Deciphr Academy
Track 2 · Keeping crypto safe · Module 10

Security and common attacks

Phishing, drainers, address poisoning, rug pulls, exploits and the big hacks.

Lessons
7
Reading
55 min
Quiz
15 questions
Pass mark
80%
  1. 1How most losses happenHow do most people and companies lose crypto, through scams or through hacks?7 min
  2. 2Phishing, fake sites and fake supportHow do crypto phishing and fake support scams work, and what do official sources say to look for?7 min
  3. 3Wallet drainers and token approvalsHow can one signature let a wallet drainer empty a crypto wallet?9 min
  4. 4Address poisoningWhat is address poisoning, and how does it trick people into paying the wrong address?8 min
  5. 5Rug pulls, pump-and-dumps and investment scamsWhat are rug pulls, pump-and-dumps and "pig butchering" scams?8 min
  6. 6Code exploits and big hacksWhat is a smart contract exploit, and do audits prevent them?8 min
  7. 7The Brindlecove near-missWhat should a team record after a near-miss, and what do official sources say to do after a crypto theft?8 min

The case used in this module

Each module tells its own made-up Brindlecove story, so details can differ from one module to the next.

Key words

Social engineering
Using human contact, such as pretending to be someone trusted, to get information or access.1
Phishing
A form of social engineering: messages or fake websites that pose as someone trusted, to get your details or get you to open harmful links.12
Wallet drainer
A malicious smart contract or program that moves crypto and NFTs out of a victim's wallet to criminals once the victim connects or approves it.34
Token approval
Permission you give a smart contract to spend your tokens on your behalf.56
Allowance
How many of your tokens an approved spender is still allowed to withdraw.6
Unlimited approval
An approval with no practical limit, so the spender can take all of that token in the wallet, with no expiry date.78
Permit signature
A signed message, under the ERC-2612 standard, that sets an allowance without a separate approval transaction.910
Address poisoning
Planting a look-alike address in someone's transaction history so that they copy it and send funds to the attacker.1112
Zero-value transfer
A token transfer of zero tokens that an attacker can make appear to come from your address.1312
Rug pull
A project whose creator collects money from investors, then suddenly abandons it and keeps the money.14
Pump and dump
Hyping an asset to push its price up, then selling into the rise. The price usually falls and later buyers lose.1516
Pig butchering
A long investment scam in which the scammer builds trust over time, then steers the victim into a fake crypto platform.1718
Smart contract exploit
Using a flaw in a smart contract to take funds in a way its builders did not intend.1920
Reentrancy
A bug where a malicious contract calls back into a vulnerable contract before the first call has finished, for example to withdraw twice.20
Code audit
An independent review of a smart contract's code to find weaknesses. It won't catch every bug.1920
Transaction hash
A transaction's unique ID, a long string of letters and numbers. The FBI asks scam victims to report it.21
Sources
  1. Avoiding Social Engineering and Phishing Attacks. US Cybersecurity and Infrastructure Security Agency (CISA), blog (marked as archived content), 1 February 2021.
  2. Recognize and Report Phishing. US Cybersecurity and Infrastructure Security Agency (CISA), Secure Our World (marked as archived content), checked 22 October 2026.
  3. Criminals Pose as Non-Fungible Token (NFT) Developers to Target Internet Users with an Interest in NFT Acquisition (Alert I-080423-PSA). FBI Internet Crime Complaint Center, 4 August 2023.
  4. Criminals Steal Cryptocurrency through Play-to-Earn Games (Alert I-030923-PSA). FBI Internet Crime Complaint Center, 9 March 2023.
  5. What Are Token Approvals?. Revoke.cash, Learn pages (the maker of an approval-checking tool), checked 22 October 2026.
  6. ERC-20: Token Standard. Ethereum Improvement Proposals (Fabian Vogelsteller, Vitalik Buterin), created 19 November 2015, status Final.
  7. How to revoke smart contract access to your crypto funds. ethereum.org guides, page updated 6 June 2026.
  8. Ethereum security and scam prevention. ethereum.org, page updated 6 June 2026.
  9. ERC-2612: Permit Extension for EIP-20 Signed Approvals. Ethereum Improvement Proposals (Martin Lundfall), created 13 April 2020, status Final.
  10. What Are EIP2612 Permit Signatures?. Revoke.cash, Learn pages (the maker of an approval-checking tool), checked 22 October 2026.
  11. Address Poisoning Attacks. Etherscan Information Center (a block explorer's help pages), 15 January 2024.
  12. Blockchain Address Poisoning. Taro Tsuchiya, Jin-Dong Dong, Kyle Soska and Nicolas Christin (Carnegie Mellon University and independent), Proceedings of the 34th USENIX Security Symposium, August 2025.
  13. What Is Address Poisoning?. Revoke.cash, Learn pages (the maker of an approval-checking tool), checked 22 October 2026.
  14. Two defendants charged in non-fungible token ("NFT") fraud and money laundering scheme. US Department of Justice, US Attorney's Office for the Southern District of New York (read through the Internet Archive copy of 11 December 2025, as justice.gov showed a bot check), 24 March 2022.
  15. Pump and Dump Schemes. Investor.gov, US Securities and Exchange Commission, checked 22 October 2026.
  16. Customer Advisory: Beware Virtual Currency Pump-and-Dump Schemes. US Commodity Futures Trading Commission (CFTC), February 2018.
  17. FinCEN Alert on Prevalent Virtual Currency Investment Scam Commonly Known as "Pig Butchering" (FIN-2023-Alert005). US Treasury, Financial Crimes Enforcement Network (FinCEN), 8 September 2023.
  18. Cryptocurrency Investment Schemes (Alert I-100322-PSA). FBI Internet Crime Complaint Center, with the FBI Miami Field Office, 3 October 2022.
  19. Cyber Criminals Increasingly Exploit Vulnerabilities in Decentralized Finance Platforms to Obtain Cryptocurrency, Causing Investors to Lose Money (Alert I-082922-PSA). FBI Internet Crime Complaint Center, 29 August 2022.
  20. Smart contract security. ethereum.org developer docs, page updated 7 October 2026.
  21. FBI Guidance for Cryptocurrency Scam Victims (Alert I-082423-PSA). FBI Internet Crime Complaint Center, 24 August 2023.