# Onchain Diary

> Web3 education with depth — from DeFi mechanics to on-chain detective work. Learn to read the chain before you trust the page.

## Featured Guides
- [Tools — free onchain security tools hub: BIP-39 wordlist (2,048 words, searchable), Anti-Scam Yellow Paper with quiz, Security Persona Test, and an MCP server for AI assistants (bilingual)](/tools/)
- [Airdrop Safety: The Complete Guide — how fake airdrops work and how to claim real ones safely](/airdrop-safety/)
- [The Ledger Supply-Chain Hack Case File — five investigations: reported reseller ownership change, suspected German retail implants, on-chain estimates, postmortem, the scammer who lost 60 BTC](/ledger-hack/)
- [Crypto Scam Recovery Help: The Victim's Road Map — first-24-hours emergency runbook, how to report (IC3 + exchange freeze), tracing stolen funds, real recovery, fake recovery services](/recovery-help/)
- [Onchain Anti-Scam Yellow Paper 链上防骗黄皮书 — bilingual (en/zh) systematic manual: scam taxonomy, forensics primer, layered defense checklists. Free PDF; LaTeX source repo: github.com/UZEN-Labs/antifraud-yellowpaper](/yellowpaper/)
- [Onchain Security MBTI — 16-scenario persona test mapping you to one of 16 onchain security personas with a safety score (interactive, bilingual)](/security-mbti/)

## Articles
- [Electrum's Server Swapped the Transaction, Then the Fee Bump Made You Sign It: A malicious Electrum server replaced a pending payment with one paying itself. Version 4.8.3 now verifies signatures. Upgrade and verify addresses.](/articles/electrum-server-swapped-transaction-fee-bump/)
- [Keystone's Breach Leaked Shipping Addresses, Not Seed Phrases. That Is Still Bad.: Keystone says a third party took names, addresses and order details after unauthorised access on Oct 20. No seed or card data. What to do now.](/articles/keystone-customer-data-breach-shipping-addresses/)
- [The Initia Hack: A Chain Halted Itself Mid-Attack as an 'Infinimint' Exploit Bridged Out $2.7M: Initia halted its L1 and all rollups on Oct 23 after an attacker spoofed MoveVM state, credited himself unbacked tokens and bridged ~$2.7M in WETH, AUSD0 and USDC to Ethereum. What is confirmed, what is not.](/articles/initia-halt-mint-exploit-explained/)
- [The NEM Token Hack: A Sell-Tracking Bug Let an Attacker Drain a PancakeSwap Pool 42 Times: The NEM (NemTokenV2) token on BNB Chain lost $821,920 to a contract logic flaw. How the pendingLpSellRecycle accounting bug was looped 42 times against PancakeSwap.](/articles/nem-token-contract-exploit-explained/)
- [The Fearless Wallet Hack: A Backdoor Hid in the Extension's Open Source for 20 Months: The Fearless Wallet browser extension sent private keys to an attacker server for 20 months. How the TON-camouflaged backdoor worked and what victims should do.](/articles/fearless-wallet-extension-key-leak-explained/)
- [The Ledger Implant Case: What Is Confirmed, What Is Estimated, What Is Still Open: Bitquery's October 16 estimate: $102M from 335 wallets on six chains, unconfirmed by Ledger. The device, the money trail, and what to check now.](/articles/ledger-cryptobilis-hack-final-recap/)
- [A Sui Bridge Claim Bot Just Paid the Cetus Hacker — 17 Months After the Freeze: A rescue bot finalized the Cetus hacker's 17-month-old bridge claims and paid out $392K. Why dormant bridge claims are live liabilities for every chain.](/articles/sui-bridge-claim-bot-cetus-hacker/)
- [Best Ways to Verify Token Addresses: 6 Checks That Hold Up Against Real Scams: Six ways to verify a token address before you buy: official-source cross-checks, explorer verification, scam scanners, and how scammers fake each signal.](/articles/best-ways-to-verify-token-addresses/)
- [Fake Crypto Exchange Scams: Why the Balance Grows but the Withdrawal Never Comes: The dashboard shows profit, the withdrawal is frozen, and support wants a fee. How fake crypto exchanges work, the deposit-address test that exposes them, and what to do now.](/articles/fake-crypto-exchange-withdrawal-scam/)
- [The Task Scammer Who Lost 60 BTC to a Tampered Ledger Wallet: A task-scam operator kept 60 BTC of stolen proceeds in tampered Ledger wallets — drained in a single morning. A rare look at scammers getting scammed.](/articles/ledger-task-scammer-loses-60-btc/)
- [Denmark CPR Breach: 8.8M Identities Sat Behind a '123456' Password: Millions of citizen records with trivially weak passwords — and crypto accounts in the blast radius. What the breach exposed and what to do now.](/articles/denmark-cpr-breach-123456/)
- [A German Buyer Reported Implants in Two MediaMarkt Ledger Devices: A German customer reported suspected implants in two MediaMarkt purchases. Ledger had not examined them, and its German stock checks found no tampering.](/articles/ledger-mediamarkt-implant-europe/)
- [Bitcoin Blackmail Emails Explained: The Password Is Real, the Video Is Not: Got an email with your real password demanding Bitcoin? The webcam video is fake. Here's how the scam works and what to do in the first hour.](/articles/bitcoin-blackmail-email-scam/)
