Scams & Attacks

:::section{mins=6} The Threat Landscape :::

:::lead In 2024, $2.2 billion was stolen across 303 incidents, and not one was a break of the blockchain itself. Attackers go after people and the code of apps on top; the chain runs exactly as designed. The hooded-hacker-cracking-cryptography image is almost entirely fiction. :::

:::p First, it helps to understand why the blockchain itself is almost never attacked directly. To rewrite the transaction history of a network like Ethereum, you'd need to control a majority of validators – that would cost tens of billions of dollars and be spotted instantly. Attacking one person or one smart contract is incomparably cheaper: a phishing site costs pennies, and the haul is measured in millions. Security here is economic: what gets broken isn't what's impossible but what's profitable. So the target becomes the weakest, cheapest link – the human at the keyboard and the app's code, not the cryptography underneath. :::

:::p So where does the money actually go? Behind these figures are firms that track crypto crime professionally: Chainalysis and Immunefi trace the movement of stolen funds, while Scam Sniffer monitors phishing. Per Chainalysis, private-key theft drove almost 44% of all 2024 losses. The first quarter of 2025 was harsher still: by Immunefi's estimate, private keys and social engineering accounted for 88% of what was stolen. Phishing via wallet drainers – programs that empty a wallet after a single signature – took $494 million in 2024 alone (Scam Sniffer's figure). Smart-contract bugs still cost a lot, but their share is falling thanks to a maturing audit culture. And rug pulls, despite their loud reputation, came to only about $95 million in 2024. The loss picture is thus the opposite of a newcomer's intuition: not "clever code breaks the blockchain" but "a deceived human hands over access." :::

:::p Most of these losses were preventable. Phishing is an awareness problem. Rug pulls are a due-diligence problem – checking a project before you buy. Exploits are an audit problem. The one thing that's genuinely hard to defend against at an individual level is a targeted attack by a state-backed group like the Lazarus Group, which has the budget, time, and patience for months of preparation. :::

:::p{html} Lazarus deserves its own mention. This North Korean group is the largest crypto thief in the world: Chainalysis estimates roughly $6.75 billion stolen between 2017 and 2025. Its favorite target isn't exchanges directly but developers and employees of crypto projects: a fake recruiter, a "test assignment" carrying malicious code, and the victim's machine is theirs. On 21 February 2025 it pulled off the biggest theft in crypto history – $1.5 billion from the Bybit exchange (401,347 ETH), an attribution confirmed by the FBI. The Bybit hack showed that even institutional-grade multisig custody (Safe{Wallet}) can be bypassed by taking over a single developer's machine – the chain held, the human link didn't. We walk through this case step by step in 3.2 §1, where a simulator puts you in the shoes of one of the signers deciding whether to sign or reject. :::

:::callout An apartment building. The walls – the blockchain – are reinforced concrete; punching through them is practically impossible. But a scammer buzzes the intercom and talks you into opening the door (phishing). A thief finds an unlatched ground-floor window (a contract bug). And the developer collected everyone's money for apartments and vanished before the building was even finished (a rug pull). The strongest walls in the world won't help if you keep letting guests in without checking who they are. :::

:::keypoints{label="Key Points"}

• The blockchain itself is almost never breached. The target is the human and the app code on top. Your security budget belongs on habits and tooling; distrusting the chain itself protects nothing
• Follow the money, not the headlines: key theft and social engineering drive the overwhelming majority of losses, while rug pulls (loud as they are) are a small slice. Spend your caution where the dollars actually go
• Most losses were preventable: phishing is an awareness gap, rug pulls a due-diligence gap, exploits an audit gap. The exception is a state-backed group like Lazarus, which is hard to stop at the individual level
• Custody hardware protects keys, not decisions: Bybit lost $1.5B with institutional multisig intact because the human approving the transaction was fed a forged screen. The weakest link is always a person in the process, not where the keys sit :::

:::details{badge=Advanced title="Follow the money: how stolen crypto is traced – and laundered"} :::p{html} We dissect the mechanics of the Bybit hack – the swapped Safe{Wallet} interface and blind signing – in 3.2 §1, including a simulator that puts you in a signer's seat. Here the deeper question is the one that decides whether a theft pays off: once $1.5 billion is stolen, what happens to it? This is where crypto's transparency cuts both ways. Every movement of the stolen ETH is public and permanent, so firms like Chainalysis and Elliptic can follow it address by address in real time. That's why attribution is even possible: the FBI tied Bybit to Lazarus within five days, and analysts have traced roughly $6.75 billion to the group since 2017 precisely because the ledger never forgets. :::

:::p{html} So the hard part for a state-scale attacker isn't stealing – it's converting visible coins into usable money. The laundering playbook is layered: split the haul across hundreds of fresh wallets; swap into other assets on DEXs to break the trail; route through cross-chain bridges to jump networks (which is partly why bridges draw so much illicit flow, as we noted in 3.5 §5); pass funds through mixers to sever the link between source and destination; and finally cash out through OTC brokers willing to look away. Lazarus laundered the majority of the Bybit funds this way within weeks. :::

The practical takeaway for you is counterintuitive: the same public ledger that makes you feel exposed is also the attacker's biggest problem. It's why exchanges can freeze flagged funds, why some hackers negotiate a return rather than risk holding marked coins, and why "the money is gone" is less absolute on-chain than in traditional fraud. Transparency doesn't prevent the theft – but it shapes what a thief can realistically do afterward, and it's the reason the defender's side keeps improving. :::

:::further{label="Further Reading"}

• Chainalysis Crypto Crime Report | chainalysis.com
• Rekt.news – exploit leaderboard | rekt.news :::

:::quiz{id=q-4-1-s1 label="Check yourself" correct=1 explanation="Correct. Private keys drove 44% of 2024 losses, and with social engineering, 88% of Q1 2025. The chain's cryptography isn't the target – people and app code are. Rug pulls are real but a small slice ($95M in 2024)."} Where do the largest crypto losses actually come from?

