Skip to content

Security & Compliance Glossary

Plain definitions of the vocabulary that actually matters on a security and compliance desk — approvals, drainers, the Travel Rule, VASPs, proof of reserves. Each entry says what the term means and why it matters, and links the incidents where it showed up.

30 terms defined

A

Address poisoning

Sending a tiny or zero-value transfer from an address whose first and last characters match one you have used, so that copying from your transaction history…

B

Blind signing

Approving a transaction your signing device cannot decode into human-readable terms, so it displays raw data rather than what the transaction will do.

Bridge

A system that locks an asset on one chain and issues a representation of it on another, releasing the original when the representation is destroyed.

C

CASP (Crypto-Asset Service Provider)

The authorisation category under the EU's Markets in Crypto-Assets Regulation for firms providing crypto-asset services.

Cold storage

Holding private keys on a device or medium that has never been, and is not, connected to a network.

Custodial vs non-custodial

Custodial means a third party holds the keys and you hold a claim against them; non-custodial means you hold the keys and there is no counterparty.

F

Flash loan

An uncollateralised loan that must be borrowed and repaid within a single transaction, reverting entirely if repayment fails.

G

Governance attack

Acquiring enough voting power to pass a proposal that benefits the attacker, rather than exploiting a code defect.

H

Hardware wallet

A dedicated device that stores private keys in isolation and signs transactions internally, so the key never reaches an internet-connected computer.

Hot wallet

A wallet whose keys are held on an internet-connected system so that transactions can be signed automatically.

K

KYT (Know Your Transaction)

Ongoing screening of blockchain transactions against risk indicators — sanctioned addresses, mixers, known theft proceeds — as distinct from identity checks on the customer.

M

MiCA

The European Union's Markets in Crypto-Assets Regulation — a directly applicable framework covering crypto-asset service providers, asset-referenced tokens and e-money tokens, and market abuse.

Multisig

A wallet requiring signatures from several keys before a transaction executes, expressed as a threshold such as three of five.

O

Oracle manipulation

Distorting the price feed a protocol relies on, so that the protocol values collateral or debt incorrectly and can be exploited at that valuation.

P

Permit signature

An off-chain signed message that grants a token allowance without an on-chain approval transaction, defined by EIP-2612 and similar schemes.

Proof of reserves

A published attestation that a custodian holds assets corresponding to customer balances, usually via a cryptographic commitment to the liability set plus evidence of controlled addresses.

R

Recovery phrase

The ordered list of words from which a wallet's private keys are derived. Also called a seed phrase or mnemonic.

Reentrancy

A vulnerability class in which a contract calls out to another contract before updating its own state, allowing the external contract to call back in and…

Rug pull

A fraud in which a project's operators withdraw pooled liquidity or exercise a retained privilege to expropriate holders, having marketed the project as legitimate.

S

Sanctions screening

Checking counterparties and addresses against government sanctions lists, such as the US Treasury's Specially Designated Nationals list.

Segregation of client assets

A requirement that customer assets be held separately from a firm's own operating funds and identifiable as customers'.

SIM swap

Persuading or bribing a mobile operator to transfer a victim's phone number to an attacker-controlled SIM, capturing SMS codes and account recovery.

Smart contract audit

A review of contract source code by a third party against known vulnerability classes and the protocol's intended behaviour.

Supply chain attack

Compromising a dependency, build system, package registry or distribution channel so that malicious code reaches users through a trusted route.

T

Timelock

A mandatory delay between a privileged action being approved and being executed.

Token approval

A standing permission allowing a named contract address to move a specified amount of one of your tokens, at any time, until the permission is changed…

Travel Rule

An anti-money-laundering requirement that originating and beneficiary information accompany transfers of value above a threshold between regulated institutions.

V

Vanity address

An address generated by repeated trial until it begins with a chosen string of characters.

VASP (Virtual Asset Service Provider)

The FATF term for a business conducting virtual asset activities on behalf of others — exchange, transfer, custody, or participation in financial services relating to an…

W

Wallet drainer

Malicious code — usually injected into or hosted as a web front end — that induces a user to sign a transaction or approval transferring their…