← Back to Knowledge Base 📖 Reference

Glossary

Plain-language definitions for crypto, blockchain forensics, scam investigation, and legal terms. Use the A–Z index to jump directly to a term.

Address Poisoning Scam: An attack where a scammer sends a tiny transaction from a wallet whose address closely resembles one already in your transaction history. The goal is to get you to copy the lookalike address from your history when next sending crypto — directing funds to the attacker instead of the intended recipient.
AML (Anti-Money Laundering) Legal: The laws, regulations, and procedures requiring financial institutions — including cryptocurrency exchanges — to detect and prevent criminals from disguising illegally obtained funds as legitimate income. AML compliance is why exchanges collect KYC information and why funds traced to a compliant exchange can be linked to a real identity.
Approval Phishing Scam: A type of attack where a victim is tricked into signing a "token approval" transaction that grants a malicious smart contract unlimited access to spend their tokens. Once signed, the attacker can drain all approved tokens at any time without any further action from the victim. Common on fake NFT minting sites and malicious DeFi platforms.
Block Explorer Technical: A public website that lets anyone view live blockchain data — every transaction, wallet balance, and smart contract interaction. Etherscan covers Ethereum and ERC-20 tokens, Tronscan covers Tron and TRC-20, Mempool.space and Blockchain.com cover Bitcoin. Block explorers are the foundation tool for any forensic trace and are free to use.
Blockchain Forensics Forensics: The discipline of collecting, analyzing, and presenting blockchain transaction data as evidence. Involves tracing fund flows across wallets and chains, identifying wallet owners through clustering and attribution, and documenting findings in formats admissible in legal proceedings.
Blockchain Intelligence Forensics: The broader practice of analyzing on-chain data to identify illicit activity, map criminal networks, and produce actionable intelligence. Broader than forensics — includes proactive monitoring, threat actor profiling, and pattern recognition across cases. Used by law enforcement, compliance teams, and private investigators.
Bridge (Cross-Chain Bridge) Technical: A protocol that lets users move tokens between blockchains — for example, USDT from Ethereum to Tron, or ETH from Ethereum to Solana. Bridges are tracked on both source and destination chains, so a forensic trace can usually continue across the bridge by correlating timestamps and amounts. Common bridges include Wormhole, JustLink, and the lending-and-withdrawing of stablecoins on centralized exchanges as de facto bridges.
Bridge Exploit Technical: An attack targeting cross-chain bridge protocols — the infrastructure that moves assets between blockchains. Attackers exploit vulnerabilities in bridge smart contract logic, validator consensus, or signature verification to mint unbacked tokens or drain bridge liquidity. Single bridge exploits have exceeded $600 million in losses.
CEX (Centralized Exchange) Technical: A cryptocurrency trading platform operated by a company that holds user funds in custody — Coinbase, Kraken, Binance, Gemini, etc. CEXs typically require KYC verification, which is what makes them the critical investigative target: if stolen funds reach a CEX, the exchange's records can identify the account holder under legal process.
Chain Hopping Laundering: A money laundering technique where funds are moved across multiple blockchains via bridges or cross-chain swaps to complicate forensic tracing. Each chain transition requires separate investigative tools and analysis, but bridge transactions leave records on both source and destination chains — the trace can be continued.
Chain of Custody Forensics: The documented record showing how digital evidence was collected, preserved, analyzed, and reported — establishing that it has not been tampered with. In blockchain forensics, chain of custody includes every transaction hash, wallet address, timestamp, and methodology step. Required for blockchain evidence to be admissible in court.
Clipboard Hijacking Technical: Malware that monitors the clipboard for cryptocurrency addresses and silently replaces them with an attacker-controlled address. Victims copy what they believe is the correct destination address, paste it, and send funds directly to the attacker. Prevention: always manually verify the first and last several characters of any pasted address.
CoinJoin Laundering: A Bitcoin mixing technique that combines transactions from multiple users into a single transaction with many inputs and outputs, breaking the direct on-chain link between sender and receiver. Used both for privacy by ordinary users and for laundering by criminals. Forensic counter-techniques (timing analysis, amount correlation) can often identify likely input-output pairs in CoinJoin transactions.