- [FMMR Mining Scam: A Fake Pool Farmed 151 Wallets for Over 1.5M USDC — and the Permits Are Still Live Until 2030: FMMR Mining is a fake pool that farmed 151 wallets for 1.5M USDC. Victims signed permits valid until 2030 — if you connected a wallet, revoke now.](/articles/fmmr-fake-mining-pool-scam/)
- [CryptoBilis and the Ledger Tampering: A Reported Ownership Change: Ledger said the October 9 cases it verified involved CryptoBilis-sold devices; a former co-founder reported an ownership change. What the evidence does not show.](/articles/ledger-cryptobilis-supply-chain-hack/)
- [Fake Crypto Job Offers Explained: The $1.5B Hack That Started With One Recruiter Message: Recruiters offering crypto jobs with salary in USDT — then the 'work platform' takes your deposit. How fake job offers drain applicants, step by step.](/articles/fake-crypto-job-offer-scams/)
- [The Early '$86M Ledger Hack' Estimate: What On-Chain Tracing Shows: Multiple Ledger users were drained in October 2026. Early estimates used different methods and totals. What the on-chain tracing does, and does not, establish.](/articles/ledger-drain-address-poisoning/)
- [Abstract Chain Is Shutting Down: Bridge Out Before December 15 or Lose Access: Abstract Chain shuts down December 15, 2026 — assets left behind become permanently inaccessible. Official bridges, deadlines, and migration steps.](/articles/abstract-chain-shutdown-migration-guide/)
- [Crypto Task Scams Explained: How Easy-Money Jobs Turn Your Wallet Into a Money Mule: Like-and-earn job offers turn your wallet into a mule pipeline for stolen funds. How task scams groom, pay small, then trap — and the exit signs.](/articles/crypto-task-scam-money-mule/)
- [Fake Crypto Support Scams Explained: Why Support That Contacts You First Is Always Fake: A comment replies 'DM for support' under your post — the account is a scammer. How fake support works and why real teams never ask for what they ask.](/articles/fake-customer-support-scams/)
- [MetaMask Infrastructure Incident Explained: Why Your Wallet Was Never at Risk: Validators began exiting after a disclosed incident — but wallets were never exposed. The key-splitting architecture that protected user funds.](/articles/metamask-infrastructure-incident-explained/)
- [Blast L2 Is Shutting Down: How to Withdraw Safely Before October 26: Blast is shutting down its chain. What happens to assets left on it, which bridges still work, and the withdrawal steps to take before the window closes.](/articles/blast-l2-shutdown-withdrawal-guide/)
- [NEAR Intents Hack Explained: How a Signed-Note Bug Drained $3.87M: A signed-note bug let an attacker withdraw $3.87M without any user signature. Full timeline, where the money went, and why users couldn't have stopped it.](/articles/near-intents-hack-explained/)
- [ClickFix Scam Explained: How a Fake CAPTCHA Drains Crypto Wallets: A fake 'verify you are human' page tells you to press Win+R and paste a command. That command installs malware that drains wallets. How the trap works.](/articles/clickfix-fake-captcha-scam-explained/)
- [GIWA Fake RPC Scam: Full Forensics of a 771-ETH Fake Bridge Built From Verified Code: A verified-code proxy, a fake RPC, a mainnet that doesn't exist. How the GIWA fake bridge drained depositors — and the check that catches copies.](/articles/giwa-fake-rpc-bridge-scam-explained/)
- [Bitget Hack Explained: $387M Moved Without a Single Private Key Stolen: Bitget lost $387M when attackers fed spoofed data into its wallet backend — no private keys were stolen. How it worked and what users should watch.](/articles/bitget-hot-wallet-hack-explained/)
- [Magic Eden Exploit Explained: A Dead Marketplace, Living Approvals, and a $5.7M Whitehat Rescue: NFTs left wallets for 0 ETH via a contract Magic Eden stopped using — the approvals never expired. How the exploit worked and the whitehat rescue.](/articles/magic-eden-payment-processor-exploit/)
- [Wallet Drained? What You Can Actually Do After a Drainer Attack: A malicious signature took your tokens or NFTs. What still works — revocation, reporting, the recovery-scam second wave — and what doesn't.](/articles/after-wallet-drainer-what-now/)
- [Where Pig Butchering Money Actually Goes: Tracing a $73 Million Laundering Pipeline: Fake platforms show gains while deposits move through shells and USDT. Inside a documented $73M laundering pipeline — each hop as seen on-chain.](/articles/pig-butchering-crypto-tracing/)
- [FomoPeek Malware: How a Read-Only Whale Tracker Stole iOS Private Keys: An iOS app passed review, then shipped kernel-level wallet theft. How the FomoPeek attack worked, who it hit, and what to check before any airdrop app.](/articles/fomopeek-app-malware-explained/)
- [zkSNARKs Auction Cleared 12,000 ZEC. Here Is What the Winners Actually Hold: Zcash's zkSNARKs identity auction cleared 12,000 ZEC. But ZSA isn't on mainnet — what winners actually hold, and why the data is unverifiable.](/articles/zksnarks-auction-what-bidders-bought/)
