/mainnet/) — The production blockchain network where transactions involve real economic value, as opposed to a testnet where tokens have no value.
- [Merkle Tree](/glossary/merkle-tree/) — A hierarchical data structure that efficiently organizes and verifies large sets of transactions using cryptographic hashes.
- [Mining](/glossary/mining/) — The process of using computational power to validate transactions and create new blocks on a Proof-of-Work blockchain.
- [Nakamoto Coefficient](/glossary/nakamoto-coefficient/) — The minimum number of independent entities that would need to collude to attack a blockchain network, measuring its decentralization.
- [Node](/glossary/node/) — A computer running blockchain client software that participates in the network by validating, storing, and propagating transactions and blocks.
- [Nonce](/glossary/nonce/) — A sequential number assigned to each transaction from an Ethereum account, ensuring transactions execute in order and preventing replay.
- [Pending Transaction](/glossary/pending-transaction/) — A transaction that has been broadcast to the network but not yet included in a block, typically waiting in the mempool for confirmation.
- [Priority Fee](/glossary/priority-fee/) — An optional user-set tip paid to validators to prioritize transaction inclusion, layered on top of EIP-1559's protocol-set base fee.
- [Relayer](/glossary/relayer/) — An entity or service that forwards transactions or messages between different blockchain networks or from users to block builders, enabling cross-chain communication.
- [RPC](/glossary/rpc/) — Remote Procedure Call — the communication protocol that allows dApps and wallets to read from and write to a blockchain.
- [Slot](/glossary/slot/) — A fixed 12-second time interval in Ethereum's Proof of Stake system during which one validator is chosen to propose a block.
- [Snapshot (Governance)](/glossary/snapshot/) — An off-chain voting platform used by DAOs to conduct gasless governance votes, and the process of recording on-chain state at a specific block height.
- [Stablecoin](/glossary/stablecoin/) — A cryptocurrency pegged to a stable asset (usually the US dollar), combining blockchain benefits with price stability.
- [Testnet](/glossary/testnet/) — A replica of a blockchain network used by developers for testing smart contracts, protocol upgrades, and application functionality without risking real funds.
- [Token Airdrop](/glossary/token-airdrop/) — A distribution method where projects send free tokens to wallet addresses, typically to bootstrap adoption, reward early users, or decentralize token ownership.
- [Token Generation Event (TGE)](/glossary/token-generation-event/) — The moment a cryptocurrency token is officially created and distributed, marking the start of vesting schedules and secondary market trading.
- [Tokenization](/glossary/tokenization/) — The process of representing real-world or digital assets as blockchain tokens, enabling fractional ownership and programmable transfer.
- [Transaction](/glossary/transaction/) — A cryptographically signed instruction submitted to a blockchain to transfer value, interact with smart contracts, or deploy code.
- [UTXO (Unspent Transaction Output)](/glossary/utxo/) — The fundamental accounting model used by Bitcoin where each transaction consumes previous outputs and creates new ones, rather than using account balances.
- [Validity Proof](/glossary/validity-proof/) — A cryptographic proof that validates every state transition in a ZK-rollup, ensuring only correct transactions are accepted without relying on challenge windows.
- [Vesting](/glossary/vesting/) — A mechanism that gradually releases tokens to team members and early investors over time, preventing immediate sell-offs and aligning long-term incentives.
- [Web3](/glossary/web3/) — The vision of a decentralized internet built on blockchain, where users own their data, identity, and assets.
- [Wei](/glossary/wei/) — The smallest unit of Ether (ETH), where 10^18 wei equals 1 ETH. Gwei is the most commonly used subdivision for gas pricing.
- [Whale](/glossary/whale/) — An individual or entity that holds a large enough amount of a cryptocurrency to potentially influence market prices through their trading activity.
- [x402](/glossary/x402/) — An open protocol that repurposes HTTP's 402 Payment Required status code for native web payments, enabling pay-per-request APIs without API keys or accounts.
- [zk-SNARK](/glossary/zk-snark/) — A cryptographic proof system that allows one party to prove knowledge of information without revealing it, with Succinct, Non-interactive, verifiable proofs.

### Governance
- [Decentralized Autonomous Organization (DAO)](/glossary/dao/) — A member-owned organization governed by smart contracts and token-based voting, without centralized leadership.
- [Governance Token](/glossary/governance-token/) — A cryptocurrency that grants holders voting rights in a protocol's governance, allowing them to propose and vote on changes.

