A crypto security glossary is a list of the terms used around hacks, wallets, scams and exchange safety. This one explains more than 80 of them in plain English, from hot wallet and multisig to proof of reserves and supply chain attack.
I have been in crypto since 2013 and have sat through Mt. Gox, Bitfinex, Bybit and now Binance with money on the line. Every hack brings the same questions to my inbox. What is a hot wallet? Does proof of reserves mean my funds are safe? What does white hat even mean? So here is every definition in one place. For the running coverage of each incident, our security tag holds every hack and breach we have written up.
Custody and Wallets
Custody: Who holds the keys to your crypto. Custodial means a company holds them, non-custodial means you do. Our self custody vs exchange guide covers when each makes sense.
Hot wallet: A wallet whose keys sit on an internet-connected device. Fast, convenient and exposed. Exchange hot wallets are where most of the biggest thefts happen.
Warm wallet: An exchange wallet that is online but needs human approval to sign. Bitget lost funds from both hot and warm wallets in 2026.
Cold wallet: A wallet whose keys never touch the internet. Our cold wallet guide explains the setup and its limits.
Hardware wallet: A physical device that signs transactions offline. Ledger, Trezor and Coldcard are the big names, and we have asked whether Ledger, Trezor and Coldcard are still safe after 2026.
Keys and Recovery Phrases
Seed phrase: The 12 or 24 words that generate every key in a wallet. Whoever holds the phrase holds the coins.
Private key: The secret that signs transactions for one address. Our seed phrase vs private key guide explains the difference.
Public key: The half of the key pair you can share. It becomes your address, as explained in public key vs private key.
Passphrase: An extra word added to a seed phrase that creates a hidden wallet. Covered in our seed phrase passphrase guide.
Multisig: A wallet that needs several keys to approve a transaction. Safer in theory, although Bybit and Drift both lost nine figures through multisig setups. See what is a multisig wallet.
Burner wallet: A throwaway wallet holding only what one risky task needs. Our burner wallet guide shows the setup.
Bunker mode: A lockdown setup for long-term holdings that you almost never touch. Explained in crypto bunker mode.
Air gap: A device that never connects to any network. The strictest form of cold storage.
Secure element: The tamper-resistant chip inside a hardware wallet that holds the keys. It is the part CryptoBilis attackers did not need to break.
Exchange Safety Terms
Proof of reserves: A cryptographic report showing an exchange holds the assets it claims. It proves assets, not debts, which is why the next term matters.
Proof of liabilities: The other half, showing what the exchange owes customers. Together they add up to solvency.
Merkle tree: The data structure that lets you verify your own balance is inside a proof of reserves without exposing anyone else’s.
Protection fund: Money an exchange sets aside to repay users after a hack. Binance calls its fund SAFU, Bitget has a Protection Fund, and both got used in 2026.
SAFU: Secure Asset Fund for Users, Binance’s billion-dollar emergency reserve. The word started as a meme and became the industry standard.
Segregated funds: Customer assets held apart from company money. FTX did not do this, which is why it collapsed.
Withdrawal pause: The first thing an exchange does after a breach. Bitget, Binance and Mercado Bitcoin all paused within hours. The Mercado Bitcoin hack post shows how that looks from the user side.
Chain halt: When validators stop a blockchain to contain an exploit. BNB Chain did it in 2022, Berachain in 2025.
Freeze: When a stablecoin issuer or chain blocks stolen funds from moving. Tether and Circle froze more than $2.3 billion after the Binance hack.
Bank run: Mass withdrawals after a scare. Binance processed $4.65 billion in nine hours when withdrawals reopened in November 2026.
Insolvency: Owing more than you hold. The difference between Bybit, which stayed solvent after $1.5 billion, and Mt. Gox, which did not.
Exchange review: Our own safety assessments. The exchange reviews tag holds 40+ of them, each with a security section.
Account Security
2FA: Two-factor authentication, a second step after your password. The type matters more than having it.
SMS 2FA: Codes sent by text message. The weakest form, because a phone number can be stolen.
Authenticator app: Time-based codes generated on your device. Better than SMS, still phishable.
Passkey: A login tied to your device and the real website. Phishing-proof, because a fake site cannot trigger it.
Hardware security key: A physical key like a YubiKey. The strongest 2FA available.
SIM swap: When an attacker moves your phone number to their SIM and receives your codes. Our SIM swap attack guide covers the fix.
Port-out PIN: A code your carrier requires before moving your number. Cheap protection against SIM swaps.
Withdrawal allowlist: A list of approved addresses an exchange may send to. With it on, a hijacked account cannot withdraw anywhere new.
Anti-phishing code: A word you set that appears in every real email from the exchange. Missing word, fake email.
API key: Credentials that let software trade on your account. Binance lost $40 million through leaked API keys in 2019.