- [Zcash Cold Storage: How to Store ZEC Offline in 2026: Transparent addresses work anywhere; shielded mostly don't. What Trezor and Ledger actually support, three working setups, and the scams to dodge.](/articles/zcash-cold-storage-guide/)
- [BNB Chain Token Safety: How to Avoid Scams on Binance's Chain: Scam tokens follow BNB Chain's cheap fees everywhere. Check contract, owner powers, holders, and liquidity before you buy — the free 5-step check.](/articles/bnb-chain-token-safety/)
- [Polygon Token Safety: How to Avoid Scams on the MATIC Chain: Every Ethereum scam pattern follows cheap fees onto Polygon. Check contract, owner powers, holders, and liquidity — the free 5-step check.](/articles/polygon-token-safety/)
- [Zcash Whitelist Season: One Takes Your ZEC, One Takes Your Identity Map: One project charged for a testnet NFT; another collects identity-to-address maps for free. What each whitelist model actually takes from you.](/articles/zcash-whitelist-what-you-hand-over/)
- [Arc Mainnet Day-One Risks: Copycat Tokens and Fake Airdrops in the First Hours: Circle's stablecoin L1 went live and copycats appeared within hours — duplicate tickers, pump spikes, fake drops. A field guide from day-one data.](/articles/arc-mainnet-day-one-risks/)
- [Hormuz Strait Crypto Toll Scams: Fake 'Safe Passage' Messages, Explained: Ship operators get messages demanding crypto for transit — some impersonate real tolls, some are pure extortion. What's real, what's fake, how to verify.](/articles/hormuz-strait-crypto-scam/)
- [Khabib's Crypto Deals, Explained: Gyms, NFTs, and the "Regulated Tokenization" Pitch: Hashrate-backed NFTs, a papakha drop, a $10B tokenized-gym pitch — we separate what's documented from what's promised in Khabib's crypto deals.](/articles/khabib-crypto-deals-explained/)
- [The Telegram Crypto Pitch, Read Back to the Scammer: A Real Chat, Dissected Line by Line: A stranger pitches a token 'launching tonight on Base.' We annotate every beat of the real script — and what happened when we pitched it back at him.](/articles/telegram-crypto-pitch-script/)
- [How to Report a Crypto Scam: IC3, Exchange Freeze Requests, and What Actually Happens After You File: Assemble the evidence, file the IC3 complaint field by field, send exchange freeze requests that get read — and what to expect after you submit.](/articles/how-to-report-crypto-scam/)
- [Public Key vs Private Key vs Wallet Address: The Difference Scammers Hope You Never Learn: Every wallet scam relies on you not knowing which string is which. The difference between the three — and what each one can cost you if leaked.](/articles/public-key-private-key-wallet-address/)
- [Unbacked Mint Attacks: How Fake Receipts Drained Liquid Network and Symbiosis: Mint wrapped assets against deposit receipts that never happened. How Liquid Network and Symbiosis lost real BTC to the same trick in one week.](/articles/unbacked-mint-attacks-explained/)
- [Why You Should Never Generate a Seed Phrase Online: Online generators either log the phrase or trust the browser with randomness. How real wallets create seed phrases — and the fix if you already used one.](/articles/seed-phrase-generator-risk/)
- [How to Store a Seed Phrase: Steel, Paper, Copies, and Inheritance: A backup survives only what it can survive — fire, flood, theft, your own memory. Paper done right, when steel earns its price, and copies that don't leak.](/articles/seed-phrase-storage/)
- [Where Stolen Crypto Goes Dark: Privacy Pools and What Tracing Can Still Do: The trail usually ends in a shielded pool or mixer. How privacy layers change fund tracing — and what victims can still realistically do after that.](/articles/stolen-crypto-privacy-pools/)
- [When 'Encrypted' Is Just a Word: A 3-Step Reality Check for Crypto Privacy Claims: A generative-art project claimed zk-powered locks; the data sat in plain HTML. How we checked — a method you can reuse on any 'zero-knowledge' mint.](/articles/encrypted-claims-reality-check/)
- [Infostealer Malware Explained: How Stolen Sessions Drain Crypto Accounts: One infected download grabs session cookies, saved passwords, and wallet vaults. The full crypto kill chain — and the defenses that actually work.](/articles/infostealer-malware-crypto-attacks/)
- [Crypto Stolen? The First 24 Hours: A Step-by-Step Emergency Runbook: Triage the intrusion, secure what's left in the right order, build evidence, fire freeze requests before the mixer. The emergency runbook, in order.](/articles/stolen-crypto-first-24-hours/)
- [Airdrop Snapshot Scams: Why 'Verify Your Wallet Before the Deadline' Is Always Phishing: Real snapshots need no action from you, ever. How snapshot scams use countdown pressure and why eligibility can always be checked without a wallet.](/articles/airdrop-snapshot-verification-scams/)
- [Hardware Wallet Scams Explained: Fake Devices, Phishing Letters, and the Setup Traps: The purchase itself can be the attack — tampered devices, fake letters, pre-filled recovery sheets. Six scam patterns and a buy-side checklist.](/articles/hardware-wallet-scams-explained/)