### Layer 1
- [Celestia](/glossary/celestia/) — A modular blockchain built specifically for data availability, enabling rollups to publish data cheaply without running their own consensus.
- [Layer 1](/glossary/layer-1/) — A base-layer blockchain that settles transactions and provides security, serving as the foundation for applications and Layer 2 networks.
- [Mempool](/glossary/mempool/) — The pending transaction pool on a blockchain where submitted transactions wait to be included in a block by validators or miners.
- [Modular Blockchain](/glossary/modular-blockchain/) — A blockchain architecture that separates core functions—execution, consensus, settlement, and data availability—into specialized, interchangeable layers.
- [Sharding](/glossary/sharding/) — A scaling technique that splits a blockchain's state and transaction processing across multiple parallel segments called shards.

### Layer 2
- [Blob-Carrying Transaction (EIP-4844)](/glossary/blob-carrying-transaction/) — A new Ethereum transaction type that carries large 'blob' data payloads for rollups, slashing L2 data costs by routing them out of the expensive call-data gas market.
- [Danksharding](/glossary/danksharding/) — Ethereum's full scalability roadmap that uses data availability sampling to enable 100,000+ transactions per second via L2 rollups.
- [Data Availability](/glossary/data-availability/) — The guarantee that transaction data published by a rollup or block producer is actually accessible to all network participants for verification.
- [EIP-4844 (Proto-Danksharding)](/glossary/eip-4844/) — An Ethereum upgrade introducing 'blob' data storage for L2 rollups, reducing transaction costs by 10-100x.
- [Layer 2](/glossary/layer-2/) — A scaling solution built on top of a Layer 1 blockchain that processes transactions off-chain while inheriting the base layer's security.
- [Optimistic Rollup](/glossary/optimistic-rollup/) — A Layer 2 scaling solution that assumes transactions are valid and uses fraud proofs to challenge invalid batches.
- [Plasma](/glossary/plasma/) — A family of Layer 2 scaling designs that use Merkle trees and fraud proofs to secure off-chain computation, proposed by Joseph Poon and Vitalik Buterin in 2017 and largely superseded by rollups.
- [Rollup](/glossary/rollup/) — A Layer 2 scaling solution that executes transactions off-chain and posts compressed transaction data to a Layer 1 for security and settlement.
- [Sequencer](/glossary/sequencer/) — The node or service responsible for ordering transactions, executing them, and publishing state updates in a Layer 2 rollup.
- [Sidechain](/glossary/sidechain/) — An independent blockchain that runs parallel to a main chain, connected via a two-way bridge for asset transfers.
- [StarkNet](/glossary/starknet/) — A ZK-rollup for Ethereum by StarkWare that uses the Cairo programming language for high-throughput computation.
- [State Channel](/glossary/state-channel/) — A two-party off-chain payment channel that enables instant, gasless transactions settled on-chain only at open and close.
- [ZK-Rollup](/glossary/zk-rollup/) — A Layer 2 scaling solution that uses zero-knowledge proofs to verify transaction batches with mathematical certainty.
- [zkSync](/glossary/zksync/) — A zero-knowledge rollup for Ethereum by Matter Labs, offering high-throughput, low-cost transactions with EVM compatibility.

### NFT
- [Floor Price](/glossary/floor-price/) — The lowest listing price for any item in an NFT collection, used as the primary market valuation metric.
- [Metadata](/glossary/metadata/) — The JSON-structured data that describes an NFT's attributes, image, name, and traits, typically stored off-chain and referenced by the token's on-chain tokenURI.
- [Minting](/glossary/minting/) — The process of creating a new NFT or token and registering it on a blockchain.
- [NFT (Non-Fungible Token)](/glossary/nft/) — A unique digital asset whose ownership and authenticity are verified on a blockchain.
- [NFT Collection](/glossary/nft-collection/) — A set of unique digital assets (NFTs) sharing a common theme, art style, and smart contract, typically ranging from 1,000 to 10,000 items.
- [PFP (Profile Picture)](/glossary/pfp/) — NFT collections designed primarily for use as social media profile pictures, characterized by generative trait combinations, rarity rankings, and strong community identity.
- [Royalty](/glossary/royalty/) — A percentage of secondary sale proceeds paid to the original NFT creator on every resale.

