<a href="/en/glossary/wallet-and-security/address-poisoning/" target="_blank">Address Poisoning</a> is a scam technique where an attacker sends a zero-value dust transaction to your wallet from an address that closely resembles one of your common transaction destinations (differing only in a few middle characters) — this fake transaction gets recorded in your on-chain transaction history. The next time you make a transfer, if you habitually copy an address from history, you may copy the fake one and send funds to the attacker. The core of this attack exploits the habit of checking only the first and last few characters of an address while ignoring the middle.

A crypto wallet where the <a href="/en/glossary/wallet-and-security/private-key/">Private Key</a> (the wallet's root credential) never touches the internet. Because hackers can't reach the private key through the network, cold wallets are considered the safest way to store large crypto holdings. Hardware wallets like Ledger and Trezor are the most common <a href="/en/glossary/wallet-and-security/cold-wallet/" target="_blank">Cold Wallet</a> form.

A crypto wallet that's connected to the internet and ready to use anytime, with its <a href="/en/glossary/wallet-and-security/private-key/">Private Key</a> stored on an online device (phone, browser extension, exchange). It's fast and convenient, ideal for everyday small transactions and interactions, but because the key is exposed to a networked environment, its hacking and theft risk is far higher than a <a href="/en/glossary/wallet-and-security/cold-wallet/">Cold Wallet</a>.

<a href="/en/glossary/wallet-and-security/multi-sig/" target="_blank">Multi-Signature (Multi-sig)</a> is a wallet security mechanism requiring multiple private keys to jointly authorize a transaction, typically expressed as M-of-N: out of N private keys, at least M must sign simultaneously for the transaction to proceed. For example, 3-of-5 means 5 keys total, requiring any 3 to sign before funds can move. This makes loss or theft of a single key no longer catastrophic, and provides clear checks-and-balances when multiple parties manage shared funds. DeFi protocols, DAO treasuries, and institutional crypto asset management all widely use multi-sig.

A randomly generated secret number that is the sole proof of control over the assets at a blockchain address. Whoever holds the private key can move those assets — and unlike a bank password, it cannot be reset: lose it or leak it and the assets are permanently lost or stolen.

A <a href="/en/glossary/wallet-and-security/reentrancy-attack/" target="_blank">Reentrancy Attack</a> is a vulnerability exploit against smart contracts: the attacker exploits the window between when the contract sends funds and when it updates its internal state (account balance), calling the original withdrawal function again the instant funds are received — allowing the contract to pass the balance check again before the state updates, repeatedly draining funds until the contract is emptied. The DAO attack of 2016 (approximately $60 million lost) exploited this vulnerability and directly led to the Ethereum hard fork (the ETH/ETC split). This vulnerability remains one of the most critical checks in <a href="/en/glossary/blockchain-fundamentals/smart-contract/">Smart Contract</a> security audits today.

Usually 12 or 24 English words — the human-readable master backup of your entire crypto wallet. Whoever holds these words has full control over every asset in that wallet, and no customer service can recover it for you.

A <a href="https://claude-me.com/en/glossary/core-concepts/token/">Token</a> approval is when you grant a <a href="/en/glossary/blockchain-fundamentals/smart-contract/">Smart Contract</a> permission to spend a certain token in your wallet. In DeFi, before you can trade, provide liquidity, or stake a token with a protocol, you must first sign an approve transaction giving that contract an allowance to use the token. The catch: many interfaces request unlimited allowance by default, effectively letting that contract move all of that token in your wallet anytime in the future — and if the contract has a bug or is malicious, your assets risk being drained.

<a href="/en/glossary/wallet-and-security/two-factor-authentication/" target="_blank">Two-Factor Authentication (2FA)</a> is a security mechanism requiring two different verification methods to log in to an account. The first factor is usually something you know — a password; the second is something you have — such as a one-time passcode (OTP) on your phone, or a physical security key. Even if a hacker gets your password, without the second factor they still can't get in. In the crypto world, enabling 2FA is one of the most basic and lowest-cost security measures for protecting exchange accounts, email, and any account holding assets.