• Breaking the blockchain's cryptography directly
• Private-key theft and social engineering – the human and app layer
• Rug pulls, which dwarf every other category
• Miners and validators reversing or censoring transactions through block reorganizations :::

:::section{mins=4} Phishing: Threat #1 :::

:::lead Everyone has seen the bank email asking you to "confirm your details." Crypto phishing runs the same playbook, with one difference that changes everything: a bank transfer can be reversed, but a signed blockchain transaction is final. No support, no undo, no chargeback. Every Approve is potentially fatal. :::

:::p{html} Phishing is the single largest category of user-facing losses, and it exploits your attention, not code. We build here on the mechanics of signatures, approve, and Permit2 covered in detail in 3.3 §5 – in this section what matters isn't how they work but how they're turned against you. You're tired, you're rushing, you see a familiar interface – and you click Approve on autopilot. The attacker needs a vulnerability in the moment. Phishing dwarfs flashier threats because it scales to anyone with a wallet and costs almost nothing to attempt. :::

:::p It takes five main forms: :::

:::howto{label="Five main forms"}

• A fake dApp – a site visually identical to the real one, differing by one character in the URL: uniswap.com instead of app.uniswap.org; you approve, and your tokens go to the attacker.
• Permit phishing – asks you to sign an off-chain message: no gas is spent, so it looks harmless, but the signature grants a contract the right to take your tokens.
• A fake airdrop – a token appears in your wallet with a "Claim your tokens" link to a malicious site.
• Fake support – a "MetaMask representative" asks for your seed phrase to "unlock your wallet."
• Hacked project accounts – a breached Discord or Twitter of a real project posts a link to an "emergency mint." :::

:::p How do you defend against it? Five basic rules cover most of it: :::

:::howto{label="Five basic rules"}

• Enter through bookmarks, not search. Keep bookmarks for every DeFi site and open them only that way – typosquatted domains buy search ads.
• Turn on pre-sign simulation. A wallet like Rabby shows the transaction's real outcome before you sign (how to use it: 3.3 §8).
• Never give anyone your seed phrase. No legitimate support will ever ask – ever.
• Don't click "claim airdrop" from DMs or Twitter.
• Check the URL. A single different letter is already phishing. :::

:::p Phishing exploits attention. The strongest defense is the habit of inserting a pause between "I want to sign" and "I signed." Blocklists of bad sites always lag behind new scams; the pause doesn't. Pre-sign simulation is that pause: it shows you what will actually happen, turning a reflexive click into a deliberate decision. :::

:::callout Signing papers at a notary. A proper notary shows you the text and explains what you're signing. Phishing is a fake notary who slides you a deed transferring your apartment, disguised as a routine handover-of-keys form. It looks like the document you expected; the consequence is the opposite of what you intended. Pre-sign simulation is your own lawyer, sitting beside you, reading each document aloud before your pen touches it – "this doesn't hand over the keys, it signs away the apartment." The fake notary's whole trick relies on you not having that lawyer in the room. :::

:::keypoints{label="Key Points"}

• Phishing can't be fully solved by tools, because it exploits your attention. Every blocklist lags behind brand-new scam domains. The durable defense is a habit: a deliberate pause before every signature
• Sort your secrets by reversibility: an approval can be revoked and a leaked hot wallet drained into a fresh one, but a leaked seed phrase is final. That single irreversible secret deserves a different level of caution than everything else
• Damage often lands long after the click: a signature captured today can be used to drain you days later, so "nothing happened, so it was fine" is false reassurance. If you signed something suspicious, act now – don't wait for proof :::

:::details{badge=Advanced title="The anatomy of permit phishing – and DNS hijacking"} Permit phishing (ice phishing) is among the cruelest attacks because the victim sees nothing suspicious. The malicious site requests an EIP-2612 permit or a Permit2 signature. It's not a transaction – no gas – so it looks completely benign. But the signature grants a contract the right to take the specified tokens. The victim notices nothing until the attacker submits the permit on-chain and pulls the funds, anywhere from minutes to days later. In October 2024, one permit-phishing victim lost $36 million (15,079 fwdETH) to a single signature.

Phishing has also become an organized business. Underground services (Pink Drainer, Inferno Drainer) sell ready-made phishing kits – a full scam site in five minutes. Pink Drainer took an estimated $85 million before shutting down in May 2024; Inferno Drainer claims over $250 million. Across all such drainers, 2024 phishing losses rose about 67% on the previous year – an industry growing, not shrinking.