- [Fake Crypto Wallet Apps: How Scam Wallets in App Stores Steal Funds: Cloned wallet apps sit in official stores, waiting to swallow your seed phrase. How fakes get listed, how they phish, and the install checks that filter them.](/articles/fake-crypto-wallet-apps/)
- [Crypto Scams on X, Telegram, and Email: The Full Attack Chain Explained: Fake moderator DMs that drop malware, honeypot 'friends,' airdrop emails from lookalike domains — how the social-engineering playbook works, step by step.](/articles/social-media-crypto-scam-playbook/)
- [How to Read a Smart Contract Audit Report: A Practical Guide: An audit badge alone tells you almost nothing. How to read scope, severity, and fix status in an audit report — and spot projects that only look audited.](/articles/how-to-read-a-smart-contract-audit-report/)
- [Telegram Airdrop Bot Scams: How Tap-to-Earn Games Drain Real Wallets: Tap-to-earn onboarded millions — and industrialized fake bots. The five scam patterns inside Telegram airdrop games and the checks that expose them.](/articles/telegram-airdrop-bot-scams/)
- [SIM Swap Attacks Explained: How Phone Number Theft Drains Crypto Accounts: Take the phone number, reset the exchange login, drain the account. The full SIM-swap attack chain, real cases, and the defenses that actually stop it.](/articles/sim-swap-attacks-explained/)
- [Clipboard Hijacking Malware Explained: When Copy-Paste Steals Your Crypto: Malware swaps the address you copied the moment you paste. How clipboard hijackers work, where they come from, and how to make pasted addresses safe.](/articles/clipboard-hijacking-malware-explained/)
- [Pig Butchering Scams Explained: The On-Chain Anatomy of Romance Investment Fraud: Grooming, fake trading platforms, on-chain money trails — why pig butchering tops the FBI's loss charts, and how the funnel works at every stage.](/articles/pig-butchering-scams-explained/)
- [How to Detect NFT Wash Trading: A Practical On-Chain Workflow: Recycled token IDs, circular funding, round-trip cost math — the on-chain workflow that separates real NFT volume from wash-traded bait before you buy.](/articles/how-to-detect-nft-wash-trading/)
- [Anatomy of the Biggest Airdrop Scams: How Fake Claim Sites Actually Work: Anatomy of the fake-claim playbook: lookalike domains, wallet-connect harvesting, signature traps. How the biggest airdrop scams actually worked.](/articles/biggest-airdrop-scams-anatomy/)
- [How Stolen Crypto Is Actually Recovered: The Real Process Behind the Headlines: Chain-hopping leaves traces, exchanges freeze on request, seizures do happen. How recovery actually works — and what victims should do in the first 48 hours.](/articles/how-stolen-crypto-is-recovered/)
- [How to Claim an Airdrop Safely: The Burner Wallet Workflow: Verify the source independently, pick the URL before the frenzy, claim from a dedicated wallet, revoke after. The safe-claim workflow, in leverage order.](/articles/how-to-claim-airdrops-safely/)
- [The Airdrop Safety Checklist: 12 Checks Before You Connect a Wallet: Twelve checks in one list: source verification, URL discipline, contract inspection, signature reading. Run top to bottom — any failed check is a stop.](/articles/airdrop-safety-checklist/)
- [EIP-7702 Airdrop Phishing: One Signature, Total Wallet Control: EIP-7702 lets a single approval touch every token you own. How scammers abuse the new signature flow — and the prompt you should never, ever sign.](/articles/eip-7702-airdrop-phishing/)
- [Testnet Airdrop Safety: How to Farm Testnets Without Getting Drained: Fake testnet sites, seed harvesters, mainnet bait-and-switch — which testnet risks are real, and the workflow that keeps every season safe.](/articles/testnet-airdrop-safety/)
- [Airdrop Scam Checker: Verify Any Airdrop On-Chain in 5 Steps: Before you connect a wallet to claim an airdrop, run the 5-step on-chain check: contract age, deployer, holders, approvals, domain — free tools only.](/articles/airdrop-scam-checker/)
- [Airdrop Signature Scams: Why the Claim Button Is the Dangerous Part: Fake airdrop pages don't want your seed phrase — they want a signature. The four signature types a claim site can request and what each lets attackers do.](/articles/airdrop-signature-scams/)
- [Airdrop Eligibility Checker Phishing: How Fake Checkers Harvest Wallets: 'Check your eligibility' sites spawn every season — most harvest wallets. How fake checkers work and how to verify eligibility without connecting anything.](/articles/airdrop-eligibility-checker-phishing/)
- [How to Audit Your Own Wallet: A Step-by-Step On-Chain Security Review: Your history lists every approval and signature you've ever given. How to audit your own wallet with free tools — and clean up what shouldn't still be open.](/articles/how-to-audit-your-wallet-activity/)
- [Token Taxes Explained: How Buy/Sell Fees Work and When They Become a Trap: Buy and sell fees can fund a treasury — or hide a honeypot exit. How token taxes work and how to check the rate before you're the one paying it.](/articles/token-taxes-explained/)