### Security
- [51% Attack](/glossary/51-percent-attack/) — An attack where a single entity controls more than 50% of a blockchain's mining hash rate, enabling double-spending and chain reorganization.
- [Address Poisoning](/glossary/address-poisoning/) — A scam where attackers send fake transactions from addresses that look almost identical to a victim's frequent contacts, tricking them into sending funds to the wrong address.
- [BGP Routing Attack](/glossary/routing-attack/) — An attack that hijacks internet routing (BGP) to intercept, isolate, or censor blockchain node traffic at the network layer.
- [Blacklist](/glossary/blacklist/) — A list of blockchain addresses flagged as malicious, fraudulent, or sanctioned, used by exchanges, wallets, and compliance tools to block transactions.
- [Brain Wallet](/glossary/brain-wallet/) — A cryptocurrency wallet whose private key is derived from a memorized passphrase. Convenient but catastrophically insecure against brute-force attacks.
- [Bug Bounty](/glossary/bug-bounty/) — A reward program that pays security researchers for finding and responsibly disclosing vulnerabilities in smart contracts, protocols, or platforms.
- [Censorship Resistance](/glossary/censorship-resistance/) — A blockchain's ability to process any valid transaction regardless of who sends it, with no party able to block or freeze it.
- [Clipboard Hijacking](/glossary/clipboard-hijacking/) — Malware that monitors the clipboard for cryptocurrency addresses and silently replaces them with the attacker's address, redirecting transfers.
- [Contract Audit](/glossary/contract-audit/) — A systematic security review of smart contract source code that combines automated analysis tools with expert manual review to identify vulnerabilities before deployment.
- [DDoS Attack (Blockchain)](/glossary/ddos-attack/) — A Distributed Denial of Service attack that overwhelms a blockchain network, exchange, or dApp with excessive transactions or requests, causing slowdowns or outages.
- [Dusting Attack](/glossary/dusting-attack/) — A privacy attack where tiny amounts of cryptocurrency are sent to many wallet addresses to trace transactions and de-anonymize users.
- [Eclipse Attack](/glossary/eclipse-attack/) — A network-level attack where a victim node is surrounded by attacker-controlled peers so it sees a fake, isolated view of the blockchain.
- [Entropy](/glossary/entropy/) — The true randomness that secures a crypto wallet. Measured in bits — 128 bits (a 12-word seed phrase) is already more than every computer on Earth could brute-force.
- [Exit Scam](/glossary/exit-scam/) — A fraud where project operators abruptly shut down and disappear with user funds after building trust over weeks or months.
- [Fake Token](/glossary/fake-token/) — A counterfeit cryptocurrency designed to impersonate a legitimate token, often airdropped to wallets or listed on DEXs to trick users into trading or interacting with it.
- [Finney Attack](/glossary/finney-attack/) — A Bitcoin double-spend where a miner pre-mines a block paying themselves, then tricks a merchant before broadcasting it.
- [Flash Crash](/glossary/flash-crash/) — A sudden, severe price drop in an asset that occurs within minutes, often followed by a partial recovery.
- [Flash Loan Attack](/glossary/flash-loan-attack/) — An exploit using uncollateralized flash loans to manipulate prices, drain liquidity, or exploit oracle vulnerabilities.
- [Front-Running](/glossary/front-running/) — The practice of exploiting advance knowledge of pending transactions to profit from the price impact.
- [Gnosis Safe (Safe)](/glossary/gnosis-safe/) — The most widely used smart contract multisig wallet in Ethereum, now rebranded as Safe, requiring multiple signatures to authorize transactions.
- [Honeypot](/glossary/honeypot/) — A malicious smart contract designed to look profitable but traps users' funds by blocking sales or withdrawals.
- [Maximal Extractable Value (MEV)](/glossary/max-extractable-value/) — The maximum value that can be extracted by reordering, including, or excluding transactions inside a block — originally called Miner Extractable Value.
- [Mint Authority](/glossary/mint-authority/) — The power to create new tokens from a smart contract. If misused or centralized, it allows the token creator to dilute holders or crash the price.
- [Mixer](/glossary/mixer/) — A service or protocol that blends cryptocurrency from multiple users to obscure the transaction trail between sender and recipient.
- [Nullifier](/glossary/nullifier/) — A unique on-chain marker published when a shielded note is spent, preventing double-spending without revealing which note was spent — the reason shielded pools break the public spending graph.