DNS hijacking is one of the most dangerous vectors because even an expert can be fooled. The attacker hijacks the DNS of a legitimate protocol's domain. You visit the real URL but see a fake frontend that proposes a malicious transaction. Real cases: Curve Finance (August 2022, ~$570K), Balancer (September 2023, ~$238K); Curve was hit again in May 2025 via a compromised registrar. Defense: ENS-based or IPFS-hosted frontends, entering only through bookmarks, and checking the SSL certificate. This is also why pre-sign simulation matters even on a "real" URL – the address being correct doesn't guarantee the frontend is. :::

:::further{label="Further Reading"}

• Scam Sniffer – phishing reports | scamsniffer.io
• Revoke.cash – approvals & permits explained | revoke.cash :::

:::quiz{id=q-4-1-s2 label="Check yourself" correct=3 explanation="Correct. That's the permit-phishing trap: an off-chain signature spends no gas but can grant a contract permission to take your tokens, submitted on-chain later. “No gas” is not “no risk” – read what the signature authorizes."} A site asks you to sign a message. It costs no gas. Is it safe?

• Yes – no gas means no transaction, so nothing can move
• Yes, as long as the URL matches the protocol's official site and contains no suspicious characters
• Only on mobile, because iOS and Android block malicious signature requests automatically
• No – a gasless permit signature can still authorize draining your tokens :::

:::section{mins=5} Rug Pulls & Exit Scams :::

:::lead You find a new token early, you buy, the price climbs – and by morning it's zero, the project's site is gone, and the Telegram channel is locked. That's a rug pull: the creators gathered the money and vanished. The chain recorded every step faithfully; nothing was "hacked." You were sold an exit from the start. :::

:::p A rug pull is a planned operation, and it comes in several shapes: :::

:::howto{label="Types of rug pulls"}

• Liquidity pull – the creator simply removes liquidity from the DEX pool. The token technically still exists, but there's nothing to sell it against, so the price collapses to zero. Red flag: the LP tokens were never locked.
• Mint & dump – the contract lets the creator mint unlimited tokens, which they mint and dump on the market. Red flag: no max supply, an owner-only mint function.
• Slow rug – the team gradually sells its own tokens and quietly abandons the project. Less obvious than an instant rug, same result. Signs: steady team selling, updates that stopped.
• Honeypot – you can buy the token but not sell it: the sell function is blocked, or selling hands almost everything back to the contract (a fee of up to 99% baked into the token).
• NFT rug – the creators collect the mint proceeds and disappear, leaving holders with worthless JPGs. :::

:::p How do you avoid it? It comes down to reading red flags before you buy. An anonymous team with no reputation; promises of unreal returns (100% a day); LP tokens that aren't locked; a contract that's unverified and unaudited; aggressive marketing with paid influencers and inflated follower counts. None of these alone proves fraud, but two or more together is almost certainly a scam – and the cost of walking away is nothing, while the cost of being wrong is everything you put in. :::

:::p Rug pulls are well-funded theater. Creators invest in marketing, manufacture the illusion of a living community, hire influencers, and build a "roadmap" full of ambitious promises – all to maximize the number of victims before the exit. Hype periods (a bull run) are especially dangerous: hundreds of new projects launch daily, investors are gripped by FOMO, and nobody has the time or appetite to verify. That combination (many targets, low scrutiny) is the environment a rug pull is designed for. :::

:::callout You're invited to invest in a restaurant. They show you a beautiful mock-up, a designer menu, a chef with polished Instagram photos. You wire money "for the renovation." A week later you drive to the address – and it's an empty unit, the phones are off, and there was never any restaurant at all. The whole package – the menu, the chef, the buzz – existed only to make the wire transfer feel safe. The polish isn't evidence the thing is real; it's the budget line that pays for your trust. :::

:::keypoints{label="Key Points"}

• A rug pull is prepared over months but executed in one block: by the time the price moves, your window to react is already closed. So the only defense is the check you do before buying – there is no "sell in time" once it triggers
• Hype periods are the scammer's harvest: hundreds of new tokens daily and FOMO that switches off scrutiny. The riskier you feel the urge to "get in before it moons," the more that urgency is the product being sold to you
• A slow rug is the dangerous one precisely because there's no single dramatic moment: the team just sells and drifts away over weeks, so nothing ever screams "exit now." Track whether the team is selling and whether updates have quietly stopped
• The math of walking away is lopsided in your favor: skipping a genuine project costs you some upside, but buying into a scam costs the whole stake. When unsure, the expected value almost always says pass :::

:::details{badge=Advanced title="Spotting honeypots and staged “hacks” before they cost you"} A honeypot contract has a modified transfer function: it permits buying but blocks selling – or applies a "tax" of up to 99% on sells. That "tax" isn't a government levy; it's a fee written into the token's own contract that diverts almost the entire sale amount to the creator, so a sale technically goes through but returns you almost nothing. Tools exist to detect this before you commit – Honeypot.is, Token Sniffer, GoPlus – and Rabby flags some honeypots through its contract-risk analysis. The rule is simple: before buying any unfamiliar token, run it through one of these.

The textbook example is the SQUID token, launched in October 2021 on the wave of the Netflix series Squid Game (with no connection to Netflix whatsoever). Marketed as the currency of an upcoming play-to-earn game, it rode the hype from $0.01 to a peak around $2,861 – a rise of more than 40,000%. But the contract was a honeypot: anyone could buy, only the creators could sell. Thousands watched "profit" climb on screen while being physically unable to exit. On 1 November the creators pulled the liquidity, the price fell to zero within minutes, and the site and socials vanished; roughly $3.3 million walked out the door. Tellingly, the red flags were visible in advance: an anonymous team, disabled comments on Twitter and Telegram, a typo-ridden website, and no real game. Any of the checkers above would have flagged the un-sellable contract before the first buy.