Cold Wallet (Cold Storage) Technical: A wallet that holds private keys offline — typically a hardware wallet, paper wallet, or air-gapped device. Cold wallets cannot be drained remotely because the keys never touch an internet-connected machine. Scammers sometimes tell victims their stolen funds went to a "cold wallet" to discourage recovery efforts; that may or may not be true, and either way the on-chain trail still exists.
Daubert Standard Legal: The US federal legal standard governing the admissibility of expert witness testimony, derived from Daubert v. Merrell Dow Pharmaceuticals (1993). Courts evaluate whether the expert's methodology is testable, peer-reviewed, has a known error rate, and is generally accepted in the field. In crypto cases, Daubert is what a blockchain forensic expert must satisfy to be allowed to testify.
DeFi (Decentralized Finance) Technical: Financial services — lending, borrowing, trading, yield farming — built on smart contracts instead of traditional intermediaries. DeFi runs on public blockchains (mostly Ethereum and Solana) without account creation or KYC. It is also where many crypto scams operate: fake yield platforms, rug pulls, and approval phishing all live in the DeFi ecosystem.
DEX (Decentralized Exchange) Technical: A trading platform that runs on a blockchain via smart contracts, with no central operator holding user funds. Uniswap, PancakeSwap, and Curve are the largest examples. DEXs do not collect KYC, which makes them a common laundering hop — though every swap is recorded on-chain and can be traced.
Dusting Attack Technical: An attack where tiny amounts of cryptocurrency ("dust") are sent to many wallet addresses. If the recipient later spends that dust alongside other funds in the same transaction, the attacker can use common-input ownership analysis to link addresses together and de-anonymize the wallet owner. Prevention: use coin control to avoid spending dust inputs.
Entity Attribution Forensics: The process of linking a wallet cluster to a known real-world entity — a named exchange, a sanctioned address, a darknet market, or a previously identified criminal organization. Attribution converts an anonymous on-chain address into a named actor, determining who to subpoena and what legal action is viable.
ERC-20 Technical: The Ethereum token standard that defines how fungible tokens (USDC, USDT-on-Ethereum, LINK, UNI, and thousands of others) behave on the network. Most DeFi activity and a large portion of crypto scams operate in ERC-20 tokens. ERC-20 transfers are visible on Etherscan and traceable like any Ethereum transaction.
FBI (Federal Bureau of Investigation) Legal: The primary US federal agency for investigating crypto-enabled fraud, ransomware, and large-scale theft. Most victim crypto reports route through IC3 (the FBI's Internet Crime Complaint Center). Individual small-loss cases rarely generate active investigation, but IC3 complaints are aggregated for pattern analysis — multiple cases tied to the same operation can collectively justify federal action.
Fake Exchange / Investment Platform Scam: A fraudulent website or app designed to look like a legitimate cryptocurrency exchange or investment platform. Victims deposit funds and see fake balances showing profits. Withdrawal attempts trigger demands for taxes, fees, or "verification deposits" — additional theft mechanisms. The platform eventually disappears entirely.
FinCEN Legal: The Financial Crimes Enforcement Network — a US Treasury bureau that administers the Bank Secrecy Act and money-laundering rules. FinCEN registration is required for US-licensed crypto money services businesses (most major exchanges). FinCEN-registered custodians are also where seized cryptocurrency in state cases is often held pending forfeiture.
Flash Loan Attack Technical: An attack exploiting uncollateralized DeFi loans that must be borrowed and repaid within a single blockchain transaction. Attackers borrow massive amounts of capital, manipulate prices across protocols, and repay the loan — all in one atomic transaction — leaving the targeted protocol with losses while the attacker keeps the profit.
Hardware Wallet Technical: A physical device that stores cryptocurrency private keys offline — Ledger, Trezor, and similar models. Transactions are signed on the device itself and only the signed result reaches the connected computer, so even a compromised PC cannot extract the keys. Hardware wallets are the recommended storage for any meaningful balance.
Honeypot Token Scam: A scam token whose smart contract is rigged so victims can buy but cannot sell — the contract blocks transfers from any wallet except the deployer's. Often promoted in Telegram and Discord groups around fake launches. The price chart looks normal until victims try to exit and discover the function returns errors.