- [Oracle Manipulation](/glossary/oracle-manipulation/) — The deliberate manipulation of price feeds to exploit DeFi protocols that depend on external data.
- [Permit Signature Phishing](/glossary/permit-sign-phishing/) — An attack where scammers trick users into signing off-chain EIP-2612 permit messages that grant token spend approvals without an on-chain transaction, draining wallets instantly.
- [Phishing Attack](/glossary/phishing-attack/) — Social engineering attacks that trick crypto users into signing malicious transactions, approving token spend, or revealing seed phrases—resulting in theft of wallet assets.
- [Proof of Reserves (PoR)](/glossary/proof-of-reserves/) — A cryptographic audit proving that a custodian holds the assets it claims, without revealing sensitive user data.
- [Pump and Dump](/glossary/pump-and-dump/) — A market manipulation scheme where organizers artificially inflate a token's price through coordinated buying and hype, then sell their holdings at the peak, leaving other investors with worthless assets.
- [Reorg (Reorganization)](/glossary/reorg/) — A blockchain event where previously confirmed blocks are replaced by alternative blocks, potentially reversing transactions that users believed were final.
- [Replay Attack](/glossary/replay-attack/) — An attack where a valid signed transaction from one chain is fraudulently re-broadcast and executed on another chain.
- [Rug Pull](/glossary/rug-pull/) — A crypto exit scam where project developers drain liquidity or abandon a project after attracting investor funds.
- [Sanctions](/glossary/sanctions/) — Government-imposed restrictions that prohibit transactions with specific individuals, entities, or addresses, enforced by agencies like OFAC.
- [Sandwich Attack](/glossary/sandwich-attack/) — An MEV exploit where a bot front-runs and back-runs your transaction to profit from the price impact.
- [Self-Custody](/glossary/self-custody/) — The practice of holding and managing your own cryptocurrency private keys directly, without relying on a third party like an exchange or bank.
- [Shielded Address](/glossary/shielded-address/) — A Zcash address type that hides sender, receiver, and amount using zero-knowledge proofs, with value held in shielded pools rather than the transparent Bitcoin-style ledger.
- [Signature Replay](/glossary/signature-replay/) — Reusing a valid cryptographic signature more than once — or on a different chain — because a smart contract failed to mark it as consumed.
- [Social Engineering](/glossary/social-engineering/) — Manipulating people into revealing secrets or performing actions that compromise security — now the leading attack vector in Web3, responsible for billions in losses.
- [Supply Chain Attack](/glossary/supply-chain-attack/) — An attack where a dependency, package, or tool in a software supply chain is compromised to distribute malware to downstream users — a growing threat in Web3.
- [Sybil Attack](/glossary/sybil-attack/) — Creating multiple fake identities to manipulate a system, common in airdrop farming, governance, and network consensus.
- [Timejacking Attack](/glossary/timejacking/) — A Bitcoin attack where false node timestamps skew a victim's network-adjusted time to slow or speed up difficulty adjustment.
- [Timelock](/glossary/timelock/) — A smart contract mechanism that delays the execution of privileged operations, giving users time to react before changes take effect.
- [Tornado Cash](/glossary/tornado-cash/) — A decentralized crypto mixer protocol that breaks the link between sender and recipient addresses, sanctioned by OFAC in 2022 for facilitating money laundering.
- [Transaction Malleability](/glossary/transaction-malleability/) — A property that lets a transaction's signature/hash be altered before confirmation, changing its ID without invalidating it.
- [Vanity Address](/glossary/vanity-address/) — A custom wallet address containing specific characters or patterns (e.g., starting with specific prefixes), generated by trying millions of key pairs.
- [Viewing Key](/glossary/viewing-key/) — A Zcash key that grants read-only visibility of a holder's shielded transactions to a third party, without surrendering spending control — the mechanism behind provable, selectively disclosable privacy.
- [Wallet Drainer](/glossary/wallet-drainer/) — Malicious software embedded in fake dApp websites that tricks users into signing transactions that drain all tokens and NFTs from their wallet.
- [Wash Trading](/glossary/wash-trading/) — A market manipulation technique where a trader simultaneously buys and sells the same asset to create fake trading volume and mislead other investors about demand.
- [Wrench Attack](/glossary/wrench-attack/) — A physical attack where criminals coerce a crypto holder into surrendering funds in person — the offline endgame of online data leaks. Named after the xkcd comic where a $5 wrench beats millions in encryption.