A separate topic is the LP lock. Liquidity should be locked through a vetted service – Team.Finance, Unicrypt, or a timelock contract – and two parameters matter: the lock duration (three months is weak; a year or more is better) and the share of LP locked (100% is good; anything less is a reason for caution).

Some rug pulls disguise themselves as "hacks." The team stages an exploit and announces "unfortunately, we were hacked" while actually draining the funds itself. Tells of a staged incident: the attacker acted at a suspiciously perfect moment (insider timing); funds moved to fresh wallets with no history; the project never ran a bug bounty; and the team disappeared after the "hack" instead of investigating it. A telling example is the Multichain bridge (July 2023): over $125 million was "drained," but it emerged that the project's founder had solely controlled all the MPC keys the whole time and had by then been detained by police; Chainalysis and independent researchers leaned toward an inside job rather than an external breach. The same skepticism you'd apply to a too-good token applies to a too-convenient hack – when the loss benefits the people who controlled the keys, "we got hacked" deserves the same scrutiny as any other claim. :::

:::further{label="Further Reading"}

• Honeypot.is – token sell-check | honeypot.is
• Token Sniffer – contract & rug analysis | tokensniffer.com :::

:::quiz{id=q-4-1-s3 label="Check yourself" correct=0 explanation="Correct. Whether LP tokens are locked is on-chain and verifiable in seconds – unlocked liquidity means the creator can drain the pool anytime. Followers, friendliness, and influencer hype are all cheap to fake and point the wrong way."} Which red flag is the most directly checkable before buying a new token?

• Whether the project's liquidity (LP) tokens are locked
• Whether the team seems friendly in Telegram
• How many followers the project has on Twitter
• Whether influencers are promoting it :::

:::section{mins=8} Smart Contract Exploits :::

:::lead On 17 June 2016, an attacker found a bug in The DAO contract and walked away with 3.6 million ETH – about $60 million then. It wasn't fraud: the code ran exactly as written. It was just written with a flaw. A decade later nothing fundamental has changed. Contract bugs still cost billions, and 2024 alone saw $1.42 billion drained across 310 incidents. :::

:::p Here the problem is flawed code holding everyone's money. The set of vulnerabilities that costs the most has been remarkably stable for years, and it's worth knowing the names because they show up in every post-mortem you'll ever read: :::

:::howto{label="The classic vulnerabilities"}

• Reentrancy – a contract is called again before it updates its own state, letting an attacker withdraw repeatedly from a balance that hasn't yet been decremented. This was the bug in The DAO, and the fallout literally split Ethereum into ETH and ETC. It's not history: reentrancy drove over $300 million in losses since January 2024.
• Oracle manipulation – the attacker fakes the price feed a protocol relies on. Mango Markets (October 2022) lost $116 million this way; oracle attacks rose about 31% year-over-year into 2025.
• Flash-loan attack – an instant, uncollateralized loan of millions, used to move a market and repaid in the same transaction. The cost to attempt is just gas (~$100); the profit is in the millions. Per Halborn, flash loans featured in 83.3% of eligible 2024 exploits.
• Access control – a critical function doesn't check who's calling it. The 2017 Parity wallet bug froze or lost over $30 million because ownership could be reassigned by anyone.
• Logic error – wrong math or a wrong assumption. Compound (September 2021) misdistributed ~$90 million to users over a single wrong character (> instead of >=); logic errors were the single most common root cause in 2024, 50 of 150+ incidents. :::

:::p Every major exploit becomes a lesson the industry encodes. After The DAO came the checks-effects-interactions pattern; after the flash-loan wave came robust oracles and TWAP (time-weighted average price); after Parity came access-control standards. But complexity grows faster than the fixes: in May 2025, Cetus Protocol on Sui lost about $223 million to an integer-overflow bug in its liquidity math – a textbook logic error, in a brand-new ecosystem, on code that had been audited. :::

:::p So how do you, a normal user who can't read Solidity, judge whether a protocol is safe? Through proxies for code quality. Look for an audit by a reputable firm (Trail of Bits, OpenZeppelin, Spearbit); a meaningful bug bounty (the larger it is, the more skin the team has in security); and time in the wild – a protocol that has held hundreds of millions for two years without incident has been battle-tested in a way a two-week-old fork has not. None of these is a guarantee, but the absence of all three is a loud warning. And there's a brutal economic asymmetry underneath all of it: an audit costs $40,000–$100,000, while the average exploit nets $10–30 million, so the math favors the attacker – which is exactly why you can't outsource your caution entirely to "it's audited." :::

:::callout A bridge over a river, built to drawings that passed expert review. The bridge looks solid; cars drive across it. But one engineer notices that under a specific load and a specific wind, a support begins to vibrate – and the whole thing could come down. A smart-contract audit is that review of the drawings. It catches most problems, and a good firm catches the obvious ones every time. But even the best reviewer can miss the one combination of load and wind nobody simulated – which is why Cetus fell despite an audit. An audit shifts the odds heavily in your favor; it doesn't promise the bridge can never fall. :::