Hot Wallet Technical: A wallet whose private keys are stored on an internet-connected device — software wallets like MetaMask, Trust Wallet, Phantom, or exchange-custodied accounts. Hot wallets are convenient for active use but are the attack surface for phishing, malware, approval drainers, and exchange hacks. Best practice is to keep only operating funds in a hot wallet and the rest in cold storage.
IC3 (Internet Crime Complaint Center) Legal: The FBI's online intake portal for reporting cyber-enabled crime — including crypto fraud — at ic3.gov. Filing creates the official federal record and feeds aggregate analysis at the FBI. Individual cases rarely produce direct investigation, but IC3 complaints linked to a common operation can collectively trigger federal action. Always file IC3 alongside any local police report.
KYC (Know Your Customer) Legal: Identity verification requirements that regulated financial institutions — including cryptocurrency exchanges — must apply to their customers. In investigations, KYC data obtained through legal process is the bridge between an anonymous blockchain address and a real-world identity. Identifying the exchange deposit address is therefore the primary goal of most forensic traces.
Layering Laundering: The second stage of money laundering — moving funds through multiple transactions, conversions, and accounts to distance them from their origin. In crypto, layering typically combines mixing, chain hopping, DEX swaps, and wallet fan-out. Each layer leaves a permanent on-chain record and is traceable, though complex layering takes more investigative time.
Liquidity Pool Technical: A smart contract on a decentralized exchange that holds two or more tokens, allowing users to swap between them at algorithmically determined prices. Rug pulls often work by removing liquidity from a pool — stealing the deposited tokens and crashing the price to zero. Liquidity pool transactions are public and traceable on-chain.
MLAT (Mutual Legal Assistance Treaty) Legal: A bilateral or multilateral agreement between countries that allows law enforcement agencies to share evidence and cooperate in criminal investigations across borders. Relevant when stolen crypto is traced to an exchange operating in a foreign jurisdiction. A forensic report identifying the specific exchange and account is the predicate for an effective MLAT request.
Crypto Mixer / Tumbler Laundering: A service that pools cryptocurrency from multiple users and redistributes equivalent amounts to different addresses, breaking the direct transaction link between sender and receiver. Used by criminals to obscure the origin of illicit funds. Tornado Cash (Ethereum) is OFAC sanctioned; Bitcoin mixers use CoinJoin. Not impossible to trace — timing analysis and graph heuristics can probabilistically link inputs to outputs.
NFT (Non-Fungible Token) Technical: A unique on-chain token representing ownership of a specific digital or physical asset (commonly art, collectibles, or memberships), typically following the ERC-721 or ERC-1155 standards. NFTs are a frequent vector for scams: fake mint sites that drain wallets via approval phishing, wash-trading schemes, and fraudulent "celebrity" collections.
OSINT (Open Source Intelligence) Forensics: The collection and analysis of publicly available information to support an investigation. In blockchain forensics, OSINT bridges the gap between on-chain wallet addresses and real-world identities — using social media profiles, domain registration records, forum posts, and scam reporting databases to link anonymous addresses to named individuals or organizations.
Phishing Scam: A social engineering attack where victims are tricked into revealing seed phrases, private keys, or login credentials through fake websites, emails, or messages impersonating legitimate services — exchanges, wallets, or support teams. The defining characteristic: urgency, fear tactics, and a request for information no legitimate service would ever need.
Pig Butchering (Sha Zhu Pan) Scam: A long-form romance fraud originating from Southeast Asia. Scammers build trust over weeks or months through fake relationships on social media or dating apps, then introduce a "profitable" crypto investment opportunity on a fraudulent platform. Victims invest increasing amounts — often their life savings — before the platform disappears. Named after the practice of "fattening a pig before slaughter."
Preliminary Injunction Legal: A court order issued after a hearing that restrains a party from specific conduct — such as transferring crypto assets — for the duration of a lawsuit. Stronger than a TRO (which is short-term and may be issued ex parte) and used in crypto fraud cases to maintain a freeze on identified exchange accounts while the underlying claim is litigated.