- [Zero-Knowledge Proof (ZKP)](/glossary/zkp/) — A cryptographic method to prove you know something without revealing the actual information.

### Smart Contract
- [Bundler](/glossary/bundler/) — An ERC-4337 participant that collects UserOperations, validates them, and packages them into a single on-chain transaction for execution.
- [ERC-1155](/glossary/erc-1155/) — A smart contract concept in the Web3 and blockchain ecosystem.
- [ERC-20](/glossary/erc-20/) — The standard for fungible tokens on Ethereum — defines the interface every interchangeable token must implement.
- [ERC-4337 (Account Abstraction)](/glossary/erc-4337/) — An Ethereum standard implementing account abstraction via a separate transaction layer, enabling smart-contract wallets with gasless txs, batching, and social recovery.
- [ERC-721](/glossary/erc-721/) — The Ethereum token standard for non-fungible tokens (NFTs), where each token is unique and non-interchangeable.
- [Event Log](/glossary/event-log/) — Immutable records stored on the blockchain by smart contracts, providing auditable logs of on-chain activities and data for off-chain indexing.
- [EVM (Ethereum Virtual Machine)](/glossary/evm/) — The runtime environment that executes smart contract code on Ethereum and all EVM-compatible blockchains.
- [Gas Optimization](/glossary/gas-optimization/) — Techniques and best practices for reducing the computational cost of smart contract operations on Ethereum and other EVM chains.
- [Paymaster](/glossary/paymaster/) — An Account Abstraction component that sponsors gas fees for smart accounts, enabling gasless transactions and flexible payment models.
- [Permit2](/glossary/permit2/) — Permit2 is a universal approval router developed by Uniswap Labs that extends ERC-2612 permit functionality to any token with advanced security features.
- [Proxy Pattern](/glossary/proxy-pattern/) — A smart contract architecture enabling upgradeability by separating logic and state through delegate calls between proxy and implementation contracts.
- [Reentrancy Attack](/glossary/reentrancy-attack/) — A smart contract exploit where an attacker recursively calls a vulnerable function to drain funds before the contract updates its state.
- [Smart Contract](/glossary/smart-contract/) — Self-executing code deployed on a blockchain that automatically enforces agreements when conditions are met.
- [Solidity](/glossary/solidity/) — The primary programming language for writing smart contracts on Ethereum and EVM-compatible blockchains.
- [Upgradeable Contract](/glossary/upgradeable-contract/) — A smart contract whose logic can be modified after deployment using a proxy pattern, allowing bug fixes and feature updates — but also creating centralization risk.

### Tokenomics
- [Bonding Curve](/glossary/bonding-curve/) — A mathematical curve that defines the relationship between a token's price and its supply, enabling continuous minting and burning.
- [Circulating Supply](/glossary/circulating-supply/) — The number of tokens currently in public circulation and available for trading, excluding locked, reserved, or burned tokens.
- [Deflationary Token](/glossary/deflationary-token/) — A cryptocurrency whose supply decreases over time through burn mechanisms, reducing the total number of tokens in circulation.
- [Depeg](/glossary/depeg/) — When a stablecoin or pegged asset loses its target price (e.g., a 'dollar stablecoin' trading below $1), signaling a loss of market confidence.
- [FDV (Fully Diluted Valuation)](/glossary/fdv/) — The theoretical total market cap if every token that will ever exist was in circulation at the current price.
- [Inflationary Token](/glossary/inflationary-token/) — A cryptocurrency whose supply increases over time through block rewards, staking, or other emission mechanisms.
- [Market Cap](/glossary/market-cap/) — The total dollar value of a cryptocurrency's circulating supply, calculated as current price multiplied by circulating supply.
- [Max Supply](/glossary/max-supply/) — The maximum number of tokens that will ever exist for a given cryptocurrency, set by protocol rules and enforceable only through consensus.
- [Soulbound Token (SBT)](/glossary/soulbound-token/) — A non-transferable token that represents identity, credentials, or commitments within a Web3 ecosystem.
- [Token Allocation](/glossary/token-allocation/) — The distribution plan for a project's total token supply across team, investors, community, and treasury.
- [Token Burn](/glossary/token-burn/) — The permanent removal of tokens from circulation, reducing total supply to increase scarcity and potentially support price.
- [Token Vesting](/glossary/token-vesting/) — A schedule that gradually releases locked tokens to team members and investors over time, preventing immediate selling.