Account takeover: An attacker logging in as you, usually through SIM swap, phishing or a leaked password.
Data breach: A leak of customer records rather than funds. The Coinbase data breach and the Trezor data breach both turned names and addresses into scam targets.
Scams That Target You
Phishing: A fake message or site that tricks you into handing over keys, codes or signatures. Still the number one cause of retail losses.
Wallet drainer: A malicious site or contract that empties your wallet once you connect and sign. Our guide on avoiding wallet drainer scams shows the pattern.
Token approval: Permission for a contract to move a token from your wallet. Forgotten approvals are open doors, so learn how to revoke token approvals.
Unlimited approval: An approval with no cap. One signature can expose your whole balance of that token.
Signature phishing: Getting you to sign an off-chain message that later moves your funds. No gas, no warning.
Blind signing: Approving a transaction your device cannot display in full. Bybit’s signers were effectively blind signing when the Safe interface was altered.
Lookalikes, Fakes and Bait
Address poisoning: Planting a lookalike address in your history so you copy the wrong one. Covered in address poisoning explained.
Dusting attack: Sending tiny amounts of crypto to track wallets or bait them into a scam. See what is a dusting attack.
Fake app: A cloned wallet or exchange app in an official store. The fake Ledger app on the Apple Store drained users for weeks.
Rug pull: When a project’s own team drains it. Our guide on crypto rug pulls lists the warning signs.
Honeypot: A token you can buy but never sell. Explained in what is a honeypot in crypto.
Recovery scam: Someone promising to get your stolen funds back for a fee. They never do, as our guide on whether stolen crypto can be recovered explains.
Faucet scam: A fake free-crypto site that harvests wallets. Our faucet scams post shows the tells.
Social media hijack: A hacked brand or celebrity account pushing a scam token. The McDonald’s Instagram hack is the classic case.
AI trading bot scam: Malicious code dressed up as an AI bot. We dissected one in the Claude trading bot scam.
How Protocols and Exchanges Get Hacked
Exploit: Using a flaw in code or process to take funds. Every entry on our DeFi hacks 2026 guide is one.
Smart contract audit: A third-party review of a protocol’s code. Useful, yet Balancer, Cetus and Flooring were all audited before they were drained.
Reentrancy: A bug that lets a contract be called again before it finishes updating balances. The DAO hack in 2016 was reentrancy.
Flash loan attack: Borrowing millions with no collateral inside one transaction to manipulate a protocol, then repaying. Beanstalk and Euler fell this way.
Oracle manipulation: Feeding a protocol a false price so it misvalues collateral. A favourite against lending markets.
Governance attack: Buying or borrowing enough votes to pass a malicious proposal.
Bridge exploit: Tricking the code that moves assets between chains into releasing funds it should not. Six of the 20 biggest hacks are bridges, and our crypto bridge explainer shows why.
Infinite mint: A bug that lets an attacker create unlimited tokens. The XRP infinite mint bug was caught before anyone used it.
Keys, Vendors and Hardware
Private key compromise: The attacker simply obtains the signing key. Behind Bitget, DMM Bitcoin, KuCoin and the Magic Eden exploit.
Admin key: A privileged key that can upgrade or pause a protocol. Drift lost $285 million when attackers collected enough of them, as our Drift exploit explainer shows.
RPC poisoning: Feeding a protocol false blockchain data through compromised nodes. The KelpDAO exploit worked this way.
Supply chain attack: Compromising a vendor, tool or reseller rather than the target itself. Bybit through Safe, DMM through its wallet provider, Ledger through CryptoBilis.
Hardware implant: A physical chip added to a device to leak keys. The Ledger CryptoBilis case was the first at scale, and the later CryptoBilis sale and Trezor CryptoBilis reports showed how deep it went.
Seed generation flaw: A firmware bug that creates weak, guessable seeds. The Coldcard hack drained 1,789 BTC this way.
Range-proof bug: A verification flaw that let attackers mint unbacked L-BTC in the Liquid Network hack.
Zero-day: A flaw nobody knew about until it was used. The Zcash Orchard vulnerability was one, found with AI help.
AI-assisted exploit: Using AI models to find bugs in audited code faster than humans can. Our post on AI crypto exploit risk explains why “audited” means less every year.
Social Engineering
Social engineering: Manipulating people instead of code. The entry point for most of the biggest hacks ever.
Operation Dream Job: North Korea’s fake recruiter campaign. A job offer, a coding test, then malware. Ronin fell to it in 2022.
Contagious Interview: The reverse trick, where attackers pose as the hiring company and send a poisoned take-home test.
IT worker scheme: North Koreans working remote developer jobs under fake identities, sending salaries home and sometimes planting backdoors.
Insider threat: An employee or contractor who leaks access. Coinbase’s 2025 breach came from bribed support staff.