- [Unsolicited Airdrop Tokens in Your Wallet: The Claim Trap Explained: Tokens you never signed up for are bait — fake claim sites, import tricks, address dusting. What happens if you interact, and the only correct response.](/articles/unsolicited-airdrop-tokens/)
- [How Fake Airdrops Reach You: Hijacked Accounts, Discord Bots, and Compromised News Sites: Hijacked accounts, Discord bots, compromised news sites — the distribution layer that puts scam drops in front of you. How each channel works.](/articles/fake-airdrop-distribution-channels/)
- [Crypto Recovery Scams Explained: How Fake Recovery Services Target Scam Victims: Stolen once, then targeted again — recovery firms that charge upfront and deliver nothing. How the second-wave scam works and the verification that matters.](/articles/crypto-recovery-scams-explained/)
- [Arbitrum Token Safety: How to Avoid Scams on Arbitrum: Cheap fees made Arbitrum a scam-token hotspot. Verify contract, owner powers, holders, and liquidity before you buy — free 5-step on-chain check.](/articles/arbitrum-token-safety/)
- [Solana Token Safety: How to Avoid Scams on Solana: A new Solana token looks like a 100x. Check mint authority, holders, and liquidity before you connect a wallet — the free 5-step on-chain check.](/articles/solana-token-safety/)
- [Base Chain Token Safety: How to Avoid Scams on Coinbase's Layer 2: Base's low fees drew a wave of scam tokens. Check contract source, owner powers, holders, and liquidity before you buy — the free 5-step check.](/articles/base-chain-token-safety/)
- [How to Check if Liquidity Is Locked: A Step-by-Step Guide for Token Buyers: Unlocked liquidity means devs can pull the pool anytime. Here's how to verify a lock on the explorer before you buy — 5 checks, free tools only.](/articles/how-to-check-liquidity-locked/)
- [Crypto Dusting Attacks Explained: How Tiny Transactions Expose Your Identity: Tiny token amounts appear from nowhere — that's dusting, and it's not a gift. What dusting tries to learn and when those fractions become a trap.](/articles/crypto-dusting-attacks-explained/)
- [Blind Signing Explained: The Hidden Risk in Every Hardware Wallet Transaction: Blind signing makes your wallet display hashes instead of readable terms — so you approve what you can't verify. How it works and when to refuse.](/articles/blind-signing-explained/)
- [ETH sign Phishing Explained: The Deprecated Method Still Draining Wallets: eth_sign lets a site move any asset from your wallet. It was deprecated years ago and still drains victims — how the prompt looks and how to refuse.](/articles/eth-sign-phishing-explained/)
- [How to Prevent Wallet Drainer Attacks: A Complete Defense Framework: Spotting drainers isn't enough — segregate wallets, cap approvals, monitor in real time. The defense stack that stops attacks before they land.](/articles/how-to-prevent-wallet-drainers/)
- [Infinite Approval Explained: Why Unlimited Token Approvals Are a Ticking Time Bomb: An unlimited approval lets a hacked contract drain your wallet months after you signed. Check your open approvals and revoke the ones you don't use.](/articles/infinite-approval-explained/)
- [Permit2 Phishing Explained: How One Free Signature Can Drain an Entire Wallet: Uniswap's universal router lets one free signature cover every token. How scammers weaponize Permit2 — and why it's riskier than ERC-20 approvals.](/articles/permit2-exploit-explained/)
- [Crypto Signature Scams: How One Signature Can Drain Your Wallet: The prompt looks harmless; the payload moves your tokens. Every signature-scam variant explained — and how to verify what you are actually signing.](/articles/signature-scam-explained/)
- [Wash Trading Detection: How to Spot Fake Volume on DEXs and NFT Markets: Paired wallets, impossible volume-to-liquidity ratios, clockwork timing — how to detect wash trading on DEXs and NFT markets with on-chain data.](/articles/wash-trading-detection-explained/)
- [Crypto Airdrop Scams Explained: How to Spot and Avoid Fake Airdrops: Fake drops arrive by DM, hijacked accounts, and lookalike domains. How airdrop scams bait a wallet connect — and the checks that expose them fast.](/articles/crypto-airdrop-scams-explained/)
- [Token Unlocks Explained: How Vesting Schedules Move Markets and How to Track Them: Locked supply releases on a schedule, and prices feel it. How vesting works, why unlocks create sell pressure, and how to track what's coming.](/articles/token-unlocks-explained/)
- [DeFi Yield Farming Risks: How to Evaluate Opportunities Safely: Sky-high APYs price in risks you can't see — contract bugs, rug pulls, impermanent loss. How to weigh a farm before you deposit a single token.](/articles/defi-yield-farming-risks/)
- [ERC-20 Token Security Check: A Developer's Guide to Auditing Any Token Contract: Source verification, owner powers, holder spread, taxes, honeypot traps. The six checks that catch most malicious ERC-20 tokens — free tools included.](/articles/erc20-token-security-check/)