- [Tokenomics](/glossary/tokenomics/) — The economic design of a cryptocurrency token — its supply, distribution, utility, and incentive mechanisms.
- [veToken](/glossary/ve-token/) — A vote-escrowed token model where users lock tokens for a period to gain voting power and yield boosts, pioneered by Curve Finance.

### Wallet
- [Account Abstraction (ERC-4337)](/glossary/account-abstraction/) — An Ethereum standard enabling smart-contract wallets with gasless transactions, social recovery, and multi-sig security without changing the protocol.
- [BIP-39](/glossary/bip-39/) — The 2013 standard that converts wallet entropy into 12-24 readable backup words — the seed phrase. Defines the 2,048-word list, the checksum, and the word-to-bits mapping every major wallet uses.
- [Burner Wallet](/glossary/burner-wallet/) — A disposable low-value wallet used for risky interactions — minting, airdrop claims, unfamiliar dapps — so a compromise costs pocket change instead of your savings.
- [Cold Wallet](/glossary/cold-wallet/) — A cryptocurrency wallet that is not connected to the internet, providing maximum security for long-term storage of digital assets.
- [Custodial Wallet](/glossary/custodial-wallet/) — A cryptocurrency wallet where a third-party service holds and manages the user's private keys, similar to a traditional bank account.
- [Derivation Path](/glossary/derivation-path/) — The address of a key inside an HD wallet's tree — e.g. m/44'/60'/0'/0/0. Tells a wallet which branch of your seed phrase to read; mismatched paths make funds 'disappear'.
- [EOA (Externally Owned Account)](/glossary/eoa/) — An Ethereum account controlled by a private key (a user's wallet), as opposed to a smart contract account controlled by code.
- [Hardware Wallet](/glossary/hardware-wallet/) — A physical device that securely stores private keys offline, protecting crypto assets from digital theft.
- [HD Wallet](/glossary/hd-wallet/) — Hierarchical Deterministic wallet — one seed phrase deterministically generates a whole tree of private keys and addresses, which is why backing up 12 words backs up everything.
- [Hot Wallet](/glossary/hot-wallet/) — A cryptocurrency wallet connected to the internet, offering convenience for frequent transactions at the cost of reduced security.
- [Multi-Sig Wallet](/glossary/multi-sig-wallet/) — A wallet requiring multiple signatures from different key holders to authorize a transaction, adding security through distributed approval.
- [Non-Custodial Wallet](/glossary/non-custodial-wallet/) — A cryptocurrency wallet where the user holds and controls their own private keys, maintaining full ownership of their assets.
- [Private Key](/glossary/private-key/) — A secret cryptographic number that proves ownership of cryptocurrency assets and authorizes transactions.
- [Public Key](/glossary/public-key/) — The public half of a cryptographic key pair, derived from the private key and used to verify signatures without ever revealing the key that created them.
- [Seed Phrase](/glossary/seed-phrase/) — A human-readable list of 12-24 words that generates and recovers all private keys in a cryptocurrency wallet.
- [Social Recovery](/glossary/social-recovery/) — A wallet recovery method where trusted contacts (guardians) co-sign to restore access, eliminating the need for seed phrases.
- [Wallet](/glossary/wallet/) — A software program or physical device that stores cryptocurrency private keys and enables users to send, receive, and manage digital assets.
- [Wallet Address](/glossary/wallet-address/) — The public account identifier others use to send you crypto — safe to share, derived from your public key, and useless for spending without the private key.
- [Wallet Connect](/glossary/wallet-connect/) — An open protocol connecting wallets to DApps through a secure pairing process, widely used but exploited by phishing drainers.
- [Wallet Passphrase](/glossary/wallet-passphrase/) — An optional secret word (the BIP-39 '25th word') added to a seed phrase — it opens a completely different hidden wallet, enabling plausible deniability at the price of unforgivable loss if forgotten.

## Agent access
Streamable HTTP MCP server exposing full-text search and read access to every article and glossary term:
- Endpoint: https://theonchaindiary.com/api/mcp
- Tools: search / read_article / read_glossary / list_content
- Discovery: https://theonchaindiary.com/.well-known/mcp.json
- Structured JSON catalog: https://theonchaindiary.com/mcp/manifest.json
- RSS: https://theonchaindiary.com/rss.xml (zh: /zh/rss.xml)
- Setup guide & verify prompts: https://theonchaindiary.com/agent/