Security & Risk

How to not get wrecked: rug pulls, phishing, honeypots, address poisoning, flash loan exploits, and what to watch for.

• What Is a Rug Pull?

  A rug pull is a scam where a project team builds hype, attracts investment (usually into a token or liquidity pool), then suddenly withdraws all funds and disappears. The rug is the liquidity or treasury that gets pulled from under investors. You are left holding worthless tokens with no buyers, no liquidity, and no recourse.

• What Is a Phishing Attack (Crypto-Specific Mechanics)?

  A crypto phishing attack tricks you into signing a malicious transaction, approving a drainer contract, or entering your seed phrase on a fake website. Unlike traditional phishing (stealing passwords), crypto phishing often needs just one signed transaction to permanently steal all your assets. There is no change password recovery because blockchain transactions are irreversible.

• What Is a Seed Phrase Drainer / Approval Drainer?

  A drainer is automated software that steals crypto from compromised wallets. Seed phrase drainers import stolen recovery phrases and sweep all assets across all chains within seconds. Approval drainers exploit token approvals you previously granted to malicious contracts, transferring your tokens without needing your seed phrase or private key at all.

• What Is a Sybil Attack?

  A Sybil attack is when one person creates many fake identities to gain disproportionate influence in a system designed for many independent participants. In crypto, this means creating hundreds of wallets to claim airdrops meant for unique users, manipulate governance votes, or game reward systems that distribute per-address rather than per-person.

• What Is a Honeypot Contract?

  A honeypot contract is a malicious smart contract designed to let you buy a token but prevent you from selling it. The contract code contains hidden restrictions that block sell transactions for everyone except the deployer. You can buy in (the price chart goes up, looking attractive), but when you try to sell, the transaction reverts. Only the scammer can extract value.

• What Is a Smart Contract Exploit (The General Category)?

  A smart contract exploit is any attack that abuses a bug, logic flaw, or unintended interaction in deployed smart contract code to steal funds or manipulate the protocol in ways its designers did not intend. Unlike phishing (which targets users), exploits target the protocol itself. The code does exactly what it was programmed to do, but that programming contains a vulnerability the attacker discovered.

• What Is Address Poisoning?

  Address poisoning is a scam where an attacker sends tiny transactions to your wallet from an address that looks almost identical to one you recently transacted with. When you later copy an address from your transaction history (instead of your contacts), you accidentally copy the attacker's look-alike address and send funds to them. It exploits the habit of copy-pasting from history rather than verifying the full address.

• What Is a Fake Token / Spoofed Token?

  A fake token is a smart contract deliberately named to impersonate a legitimate cryptocurrency (same name, same ticker symbol, even the same logo in some wallet UIs). Because anyone can deploy an ERC-20 with any name, scammers create fake USDC, PEPE, or ARB tokens and trick people into buying the worthless copy instead of the real one.

• What Is a Pump-and-Dump Scheme (Mechanics, Informational)?

  A pump-and-dump is a market manipulation scheme where insiders accumulate a cheap asset, artificially inflate its price through coordinated hype (the pump), then sell their holdings into the artificially high demand (the dump), crashing the price and leaving late buyers with losses. In crypto, this happens on micro-cap tokens, coordinated through Telegram groups and social media.

• What Is Social Engineering (Crypto-Specific Framing)?

  Social engineering in crypto is manipulating people (not code) into making security mistakes: giving up seed phrases, signing malicious transactions, sending funds to attackers, or downloading compromised software. The target is human psychology, not technical vulnerabilities. It is responsible for more dollar value stolen from individuals than smart contract exploits.

• How to Spot a Pump-and-Dump (Detection Checklist)

  Before buying any token promoted on social media, run through these checks: verify the contract on a scanner (Token Sniffer, honeypot.is), check holder concentration (top wallet should not hold more than 10%), confirm liquidity is locked and for how long, look for verified source code on Etherscan, and search for the team with verifiable identities. If more than two of these fail, walk away.

• How to Secure Your Discord and Twitter From Crypto Scams

  Turn off DMs from strangers in Discord server settings, enable two-factor authentication everywhere, never click links sent via DM (legitimate projects never DM you first), verify announcements only in official channels, and report/block fake accounts immediately. These five settings changes take two minutes and block 95% of crypto social media scams.

• What Is a Dusting Attack?

  A dusting attack sends tiny amounts of crypto (dust) to many wallet addresses to track their activity and potentially identify the owners. The attacker sends fractions of a cent to thousands of wallets, then monitors when those dust amounts are spent (combined with other UTXOs or tokens), linking previously unconnected addresses together. It is a surveillance technique, not a direct theft mechanism.

• What Is Clipboard Hijacking?

  Clipboard hijacking is malware that monitors your clipboard and automatically replaces crypto addresses when you copy-paste them. You copy a legitimate address from an exchange or friend, but when you paste it into your wallet send field, the malware has silently swapped it for the attacker address. You send funds to the wrong destination without realizing. It is one of the simplest and most effective crypto theft methods.

• What Is a Drainer-as-a-Service?

  Drainer-as-a-Service (DaaS) is a criminal business model where developers build and sell wallet-draining toolkits to less technical scammers for a revenue share (typically 20-30% of stolen funds). The buyer sets up phishing sites, the toolkit handles the technical exploitation: crafting malicious approvals, detecting wallet balances across chains, prioritizing high-value assets, and sweeping everything in one transaction. It has industrialized crypto theft.

• What Is a Flash Crash (And How to Protect Your Positions)?

  A flash crash is a sudden, extreme price drop (10-50% in minutes) followed by a rapid recovery. In crypto, they are caused by cascading liquidations, thin liquidity at key price levels, and algorithmic trading reactions compounding each other. If you have leveraged positions or tight stop-losses, a flash crash can wipe you out on a price that exists for only seconds before recovering. Protection requires: avoiding over-leverage, using wider stops, and understanding how liquidation cascades work.