Wallets & Security
Protecting your assets and managing keys
Plain English
Hot wallets are connected to the internet (apps on your phone/computer) - convenient but less secure. Cold wallets are offline (hardware devices like Ledger) - more secure but less convenient. It’s like keeping some cash in your pocket (hot) and some in a safe at home (cold).
Technical
Hot wallets: software wallets connected to the internet (browser extensions, mobile apps), enabling convenient access but vulnerable to remote exploits. Cold wallets: hardware devices (Ledger, Trezor) or paper wallets storing private keys offline, immune to online attacks. Best practice: hot wallets for daily use, cold storage for long-term holdings.
Plain English
A physical device (like a USB stick) that stores your private keys offline. Even when you plug it into your computer to make a transaction, the keys never leave the device. Most secure way to store crypto for long-term. Popular brands: Ledger, Trezor.
Technical
Specialized hardware devices designed to generate and store private keys in a secure element chip, isolated from internet-connected devices. Transactions are signed within the device after user verification (PIN, button press). Immune to remote attacks, keyloggers, and malware. Support multiple cryptocurrencies through BIP32/BIP39/BIP44 standards.
Plain English
A wallet that requires multiple people to approve a transaction, like a safe deposit box that needs two keys to open. For example, a "2-of-3 multisig" means any 2 out of 3 designated people must approve. Great for organizations or securing large amounts.
Technical
A cryptographic scheme requiring M-of-N signatures to authorize transactions. Smart contracts enforce that a threshold number of designated signers must cryptographically approve before execution. Eliminates single points of failure. Used for treasury management, organizational wallets, and enhanced security. Solana implements multisig through Squads Protocol and SPL programs.
Plain English
Scam where someone impersonates a legitimate website or person to steal your private keys or seed phrase. They might send fake emails, create fake websites, or DM you pretending to be support. Golden rule: legitimate companies will NEVER ask for your seed phrase.
Technical
Social engineering attack attempting to obtain sensitive information (private keys, seed phrases, wallet credentials) by impersonating trusted entities. Common vectors: fake websites (typosquatting), email/Discord/Telegram scams, malicious smart contract approvals, fake token airdrops. Defense: verify URLs, bookmark sites, use hardware wallets, revoke token approvals regularly.
Plain English
Bugs or vulnerabilities in smart contract code that hackers can exploit to steal funds. Even audited contracts can have hidden flaws. When you interact with a DeFi app, you’re trusting their code is secure. Stick to well-established protocols with multiple audits.
Technical
Vulnerabilities in smart contract code enabling exploits: reentrancy attacks, integer overflow/underflow, access control flaws, oracle manipulation, front-running. Audits by firms (Certik, Trail of Bits) reduce but don’t eliminate risk. DeFi composability creates systemic risk - one vulnerable dependency can compromise entire protocols. Always verify contracts, check audits, start with small amounts.
Plain English
Permission you give a smart contract to spend your tokens. Like giving someone a credit card with a spending limit. When using DEXs or DeFi apps, you approve them to access your tokens. Important: Revoke old approvals you’re not using to stay safe.
Technical
ERC-20/SPL token standard mechanism allowing smart contracts to transfer tokens on behalf of an address. Approvals specify spender address and amount limit. On Solana, this is handled through associated token accounts and program-derived addresses with designated authorities. Unlimited approvals pose security risk if contract is exploited - use tools like Revoke.cash to audit/revoke.
Plain English
A scam where developers create a token, hype it up, get people to invest, then suddenly drain all the money and disappear. Like pulling a rug out from under someone. Red flags: anonymous teams, locked liquidity for short periods, concentrated token ownership.
Technical
Exit scam where project creators abandon project after extracting value from investors. Types: (1) liquidity theft - removing DEX liquidity pool funds; (2) token dump - creators selling massive token allocations; (3) backdoor exploits - hidden smart contract functions enabling fund drainage. Due diligence: verify liquidity locks, check token distribution, audit contract ownership/mint authority.
Plain English
A loss you experience when providing liquidity to a DEX pool if the price of your deposited tokens changes. You might have been better off just holding the tokens. It’s "impermanent" because it only becomes a real loss if you withdraw - if prices return to original levels, the loss disappears.
Technical
Divergence loss experienced by liquidity providers in AMMs when the price ratio of deposited assets changes from initial deposit. Caused by constant product formula - arbitrageurs rebalance pools to match external prices. Magnitude depends on price divergence magnitude and time. Mitigated by trading fees earned and LP incentives. Most severe with volatile pairs; minimal with stablecoin pairs.
Plain English
Best practices for protecting your 12-24 word recovery phrase: write it down on paper (never digitally), store copies in multiple secure locations, never share it with anyone, and never enter it on websites. Your seed phrase is the master key to all your crypto.
Technical
Security practices for BIP39 mnemonic phrases: offline generation using hardware wallets, physical storage on durable materials (metal plates), geographic distribution of backups, verification of phrase validity, and air-gapped recovery testing. Seed phrases represent the cryptographic entropy from which all private keys are derived - their compromise means total asset loss.
Plain English
Psychological manipulation tactics used by scammers to trick you into revealing sensitive information. Common in crypto: fake support agents asking for seed phrases, impersonation of influencers offering "investment opportunities," or urgent messages claiming your account is compromised.
Technical
Manipulation techniques exploiting human psychology rather than technical vulnerabilities to gain unauthorized access to systems or information. In crypto contexts: phishing attempts, fake customer support, impersonation attacks, romance scams, fake airdrops, and authority exploitation. Defense requires security awareness, verification protocols, and healthy skepticism.