Crypto Security Glossary — Terms Defined

Keys and custody

Private key — The secret that authorises moving funds from an address. Whoever holds it controls the funds; there is no separate concept of ownership.

Public address — The identifier funds are sent to, derived from the private key. Safe to share.

Seed phrase (recovery phrase) — Typically 12 or 24 words encoding the master secret from which all a wallet's keys derive. A complete backup and a complete compromise. No legitimate service ever needs it.

Self-custody — You hold the keys. No counterparty risk, no recovery.

Custodial — A third party holds the keys; you hold a claim on them. Recovery exists, counterparty risk exists.

Hot wallet — Keys on an internet-connected device. Convenient; exposed to malware and phishing.

Cold wallet — Keys kept offline, usually on dedicated hardware. Signing requires physical possession.

Hardware wallet — A dedicated device holding keys offline and confirming transactions on its own screen — the part malware cannot alter.

Wallet separation — Using distinct wallets by purpose (vault, trading, burner) so one mistake cannot reach everything.

Burner wallet — A wallet holding almost nothing, used for unfamiliar contracts so a malicious approval costs little.

Authorisation

Approval (allowance) — Permission granted to a contract to move your tokens on your behalf. Persists until revoked, which is why an interaction you have forgotten can still drain tokens.

Unlimited approval — An allowance with no cap. Common practice, which is why a malicious one does not look unusual.

Revoking — Withdrawing a previously granted approval.

Wallet drainer — Malicious code producing a signature request designed to transfer your assets, presented as a routine action like "connect" or "claim".

Signature request — A prompt to cryptographically authorise something. The moment worth reading carefully, since a signature is the decision.

Contracts

Smart contract — Code deployed on-chain that executes deterministically when called.

Contract address — The unique on-chain address of a contract. The only reliable identifier a token has, because names and tickers are not unique.

Verified source code — Published source confirmed to compile to the deployed bytecode. Without it you are trusting a description of a contract rather than the contract.

Privileged function — A function ordinary holders cannot call: mint, pause, blacklist, upgrade. Not disqualifying; what matters is disclosure and control.

Mint — Creating new tokens after deployment, increasing supply.

Pause / freeze — Halting transfers. Legitimate and occasionally protective.

Blacklist — Blocking specific addresses from transacting.

Fee on transfer — A design where the recipient receives less than was sent. Breaks assumptions most exchange integrations make.

Asymmetric fee — A different fee on sells than buys, or one the owner can raise after launch. The honeypot pattern.

Rebase — A design where balances change without a transfer occurring.

Proxy contract — A contract forwarding calls to a replaceable implementation. How upgradeability works; means the reviewed contract may not be tomorrow's contract.

Renounced ownership — Permanently giving up the owner role. Does not necessarily remove other privileged roles, and removes the ability to fix a bug.

Multisig — A wallet requiring several independent keys to authorise an action.

Timelock — An enforced delay between calling a privileged function and its taking effect, giving holders time to react.

Audit — An independent examination of contract code. Evidence that competent people looked and a record of findings — not a guarantee, and no protection against liquidity removal or supply dumping.

Fraud

Phishing — Impersonating a trusted party to obtain credentials, signatures, or funds.

Impersonator token — A contract deployed using a real project's name and ticker. Defeated only by checking the contract address.

Honeypot — A token that can be bought but not sold, due to a contract-level restriction invisible in market data.

Rug pull — Operators extracting value and abandoning a project, via liquidity removal, contract restriction, or supply dumping.

Advance-fee fraud — Payment demanded for something never delivered — a listing, a partnership, a release of funds.

Recovery fraud — Offering, for a fee, to recover already-lost funds. A second fraud targeting people who have just been defrauded.

Address poisoning — Sending a tiny transaction from an address whose first and last characters match one you have used, hoping you later copy the wrong one from your history.

Address substitution — Malware swapping a destination address at the moment of copy or paste.

SIM swap — Taking over a phone number to intercept SMS-based authentication.

Social engineering — Persuading someone to act against their own interest. The mechanism behind most crypto losses.

Wash trading — Trading with oneself to manufacture apparent volume.

Spoofing — Placing orders with no intention of filling them, to create a false impression of supply or demand.

Account security

Two-factor authentication (2FA) — Requiring a second factor beyond a password.

TOTP — Time-based one-time password: the rotating six-digit code an authenticator app generates. Phishable, because a code can be relayed.

Passkey — A cryptographic credential bound to a device and a specific domain. Cannot be phished, because the browser will not offer it to a lookalike site.

Recovery codes — Single-use codes bypassing 2FA when the authenticator is unavailable. As sensitive as a password; store offline, away from the authenticator device.

Trusted device — A device recognised so it is not challenged each login. Should carry expiry and be revocable.

API key scope — The permission attached to an API key. CoinDock separates read, trade, and withdraw, so a leak's consequence depends on what was granted.

HMAC signing — Authenticating an API request by signing it with a secret rather than transmitting a bearer token.

Withdrawal allowlist — A registered list of permitted withdrawal addresses.

Cooldown — A delay before a newly added withdrawal address may be used, so momentary account access cannot be converted into an immediate withdrawal.

Related

• Crypto Security Basics
• Wallet Safety Guide
• Common Crypto Scams