Crypto security glossary

Address poisoning
Sending tiny or zero-value transfers from a lookalike address so a victim later copies the wrong address from their history. See address poisoning.

Airdrop
A distribution of tokens to wallet addresses, often to early users of a protocol. Real airdrops are claimed through the project's official site or arrive directly.

Allowlist (withdrawal whitelist)
An exchange setting that only allows withdrawals to addresses you have approved in advance.

Approval (allowance)
Permission you give a smart contract to move a specific token from your wallet. See token approvals.

Blind signing
Signing a transaction or message that your wallet cannot decode, so you only see a hash or raw data.

Bridge
A protocol that moves assets between blockchains, usually by locking them on one chain and issuing a representation on another.

Cold wallet
A wallet whose private keys are kept off internet-connected devices, such as a hardware wallet.

Drainer
A phishing kit that, once connected to a wallet, requests the signatures or transactions needed to steal its most valuable assets. See signature drainers.

Gas
The fee paid to the network to process a transaction.

Hardware wallet
A dedicated device that stores private keys and signs transactions without exposing the keys to your computer or phone.

Honeypot token
A token whose contract lets people buy but blocks or heavily taxes selling. See rug pulls and honeypots.

Hot wallet
A wallet whose keys are stored on an internet-connected device, such as a browser extension or mobile app.

Infostealer
Malware that steals saved passwords, session cookies, wallet files and other data from a computer.

Multisig
A wallet that requires signatures from several keys (for example 2 of 3) to move funds.

Passphrase (25th word)
An optional extra word or phrase added to a seed phrase, creating a separate set of accounts.

Permit / Permit2
Ways to grant a token allowance by signing a message instead of sending a transaction. Widely abused by drainers.

Phishing
Tricking someone into revealing secrets or signing something by imitating a trusted website, person or organisation.

Private key
The secret number that controls a single address. Anyone with it can move that address's funds.

Rug pull
When a project's creators abandon it and take investors' money, for example by removing liquidity.

Seed phrase (recovery phrase)
The 12 or 24 words from which a wallet's private keys are generated. See seed phrases.

setApprovalForAll
A function that gives an operator permission to move all of your NFTs in a collection.

SIM swap
Taking over someone's phone number by moving it to a SIM card the attacker controls. See SIM-swap protection.

Simulation
A wallet feature that predicts what a transaction will do to your balances before you sign it.

Sybil
Using many wallets or fake identities to appear as many separate users, often to farm airdrops. Many projects disqualify sybil wallets.

TOTP
Time-based one-time passwords: the six-digit codes shown by authenticator apps.

Typed data signature
A structured message signature (for example EIP-712) that can represent logins, orders or permits.

Zero-value transfer
A transaction that moves no tokens but still appears in a wallet's history, often used for address poisoning.