:::keypoints{label="Key Points"}

• Because there's no undo on-chain, security is front-loaded entirely onto the moment before you interact: unlike a bank fraud you can dispute, here the only "customer protection" is the choice you make before signing. Build your routine around that one irreversible instant
• Old defensive assumptions keep expiring: "an attacker can't afford to move the price" died with flash loans, and "audited code is safe" is dying as AI scales both finding and exploiting bugs. Treat any single safety claim as having a shelf life
• No single signal is enough. Weigh several together: an audit, the bounty size, time in the wild, and now whether the protocol runs live monitoring. One green checkmark is marketing; a stack of independent ones is a probability worth acting on
• The defender's edge is the public ledger: the same transparency that lets a bug be exploited also lets the theft be traced, frozen, negotiated back, and prosecuted. "It ran as code" is no longer a safe legal hiding place, as Eisenberg's conviction showed :::

:::details{badge=Advanced title="Anatomy of a flash-loan attack, and what happens after a hack"} A flash-loan attack follows a tight script, all inside a single transaction that either completes whole or reverts entirely. First the attacker borrows millions with no collateral via a flash loan. Then they manipulate a token's price on a DEX – say, with a massive swap that moves a thin pool. Next they exploit a protocol that naively uses that now-distorted on-chain price as its oracle – borrowing against inflated collateral, or draining a lending pool. Finally they repay the loan and keep the profit. The whole thing is one transaction, one block, ~$100 of gas. Euler Finance (March 2023) is the canonical case: attackers used flash loans to make the contract believe there were fewer collateral tokens than debt tokens, draining $197 million. Protocol-level defenses are well known now: Chainlink oracles instead of raw on-chain price, TWAP, and multi-oracle setups – but they only protect protocols that actually adopt them.

:::p{html} What happens after a hack is its own ecosystem. Bug bounties pay white-hats to find bugs before criminals do: Immunefi has paid out over $120 million to date, with a record single payout of $10 million for a vulnerability in the Wormhole bridge. Negotiating with the hacker is now common – the attacker returns the funds in exchange for a "bounty" and no prosecution. Euler is the standout: the hacker took $197 million and returned all of it; because ETH rose during the talks, Euler effectively recovered ~$240 million. On-chain messaging is the channel – protocols write to the attacker through transaction input data, proposing terms. This is the strange upside of an immutable public ledger: the thief can't hide the loot, so returning it is sometimes the rational move. :::

And increasingly, there's a courtroom at the end of the chain. The clearest case is Avraham Eisenberg, who drained $110 million from Mango Markets in 2022 via a flash-loan price manipulation and publicly called it a "legal trading strategy" – the "code is law" defense. He was arrested in December 2022, and in April 2024 a jury rejected that defense and convicted him of fraud and market manipulation – a first for a DeFi exploit. The twist: in May 2025 a judge vacated those convictions on a venue technicality, showing the law here is still being written even as enforcement bites. Laundering infrastructure is targeted too – the mixer Tornado Cash was sanctioned by the US Treasury over roughly $455 million in North Korea-linked funds. The lesson for the would-be "it's just clever code" attacker: tracing plus prosecution increasingly turns a public on-chain theft into a public on-chain confession. :::

:::details{badge=Advanced title="AI on both sides: the audit just got cheaper – so did the attack"} The economic asymmetry above – cheap audit, expensive exploit – is exactly what AI is now reshaping, and it cuts both ways. On the defense side, large language models read Solidity, Vyper, and Move directly and reason about logic, not just pattern-match. Benchmarked frameworks (LLM-SmartAudit, iAudit at ~91% accuracy) outperform classic static analyzers like Slither and Mythril precisely on the complex logic bugs those tools historically missed. The 2026 research frontier is agentic auditing: systems where the AI proposes a vulnerability and a verification engine proves it, killing the false-positive problem that plagued early LLM scanners. One such framework reconstructed 17 of 20 real post-2025 attacks ($384M in losses) and surfaced four confirmed zero-days protecting $400M in TVL – at about $2.31 per 10,000 lines of code, cutting analysis time by ~97%. The practical upshot: re-auditing old, long-"trusted" contracts is now cheap enough to do continuously, and real-time monitors (e.g. Forta) can pause a protocol within seconds of an exploit's first transaction.

:::p{html} But the same capability arms the attacker. The identical models scan thousands of deployed contracts for weak spots autonomously, and AI slashes the cost of the human-facing attacks elsewhere in this card – convincing phishing copy at scale, voice and video deepfakes for the social engineering in §5. And AI is no guarantee even on defense: it hallucinates, it still struggles with deep business logic and cross-protocol economic invariants, and the sobering proof that human review already fails came in March 2025, when a reentrancy bug drained $47M in 90 seconds from a contract three separate firms had audited. :::

:::p{html} So what should you actually do in a fast-moving-AI world? As a user: prefer protocols that pair audits with real-time monitoring and a live bug bounty, and stay as skeptical of "AI-audited" as of "audited" – both are signals, not proofs. As a developer: treat AI as a first-pass filter that frees human auditors for the hard architectural and economic-logic questions, keep a human in the loop on anything that moves funds, and assume attackers are running the same tools against your code the moment it ships. The 2026 consensus is blunt: AI plus humans beats either alone, and the lone constant is that an audit lowers risk – it never zeros it. ::: :::

:::further{label="Further Reading"}

• Rekt.news – exploit leaderboard | rekt.news
• Immunefi – bug bounty platform | immunefi.com :::

:::quiz{id=q-4-1-s4 label="Check yourself" correct=2 explanation="Correct. An audit is expert review, not a proof of safety. Cetus was audited and still lost $223M to a logic bug. Treat “audited” as one positive signal among several – weigh it with bounty size and time in the wild, and never as a guarantee."} A protocol proudly says it's "audited." What does that actually guarantee?