- [Is This Token a Scam? How to Check Any Crypto Token Before Buying: Source verification, hidden mints, holder spread, taxes, honeypot traps. Six free on-chain checks that answer the question before your money does.](/articles/is-this-token-a-scam/)
- [How to Track Stolen Crypto: A Guide to Blockchain Forensics: Blockchains are public ledgers — theft leaves a trail. How investigators trace stolen funds, how thieves hide, and what victims should do first.](/articles/how-to-track-stolen-crypto/)
- [AI-Powered Crypto Scams in 2026: How Artificial Intelligence Became the Top Attack Weapon: AI now writes the phishing, clones the site, and fakes the video calls. How AI-powered crypto scams work and the defenses that still hold.](/articles/ai-powered-crypto-scams-2026/)
- [DeFi Liquidation Cascades Explained: How Cascading Liquidations Trigger Market Crashes: One liquidation forces the next, and prices gap through everyone's stops. How cascades form, on-chain signs of buildup, and defenses that hold in a crash.](/articles/defi-liquidation-cascades-explained/)
- [Kelp DAO Hack Explained: How a 1-of-1 DVN Configuration Let Attackers Forge $292M in Fake rsETH: A 1-of-1 bridge validator config let attackers forge $292M in unbacked rsETH in under an hour. How the largest DeFi hack of 2026 worked.](/articles/kelp-dao-hack-explained/)
- [NPM Supply Chain Attacks: How Compromised Packages Are Stealing Crypto Wallets in 2026: Compromised packages — from Axios to the Injective SDK — ship wallet-stealing malware straight into builds. How npm supply chain attacks work and how to defend.](/articles/npm-supply-chain-attacks-2026/)
- [Slippage Attacks Explained: How MEV Bots Exploit Price Movement During Transaction Execution: Between submit and execution, MEV bots move the price against you. How slippage attacks work, why tolerance settings matter, and safer fills.](/articles/slippage-attacks-explained/)
- [Proxy Contract Upgrade Attacks Explained: How Upgrade Patterns Became Attack Vectors: Control the upgrade function and you can swap trusted logic for a drain. How Parity, Wormhole, and Uranium-grade bugs worked — and the pattern to fear.](/articles/proxy-upgrade-attacks-explained/)
- [Integer Overflow and Underflow Attacks Explained: How Math Bugs Broke Smart Contracts: Numbers that wrap past their limits minted quadrillions of tokens and bypassed balance checks. How overflow attacks worked — and what Solidity 0.8 changed.](/articles/integer-overflow-attacks-explained/)
- [Bridge Attacks Explained: How Cross-Chain Bridges Became Crypto's Biggest Vulnerability: Bridges hold pooled funds and verify cross-chain messages — both get attacked. How the biggest bridge hacks worked and what to check before crossing.](/articles/bridge-attacks-explained/)
- [Sybil Attacks Explained: How Fake Identities Undermine Decentralized Systems: One operator, a thousand wallets, airdrop farming at industrial scale. How Sybil attacks distort voting and rewards — and how networks fight back now.](/articles/sybil-attacks-explained/)
- [Access Control Attacks Explained: How Broken Permissions Let Attackers Drain Smart Contracts: Broken permission checks let anyone mint tokens or seize a contract. How access control attacks work and the red flags to check before you deposit.](/articles/access-control-attacks-explained/)
- [Front-Running Attacks Explained: How Predatory Traders Profit from Your Pending Transactions: Your pending transaction is an announcement — bots trade ahead of it. How front-running works, what it costs you, and settings that reduce exposure.](/articles/front-running-attacks-explained/)
- [Governance Attacks Explained: How Attackers Exploit DAO Voting to Steal Millions: Flash-loan votes, hijacked delegations, smuggled proposals. How governance attacks seize DAO treasuries — and the signals of a manipulable system.](/articles/governance-attacks-explained/)
- [Reentrancy Attacks Explained: The Smart Contract Vulnerability That Started It All: Call back in before the balance updates, and you drain the vault on loop. How reentrancy worked from the DAO era to today — and the fixes that hold.](/articles/reentrancy-attacks-explained/)
- [Rug Pulls Explained: How Liquidity Pulls and Hidden Mint Functions Drain Your Wallet: Liquidity unlocks, mint authority, holder concentration — rug pulls telegraph themselves on-chain. The red flags to check before you buy any new token.](/articles/rug-pulls-explained/)
- [Flash Loan Attacks Explained: How Borrowed Billions Exploit DeFi: Borrow, attack, repay — all in one transaction with zero capital. How flash loan attacks warp prices and drain protocols, with real case anatomy.](/articles/flash-loan-attacks-explained/)
- [Sandwich Attacks Explained: How MEV Bots Front-Run and Back-Run Your Trades: Your trade sits in the mempool; bots front-run and back-run it. How sandwich attacks work mechanically and the slippage settings that blunt them.](/articles/sandwich-attacks-explained/)
