Security

Introduction

The overwhelming majority of losses in crypto come from a small set of repeated patterns: phishing, contract exploits, and avoidable operational mistakes, not exotic, unstoppable attacks.

This lesson is written from a defender's perspective. It explains what these attacks look like and why they work, so you can recognize the pattern, not how to carry one out.

By the end of this lesson you'll be able to recognize common phishing patterns, understand what a smart contract audit does and doesn't guarantee, spot the warning signs of a rug pull, and build the personal habits that remove most realistic risk.

Phishing

Phishing is the single largest cause of loss in crypto, by a wide margin. It doesn't exploit a weakness in a blockchain or a wallet, it exploits trust, and a moment of urgency.

The common thread across all three is the same: a request to sign, connect, or reveal something, wrapped in urgency. No legitimate support agent will ever ask for your seed phrase.

Smart Contract Exploits

Most smart contract exploits don't "break" anything in a traditional hacking sense. The attacker interacts with the contract exactly as its code allows, just in a sequence or combination its developers didn't anticipate.

A few categories of bugs show up repeatedly across incidents. Understanding what they are, at a conceptual level, helps you understand why audits and defensive coding patterns exist.

• Reentrancy. A contract sends funds out before updating its own internal balance, letting the same call re-enter and withdraw again before the first withdrawal is even recorded.
• Access control gaps. A function meant to be restricted (minting tokens, changing an admin) is missing the permission check that should have restricted it.
• Oracle manipulation. A contract that prices an asset using a manipulable source can be tricked into acting on a temporarily distorted price, often using a flash loan to fund the distortion.

None of these require the attacker to break cryptography, they require the contract's logic to have a gap. This is exactly what an audit is meant to catch.

What Audits Do (and Don't) Guarantee

An audit is a time-boxed, expert review of a contract's code, looking for the kinds of bugs covered in the previous section, and others specific to the protocol's design.

An audit reduces risk, it doesn't eliminate it. It's a review of the code at a specific point in time, by people working within a limited timeframe, not a mathematical proof that no bug exists.

A published audit is a genuinely good sign, but "audited" is a data point to weigh, not a guarantee to rely on completely.

Rug Pulls

A rug pull is a scam where a project's creators withdraw liquidity or funds and disappear, rather than a technical exploit of someone else's code. A few structural warning signs tend to precede one.

• Unlocked liquidity. If the team can withdraw the pool's liquidity at any time, with no lock or time delay, nothing stops them from doing so.
• Unlimited minting power. A function that lets the owner create new tokens at will can be used to dilute or dump on holders without warning.
• Anonymous team, no lock-up. Anonymity alone isn't disqualifying, but combined with no vesting schedule on team tokens, it removes any cost to walking away.
• Retained owner privileges. A contract owner that keeps the ability to pause trading, blacklist addresses, or change fees after launch holds a lot of leverage over holders.

Wallet Approvals & Permissions

To let a dApp move your tokens on your behalf (to swap or stake them, for example), you grant it a token approval, a permission recorded on-chain, separate from any individual transaction.

Many interfaces default to requesting an unlimited approval, permission to move any amount, indefinitely, rather than just the amount needed for that transaction. That convenience is exactly what a malicious approval abuses.

Reviewing and revoking unused or unlimited approvals periodically, using a block explorer's token approval checker, closes off access you may have forgotten you granted.

Personal Security Habits

• Separate wallets by purpose. Keep a small "hot" wallet for everyday interactions and a hardware wallet for meaningful holdings, exactly the hot/cold split covered in Module 02.
• Never share your seed phrase. No legitimate wallet, exchange, or support channel will ever need it, anyone asking for it is attacking you.
• Verify URLs before connecting. Bookmark official sites you use regularly instead of searching for them each time, search ads are a common phishing vector.
• Read what you sign. A wallet's signature prompt describes what permission you're granting, treat a request you don't understand as a reason to stop, not to proceed.
• Be skeptical of urgency. "Act now or lose your funds" is a pressure tactic used by nearly every phishing attempt, a genuine issue rarely requires an instant, unverified reaction.

If You Get Compromised

If you suspect a wallet has been compromised, or that you signed something malicious, speed matters more than certainty.

• Move remaining funds immediately. Send anything still safe to a fresh wallet whose keys have never touched the compromised device.
• Revoke approvals from the old wallet. Use a token approval checker to cut off any permission the attacker's contract still holds.
• Treat the device as compromised, not just the wallet. If malware or a fake app is the likely cause, a new wallet on the same device doesn't fix the root problem.
• Be wary of "recovery" offers. Unsolicited help offering to recover stolen funds, for an upfront fee, is itself one of the most common follow-up scams.

Summary

Most losses in crypto trace back to phishing, contract logic gaps, or avoidable operational habits, not unstoppable attacks. Recognizing the pattern is most of the defense.

An audit and a locked liquidity pool are good signs, not guarantees. The habits that remove the most realistic risk are simple: separate wallets by purpose, never share a seed phrase, read what you sign, and treat urgency as a reason to slow down.

Glossary

Audit

An independent review of a smart contract's code, looking for bugs and vulnerabilities.

Exploit

An attack that takes advantage of a specific bug or design flaw to steal or misdirect funds.

Rug Pull

A scam where a project's creators withdraw all liquidity or funds, abandoning users.

Reentrancy

A common smart contract bug where a function is re-entered before its state is updated.

Opsec

Operational security, the personal habits that reduce your exposure to attacks.

Phishing

An attempt to trick someone into revealing sensitive information or signing a malicious transaction, usually by impersonating something trusted.

Token Approval

An on-chain permission letting a contract move a specified (or unlimited) amount of your tokens on your behalf.

Oracle Manipulation

An attack that distorts the price feed a contract relies on, tricking it into acting on an inaccurate value.

Quiz

Check your understanding of this lesson before moving on. Incorrect answers point you straight back to the relevant section.