• That the code is mathematically proven free of all bugs
• That your funds are insured if it's exploited
• That experts reviewed it and caught most issues – but not necessarily all
• That the team is anonymous but trustworthy :::

:::section{mins=5} Social Engineering :::

:::lead A "friend" messages you on Telegram begging for urgent help with a transfer. A recruiter on LinkedIn offers your dream job. "Project support" in Discord asks for your seed phrase. None of these attacks the code – they attack you. And no technical defense helps if you're the one handing over the data or signing the transaction. :::

:::p Social engineering is the oldest trick in fraud, ported to crypto – and it works because it bypasses every technical control by getting you to act against your own interest, willingly. Each scheme targets a specific human lever: :::

:::howto{label="Common schemes"}

• Fake support – "Your wallet is locked, enter your seed phrase to unlock it." Plays on fear of losing funds.
• Pig butchering (romance scam) – weeks of conversation on a dating app or Telegram, real "friendship," then an "investment opportunity" on a fake platform. Exploits trust.
• Impersonation – a fake Vitalik or a fake project founder: "Send 1 ETH, get 2 back." Plays on authority.
• Hacked accounts – a real project's breached Twitter posts "emergency migration, connect wallet."
• Job-offer scam – "We're hiring a Smart Contract Developer," and the test assignment carries a malicious npm package. Run it and your machine is taken over, your keys stolen. This is how Lazarus Group attacks developers. :::

:::p Pig butchering deserves special attention because of its patience. The scammer may "befriend" you for weeks – discussing life, sharing "personal" stories, building a genuine-feeling emotional bond. Only once trust is established does the "investment" appear, and by then the victim no longer sees a stranger, let alone a fraudster. There's one reliable tell: if an online acquaintance eventually steers the conversation toward crypto investing, it's a near-guaranteed scam, no matter how warm the relationship felt. :::

:::p The throughline across all five is that the technology did its job – you were simply persuaded to override it. The defense, then, is a set of pre-committed rules you follow regardless of how the moment feels: no one legitimate ever needs your seed phrase; "send X, get 2X back" is always a scam; an unsolicited job test that wants to run code on your main machine is hostile by default. :::

:::callout A skilled street magician doesn't pick your pocket. He does a card trick, cracks a joke, and you hand him your wallet yourself, "just to hold for a second." The attacker doesn't break your defenses either; he creates a situation in which you switch them off yourself, feeling clever and in control the whole time. The misdirection isn't the lie he tells; it's the good mood he puts you in so you stop checking. :::

:::keypoints{label="Key Points"}

• A sudden spike of emotion (urgency, fear, flattery, or the thrill of easy money) is the attack surface itself. Treat the feeling as the alarm: the stronger the pull to act now, the more it's worth doing nothing for a beat
• AI makes these attacks cheaper and more convincing: voice and video deepfakes can now impersonate a founder or a friend in real time, so "I recognized their face/voice" is no longer proof of identity. Verify through a separate channel, never through the one that contacted you
• You don't have to be rich to be a target: state groups like Lazarus go after developers and employees for their access, not their savings, turning an ordinary job applicant into the entry point for a nine-figure theft :::

:::details{badge=Advanced title="Lazarus Group, and the legit-looking dApp that farms your approvals"} :::p{html} Lazarus Group (North Korea, DPRK) is the most dangerous actor in crypto, with roughly $6.75 billion stolen between 2017 and 2025 (Chainalysis). Their primary target isn't exchanges head-on but the developers and staff around them: a fake LinkedIn recruiter offers a "dream position" and sends a "test assignment" containing malicious code; run it, and the victim's machine is taken over and private keys are stolen. Confirmed operations: Bybit (Feb 2025, $1.5B, the largest theft in crypto history – a social-engineered Safe{Wallet} developer let them swap the signing interface for Bybit's 3-of-6 multisig; the full mechanics are dissected in 3.2 §1); Ronin Bridge (Mar 2022, $620M, a fake job offer to a Sky Mavis engineer compromised 5 of 9 validator keys); and Atomic Wallet (Jun 2023, $100M+, attributed by Elliptic). Defending against a state actor takes process, not just gadgets: dedicated signing machines, hardware wallets, and security training for the whole team. :::

:::p{html} A subtler off-shoot is approval farming: building a genuinely working dApp – a game, a tool, an NFT mint – whose real purpose is to accumulate token approvals. It functions as advertised, so nothing feels wrong; but weeks or months later, once enough wallets have approved it, the operator uses those standing permissions to drain everyone at once. In July 2024 a Li.Fi Protocol vulnerability was used to pull $9.7 million, and the wallets that lost funds were specifically the 153 that had granted unlimited approvals. The mechanics of approve and revoking are covered in 3.3 §5, and the defense is the same – never grant unlimited approve, set explicit amounts, and periodically review and revoke unused permissions via Revoke.cash or Rabby. ::: :::

:::further{label="Further Reading"}

• FBI IC3 – crypto scam alerts | ic3.gov
• Chainalysis – North Korea / DPRK hacking | chainalysis.com :::

:::quiz{id=q-4-1-s5 label="Check yourself" correct=1 explanation="Correct. An online relationship that eventually pivots to crypto investing is the defining pattern of pig butchering – the patient trust-building is the attack, not a sign of safety. The warmth is the weapon; the platform's polish is irrelevant."} An online friend of several weeks gradually starts talking about a great crypto investment. What is this most likely?