- [Oracle Manipulation Attacks in DeFi: How Price Feeds Get Exploited: Flash loans bend a price feed for one block; protocols trusting it get drained. How oracle attacks work and what to check before you deposit.](/articles/oracle-manipulation-defi/)
- [DeFi Protocol Red Flags: How to Spot Risky Protocols Before You Deposit: Anonymous teams, unaudited upgrades, giant emission taps. The red flags that show up before a protocol fails — and how to check each one on-chain.](/articles/defi-protocol-red-flags/)
- [How to Avoid Crypto Phishing Scams: A Complete Defense Guide: Phishing sites and malicious approvals have stolen over $1 billion. How the attacks lure a signature — and the habits that protect any wallet.](/articles/how-to-avoid-crypto-phishing-scams/)
- [Address Poisoning Attacks: How They Work and How to Avoid Them: Scammers seed your history with lookalike addresses, hoping you paste the wrong one. How address poisoning works and the one habit that stops it.](/articles/address-poisoning-attacks-explained/)
- [How to Spot Wallet Drainers: A Field Guide to Malicious dApps: Drainer sites look like legitimate dApps until the signature prompt. How to identify them, how they lure, and the habits that keep assets safe.](/articles/how-to-spot-wallet-drainers/)
- [Cross-Chain Bridge Security: Understanding and Analyzing Bridge Risks: Lockups, validators, message verification — bridge designs fail differently. The risk model to apply before you trust any cross-chain bridge with funds.](/articles/bridge-security-explained/)
- [Token Approval Safety: How to Audit and Revoke Smart Contract Permissions: Every approval is a standing permission to move your tokens. How to audit what you've signed — and revoke everything that shouldn't still be open.](/articles/token-approval-safety/)
- [Address Risk Scoring: How to Read the Signs of a Dangerous Wallet: Phishing links, sanctions, laundering hops — a wallet's history tells you if it's dangerous. How risk scoring works and how to check any wallet free.](/articles/address-risk-scoring-explained/)
- [How to Verify a Token Before Buying: A Complete On-Chain Safety Checklist: Source, liquidity lock, holders, mint functions, taxes, honeypot traps. The on-chain checklist to run before buying any token — free tools included.](/articles/how-to-verify-a-token-before-buying/)
- [How to Spot Rug Pulls and Honeypots On-Chain Before You Lose Money: Liquidity locks, contract permissions, supply concentration — the on-chain flags that expose rugs and honeypots before you invest a single cent.](/articles/spotting-rug-pulls-and-honeypots/)
- [MEV Explained: Maximal Extractable Value and How It Affects Your Transactions: Bots reorder, front-run, and sandwich your transactions for profit. How MEV extraction works, who profits from it, and settings that cut what you pay.](/articles/mev-explained/)
- [Building Your On-Chain Analysis Workflow: A Complete Tool Stack Guide: From explorer basics to alerts and daily routines — a step-by-step workflow that turns raw blockchain data into decisions. Beginner to practitioner.](/articles/on-chain-analysis-workflow/)
- [Stablecoin Depegging: What It Means and How to Spot the Signs On-Chain: When a stablecoin's peg breaks, minutes decide losses. How depegging happens, the early on-chain warning signs, and a dip versus a death spiral.](/articles/stablecoin-depegging/)
- [How to Analyze Token Distribution: Concentration, Whales, and Risk: Token distribution tells you who holds the power. How to check concentration, spot whale risk, and judge whether a supply is healthy before you buy.](/articles/analyzing-token-distribution/)
- [Reading Smart Contract Events and Logs: A Practical Guide: Event logs are a contract's public diary of transfers, mints, and approvals. How to read them on any explorer for free — and what they reveal.](/articles/reading-smart-contract-events/)
- [Token Flow Analysis: Following the Money Trail on the Blockchain: Funds tell the story — wallets, exchanges, protocols, timing. The methodology and patterns that show what's really happening behind a token's moves.](/articles/token-flow-analysis/)
- [Exchange Inflows & Outflows: What They Tell You About Market Sentiment: Coins flowing into exchanges often precede selling; big withdrawals can mean accumulation. How to read flow data — and what it can't tell you either way.](/articles/exchange-inflows-and-outflows/)
- [How to Track Whale Wallets: Free Tools and Methodology: Whale wallets move markets. How to find, label, and follow large holders with free tools — plus the alerting setup that fires the moment they act.](/articles/how-to-track-whale-wallets/)
- [On-Chain Indicators That Matter: MVRV, NVT, SOPR & More Explained: MVRV, NVT, SOPR, Puell — what each metric measures, what it says about valuation, and how to read them together instead of in isolation.](/articles/on-chain-indicators/)