Compromised laptop: One developer machine with the wrong permissions. Binance says that is how $6.3 billion left, as the Binance hack post mortem explains.
Fake wallet interface: Altering what a signer sees so a malicious transaction looks routine. The Bybit hack post mortem walks through the one that cost $1.5 billion.
Who Does the Hacking
Lazarus Group: North Korea’s state hacking umbrella, responsible for more than $12 billion in crypto theft. Our guide on who is Lazarus Group covers the structure, and the earlier Lazarus Group crypto hacks post lists the trail.
TraderTraitor: The Lazarus subunit behind Binance, Bybit and DMM Bitcoin. Also tracked as Jade Sleet.
Black hat: A hacker who steals and keeps the funds. Most of the names above.
White hat: A hacker who finds flaws and reports them, or rescues funds, for a reward. The Flooring Protocol rescue by Yuga Labs is a clean example.
Grey hat: Someone who exploits first and negotiates later. Liquid Network’s attackers returned 85% and kept $47 million as a “bounty”.
Bug bounty: A reward programme for reporting vulnerabilities before anyone exploits them.
On-chain sleuth: An investigator who traces stolen funds publicly. Our post on ZachXBT tracking Lazarus shows how far that work goes.
After the Hack
Post mortem: The exchange’s or protocol’s own report on what happened. The Bitget post mortem is a good template for what one should contain.
Incident update: The short status posts during a hack. Binance published five in four days.
Bounty offer: A public offer to let the attacker keep a share if the rest comes back. Balancer, Poloniex and Liquid all tried it.
Clawback: Recovering funds by counter-exploiting the attacker. Jump did it to the Wormhole hacker for $225 million.
Hard fork: Rewriting the chain to undo a theft. Ethereum did it after The DAO, which created Ethereum Classic.
Mixer: A service that scrambles transaction trails. Our Tornado Cash and crypto mixers explainer covers the main one.
Peel chain: Splitting stolen funds through hundreds of wallets in small chunks to defeat tracing.
Privacy coin: A coin that hides sender, receiver and amount. Monero is where tracing usually ends, as our Monero deep dive explains.
OTC desk: An off-exchange trader who converts crypto to cash. Chinese-language OTC networks launder most Lazarus proceeds.
Made whole: When every user is repaid in full. Binance, Bybit, Bitget and KuCoin did it. Mt. Gox and WazirX could not.
Where to Read the Full Stories
The terms above come from real incidents, so here is where each one is covered in depth. The Binance hack is the largest theft ever recorded. The Bybit hack held the record before it. The Bitget hack was the warm-up a month earlier.
For the rankings, our biggest exchange hacks list covers centralized platforms and our biggest crypto hacks list adds DeFi, bridges and wallets.
For the practical side, start with the stay safe page, then the guides on claiming airdrops safely, whether airdrop farming is still safe, which DEX is safe and the best wallets for airdrops. Every beginner guide sits in the knowledge base.
Keep This Content Free
Eighty definitions, nine years of hacks and not a single paywall. If this glossary saved you from one bad signature, support the site by opening an exchange account through our links. Both publish proof of reserves, and Bybit has already proven it can cover a Lazarus-sized hole.
Final Words
Crypto security has its own language, and most people learn it the expensive way. Hopefully this page lets you skip that part. Bookmark it, because every big hack adds a term or two, and I update the list after each one.
Terms without a link yet are the guides still to be written. Watch the security tag for those over the coming weeks. And if you came here from the farming or trading side, our crypto airdrop glossary and meme coin glossary cover the rest of the vocabulary.
FAQ
What is the difference between a hot wallet and a cold wallet?
A hot wallet keeps its keys on a device connected to the internet. A cold wallet keeps them offline, usually on a hardware device. Exchanges lose funds from hot wallets, so the bulk of their reserves sits in cold storage.
Does proof of reserves mean an exchange is safe?
No. It proves the exchange holds certain assets at a snapshot in time. It does not show debts, and it cannot stop a hack. Treat it as one signal next to the protection fund, licensing and hack history.
What is a supply chain attack in crypto?
An attack on a vendor, tool or reseller that the real target trusts. Bybit was hacked through its wallet provider Safe, and Ledger users were drained through tampered devices from the reseller CryptoBilis.
What is the difference between a white hat and a black hat hacker?
A white hat finds flaws and reports or rescues funds for a reward. A black hat steals and keeps them. A grey hat exploits first and negotiates afterwards, like the Liquid Network attackers.
What is social engineering in crypto?
Manipulating a person into giving up access, rather than breaking code. Fake job offers, poisoned coding tests and bribed support staff are the common forms, and they sit behind most of the biggest hacks.
Can stolen crypto be recovered?
Rarely, and only when funds get frozen fast or the attacker returns them. Large exchanges usually repay users from reserves, but DeFi and wallet victims mostly get nothing back.
Credit: Source link