• A genuine tip – they clearly trust you by now
• Pig butchering – the weeks of "friendship" were the setup
• Safe, as long as the platform has a nice website
• Risky only if they ask for your seed phrase :::

:::section{mins=5} Technical Attacks :::

:::lead You didn't click anything, didn't enter a seed phrase, didn't approve a shady contract – you just did a normal swap on Uniswap. And you lost 0.3% of the amount. How? Technical attacks run automatically: you don't have to make a mistake, you only have to perform an ordinary operation. :::

:::p This is a different class of threat: a machine that profits from your routine activity without any mistake on your part. The main types: :::

:::howto{label="Main types"}

• Sandwich attack (MEV) – a bot sees your swap in the mempool, buys the token just before you (front-run), the price rises, you buy higher, the bot sells right after (back-run) and pockets the difference. Defense: a tight slippage limit and a private mempool like Flashbots Protect.
• Address poisoning – the attacker sends a 0-value transaction from an address whose first and last characters match a contact you transact with. Later you copy the address from your history – and copy the attacker's. In May 2024 one victim lost $68 million in WBTC this way. Defense: use an address book and verify the full address, not just the first and last characters.
• Clipboard malware – malware on your computer swaps the wallet address you copied. You copy the right address; by the time you paste, it's a different one. Defense: always check the address after pasting, and run anti-malware.
• Dust attack – tiny tokens are sent to your address to track you and set up later social engineering. Fix: ignore unknown tokens; never interact with them. :::

:::p{html} A practical helper here: portfolio trackers like DeBank now tag these as "Scam" transactions and let you filter them out of your history. Those flags mostly cover exactly two things from this card – unsolicited scam tokens and fake airdrops (the §2 trap) and the lookalike entries created by address poisoning. The rule that follows is simple and absolute: never interact with a token that just appeared unrequested, and never copy an address straight from your transaction history without checking every character. :::

:::p What unites all of these is automation and scale: the attacker targets thousands of victims at once, with no manual effort per target. That's also the clue to the defense – it has to be automated too. You won't out-vigilance a bot on every single swap, so you install the guardrails once and let them run: a private mempool for MEV, an address book for transfers, anti-malware for the clipboard, and a habit of ignoring anything that lands in your wallet uninvited. :::

:::callout You're in line for coffee, about to pay $3 for the last cup. The reseller ahead of you hears your order, buys that last cup for $3, then immediately resells it to you for $3.10 – all in the split second before the barista even blinks. That's a sandwich attack: a bot sees your order (your swap, sitting in the public mempool), jumps in front to buy, and sells back to you at a worse price. You still get your coffee; you just quietly pay the middleman's cut every time you don't protect the order. :::

:::keypoints{label="Key Points"}

• These attacks need no mistake from you; being ordinary is enough, so vigilance can't be the defense. You set up automated guardrails once instead of trying to out-react a bot on every transaction
• The public mempool is what makes you front-runnable: your swap is visible before it executes, which is the whole opening a sandwich bot needs. Routing through a private mempool removes the visibility at the root
• Your transaction history is attacker-writable: anyone can plant a lookalike address in it, so it's a convenience you shouldn't trust blindly. Copy addresses from your own address book, never from the history feed
• Some of these losses are an operating-system problem: clipboard malware lives on your computer, and wallet security can't catch it. Verify the pasted address with your own eyes every time it moves real value :::

:::details{badge=Advanced title="Anatomy of a sandwich – and governance attacks via flash loan"} Walk through one sandwich concretely. You submit a USDC → ETH swap with 1% slippage. A MEV bot spots your pending transaction in the public mempool and acts in the same block: it buys ETH ahead of you (front-run), nudging ETH's price up ~0.5%. Your swap then executes at that worse price – still inside your 1% tolerance, so nothing looks wrong. The bot immediately sells (back-run) and keeps ~0.3%. Trivial on one trade, but across thousands of daily swaps it adds up to millions extracted. Defenses attack the root cause – visibility: Flashbots Protect or MEV Blocker route your transaction through a private mempool so bots never see it, and a tighter slippage caps how much can be skimmed even if they do.

:::p{html} A heavier variant targets protocols, not swaps: the governance attack. An attacker acquires or borrows governance tokens and votes through a malicious proposal – draining the treasury, changing a critical parameter, or whitelisting a hostile contract. The dangerous flavor is the flash-loan governance attack: borrow the tokens, vote, and repay all in a single transaction, so no real capital is ever at risk (this is the same flash-loan primitive from §4, pointed at the ballot box instead of a price oracle). The textbook case is Beanstalk (April 2022): the attacker flash-borrowed about $1 billion in stablecoins, used it to buy enough governance tokens, and invoked an emergencyCommit() function that allowed a supermajority proposal to execute immediately, with no delay. The malicious proposal drained $182 million from the treasury – all in one block, so no one could react; afterward the project abandoned on-chain governance for a multisig entirely. Defenses are structural: a timelock that delays execution after a vote passes (giving everyone time to react and exit if it's malicious), a minimum voting period, delegation to trusted delegates, and snapshot voting – off-chain voting weighted by historical balances, which a one-block flash loan can't influence. Snapshot makes the explicit point that the safest fixes here are the ones a single instantaneous transaction cannot touch. ::: :::

:::further{label="Further Reading"}

• Flashbots – MEV protection docs | flashbots.net
• EigenPhi – MEV & sandwich explorer | eigenphi.io :::

:::quiz{id=q-4-1-s6 label="Check yourself" correct=2 explanation="Correct. Anyone can send you a 0-value transaction from a lookalike address, planting it in your history so you copy the wrong one – that's address poisoning, and it cost one victim $68M. Copy from your own address book and verify the full address, every character."} You're about to send funds and copy the recipient address from your transaction history. Why is that risky?