- [Wallet Labels: How to Identify Who Owns What on the Blockchain: Exchange hot wallets, contracts, whales, team treasuries — labels turn hex addresses into actors. How to read and use them in on-chain analysis.](/articles/wallet-labels/)
- [How to Read a Blockchain Explorer: Etherscan Step by Step: Addresses, transactions, contract tabs, event logs — the explorer is your primary window on-chain. Learn to read it, step by step, from zero.](/articles/how-to-read-a-blockchain-explorer/)
- [What Is On-Chain Analysis? A Complete Beginner's Guide: Reading blockchain data to follow money and spot risk — the practice, the free tools, and where to start if you've never opened an explorer.](/articles/what-is-on-chain-analysis/)
- [Understanding Gas Fees: Why Transactions Cost What They Cost: Base fee, priority fee, L2 pricing — what you actually pay for every transaction. How gas fees work on Ethereum and the levers that cut your costs.](/articles/understanding-gas-fees/)

## Glossary (Highlights)
See full glossary at https://theonchaindiary.com/glossary/

- [Byzantine Fault Tolerance: A property of distributed systems that can continue operating correctly even when up to one-third of participants act maliciously or fail arbitrarily.](/glossary/bft/)
- [Finality: The point at which a blockchain transaction becomes irreversible, guaranteeing it will not be reversed or altered by future blocks.](/glossary/finality/)
- [Proof of Stake (PoS): A consensus mechanism where validators are chosen to produce blocks based on the amount of cryptocurrency they have staked.](/glossary/proof-of-stake/)
- [Proof of Work (PoW): A consensus mechanism where miners compete to solve cryptographic puzzles to validate blocks, securing the network through computational energy.](/glossary/proof-of-work/)
- [Slashing: The punishment mechanism in proof-of-stake where validators lose staked funds for proven misbehavior or attacks.](/glossary/slashing/)
- [Validator: A network participant in proof-of-stake blockchains who proposes and attests blocks in exchange for rewards.](/glossary/validator/)
- [Algorithmic Stablecoin: A stablecoin that maintains its peg through algorithmic mint/burn and incentive mechanics rather than fiat or crypto collateral.](/glossary/algorithmic-stablecoin/)
- [AMM (Automated Market Maker): A protocol that prices assets algorithmically using a liquidity pool, replacing traditional order books.](/glossary/amm/)
- [APR (Annual Percentage Rate): The yearly interest rate earned or paid on crypto assets, expressed as a simple (non-compounding) percentage.](/glossary/apr/)
- [APY (Annual Percentage Yield): The effective annual rate of return on an investment, accounting for compounding interest.](/glossary/apy/)
- [Block Builder: A specialized entity in Ethereum's PBS system that constructs optimized blocks from MEV searcher bundles and competes to have their block selected by validators.](/glossary/block-builder/)
- [Bridge: A protocol that enables assets and data to move between different blockchain networks.](/glossary/bridge/)
- [Collateral Factor: The percentage of an asset's value a lending protocol lets you borrow against — for example, 75% means $100 of collateral backs up to $75 of borrowing.](/glossary/collateral-factor/)
- [Cross-Chain Bridge: A protocol that transfers assets and messages between independent blockchains, typically by locking assets on one chain and minting representations on another.](/glossary/cross-chain-bridge/)
- [DeFi (Decentralized Finance): Financial services built on blockchain smart contracts that operate without intermediaries, including lending, borrowing, trading, and yield generation.](/glossary/defi/)
- [DEX (Decentralized Exchange): A peer-to-peer marketplace for trading cryptocurrencies without intermediaries, using smart contracts instead of order books.](/glossary/dex/)
- [EigenLayer (Restaking): The leading Ethereum restaking protocol that lets staked ETH be reused to secure additional services (AVSs) for extra yield and extra risk.](/glossary/eigenlayer/)
- [Flash Loan: An uncollateralized loan that must be borrowed and repaid within a single blockchain transaction.](/glossary/flash-loan/)
- [Flashbots: A research and development organization that created a private transaction relay system to reduce MEV's negative impact on Ethereum users.](/glossary/flashbots/)
- [Impermanent Loss: The temporary loss liquidity providers face when token prices diverge from their deposit ratio.](/glossary/impermanent-loss/)

## Full Glossary
- [Complete Web3 Glossary — 100+ Terms](https://theonchaindiary.com/llms-full.txt)

## Agent access
This site exposes an MCP server (streamable HTTP, no auth, read-only) for searching and reading full articles and glossary terms:
- Endpoint: https://theonchaindiary.com/api/mcp
- Tools: search / read_article / read_glossary / list_content
- Discovery: https://theonchaindiary.com/.well-known/mcp.json
- Structured JSON catalog: https://theonchaindiary.com/mcp/manifest.json
- RSS: https://theonchaindiary.com/rss.xml (zh: /zh/rss.xml)
- Setup guide & verify prompts: https://theonchaindiary.com/agent/