• History is always outdated and shows old balances
• Copying from transaction history adds metadata that increases the transaction's size and cost
• An attacker can plant a lookalike address there via address poisoning
• Transaction history entries are copy-protected after a certain number of block confirmations :::

:::section{mins=4} How to Protect Yourself :::

:::lead A handful of simple rules cover the large majority of the risk. No single tool saves you from everything, but tools plus habits add up to a system that actually holds. :::

:::p Start with a minimum kit. None of these is exotic, and together they neutralize most of what this card described: :::

:::howto{label="The minimum kit"}

• Rabby with phishing detection and pre-sign simulation – shows the transaction's real outcome before you sign.
• A hardware wallet (Ledger, Trezor) for meaningful sums – the keys never leave the device. We cover how and why in 3.1 §6.
• Your seed phrase on paper or metal, stored offline – never in a file, never in the cloud.
• Bookmarks for every DeFi site – enter only through them.
• Regular revoke of unused approvals via Revoke.cash or Rabby.
• Flashbots Protect (or a similar private RPC) against MEV.
• Common sense – if an offer is too good to be true, it's a scam. :::

:::p The point of layering them is that each tool covers another's blind spot. Phishing detection may not know a brand-new scam site – but simulation will still show the transaction is hostile. A hardware wallet protects your keys – but not against you willingly signing a malicious transaction. Approval monitoring doesn't prevent an attack – but it lets you catch one early. Mapped against the threats from this card, the kit looks like this: :::

:::p{html}

:::p Habits matter as much as tools. Checking the URL before connecting a wallet, reading the simulation before signing, reviewing approvals once a week, staying skeptical of "too good" offers – these have to become reflexes. :::

:::callout Gearing up for a mountain hike: the helmet guards your head but not your feet. The harness catches a fall but not a rockslide. The headlamp lets you see but won't keep you warm. No single item saves you from everything – but the full kit dramatically raises your odds of getting home. Each tool covers its own zone of risk; you don't pick the "one best" item, you carry the set. And the gear is only half of it – the other half is the habits of someone who's done the route before. :::

:::keypoints{label="Key Points"}

• Security is a stack: each layer covers the others' blind spots. The productive question is always "which gap is still uncovered," not "which tool is best." Buying one good tool and stopping is the common mistake
• Tools and habits split the work cleanly: hardware and simulation stop what a machine can stop, but only your reflexes catch the attacks aimed at your judgment. A perfect toolkit with careless habits still loses
• Some layers prevent, others only detect, and you need both. Simulation prevents a bad signature, but approval monitoring just tells you something already leaked. Knowing which is which sets your expectations for what each can actually save
• Have an incident plan before you need one: in a live theft, minutes decide how much you keep, and that's the worst moment to be improvising. Deciding in advance what you'd revoke and where you'd move funds is itself a defense layer :::

:::details{badge=Advanced title="Your incident-response plan: what to do if you're hit"} :::p{html} If you suspect your wallet is breached, the difference between a scare and a total loss is often how fast and how calmly you move. The detailed walkthrough – including subtleties like a dedicated receiving wallet and why revoking on the old address can sometimes backfire – is in 3.3 §8. Here's the short checklist worth deciding on in advance, because the moment itself is the worst time to think it through: :::

:::p{html}

• Don't panic, and assess the scope: which addresses are actually affected? Don't assume everything; don't assume only one thing.
• Revoke approvals and move funds to a fresh address – the order and the nuances (when revoking on the old address only hurts) are covered in 3.3 §8.
• Check linked addresses: if one key leaked, others derived or reused alongside it may be exposed too.
• For large sums, call in specialists (Chainalysis, SlowMist) – tracing and exchange-level freezing are sometimes possible while funds are still moving.

:::p{html} Speed is everything. Because the ledger is public, a fast response can sometimes get funds frozen downstream – but only if you act while the trail is hot. So the real value of the plan isn't the steps themselves, it's having decided them before the incident. Keep it somewhere you can reach without your main machine. ::: :::

:::further{label="Further Reading"}

• Revoke.cash – manage & revoke approvals | revoke.cash
• Rabby – wallet with pre-sign simulation | rabby.io :::

:::quiz{id=q-4-1-s7 label="Check yourself" correct=3 explanation="Correct. A hardware wallet keeps your keys off the internet, but if you're tricked into approving a malicious transaction, it signs it just the same. That's why it's one layer in a stack – paired with simulation, bookmarks, revokes, and skepticism – not a complete defense on its own."} Why isn't a hardware wallet alone enough to keep you safe?

• Hardware wallets are vulnerable to remote attacks through manufacturer firmware updates
• Each hardware wallet supports only one blockchain, so the rest require separate devices
• The cost of buying and maintaining a hardware wallet outweighs the benefit for most users
• It protects your keys, but not against you signing a malicious transaction yourself :::