Preservation Letter Legal: A written request from a law enforcement agency to a service provider (including a crypto exchange) directing the provider to preserve account records and transaction data while the agency obtains legal process for production. The letter does not compel disclosure or freeze the account — only preserves records. Specific statutory authority and scope should be confirmed with a prosecutor.
Privacy Coin Laundering: A cryptocurrency designed to obscure transaction details — sender, receiver, and amount. Monero (XMR) uses ring signatures, stealth addresses, and RingCT to make transactions untraceable on-chain. If stolen funds are converted to Monero, on-chain tracing ends at that conversion point. Investigation then shifts to obtaining KYC data from the exchange that processed the conversion.
Pump and Dump Scam: A market manipulation scheme where organizers accumulate a low-cap token, artificially inflate its price through coordinated buying and social media hype, then sell ("dump") at the peak — crashing the price and leaving other investors with losses. Common in Telegram and Discord groups. The organizers profit; late buyers hold worthless tokens.
Reentrancy Attack Technical: A smart contract vulnerability where a malicious contract repeatedly calls back into a target contract before the first execution completes — draining funds in a loop. The 2016 DAO hack, which led to the Ethereum hard fork, was a reentrancy attack. Prevention: smart contracts should follow the checks-effects-interactions pattern and use reentrancy guards.
Recovery Scam Scam: A second-wave fraud targeting people who have already been scammed. Recovery scammers pose as investigators, law enforcement, or recovery specialists and promise to retrieve stolen funds for an upfront fee — then disappear or demand more. They specifically monitor IC3 reports, victim forums, and social media. No legitimate investigator guarantees recovery or accepts only crypto payment.
Romance Scam Scam: A fraud where a scammer builds a romantic relationship with a victim entirely for financial exploitation. Unlike pig butchering, which uses romance as a vehicle to an investment scam, romance scams involve direct requests for money, gift cards, or crypto for fabricated emergencies — medical crises, travel problems, business failures. Common signals: person claims to be overseas, refuses video calls, and requests are always via crypto or gift cards.
Rug Pull / Exit Scam Scam: A DeFi scam where project developers drain investor funds by removing liquidity, dumping reserved tokens, or triggering a hidden smart contract function after enough capital has been deposited. Common in token launches and NFT projects. Warning signs: anonymous team, unlocked liquidity, unaudited contracts, concentrated token ownership.
Seed Phrase / Recovery Phrase Technical: A 12 or 24-word sequence that is the master key to a cryptocurrency wallet. Anyone who knows the seed phrase has complete and permanent control over all assets in that wallet — on any device, anywhere in the world. There is no recovery mechanism if a seed phrase is stolen. No legitimate service ever needs your seed phrase.
SIM Swap Attack Scam: An attack where a criminal convinces a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls. This allows them to intercept SMS-based two-factor authentication codes, gaining access to exchange accounts and wallets. Prevention: use an authenticator app (not SMS) for 2FA and set a carrier PIN.
Smart Contract Technical: Self-executing code stored on a blockchain that automatically enforces the terms of an agreement when specific conditions are met. Smart contracts can hold and transfer funds without human intervention. A malicious or exploitable smart contract is the mechanism behind wallet drainer attacks, rug pulls, and flash loan exploits.
Stablecoin Technical: A cryptocurrency designed to hold a stable value pegged to an external reference, almost always the US dollar. The largest by far are USDT (Tether) and USDC (Circle). Stablecoins are the dominant rail for crypto scams because their value doesn't move during the laundering window. USDT and USDC issuers can blacklist specific addresses on legitimate request, freezing the tokens at that address.
Subpoena Legal: A court-backed order requiring a person or entity to produce documents, records, or testimony. In crypto cases, a subpoena to a centralized exchange compels production of subscriber identification (KYC), account history, login IPs, and transaction records — converting an anonymous wallet trace into a named account holder. FRCP Rule 45 governs federal civil subpoenas; state courts have analogous mechanisms.
Tether Freeze (Issuer Blacklist) Forensics: A unique recovery lever for USDT (and similarly for USDC): the issuer's smart contract can blacklist any address, permanently freezing the tokens at that address so they can no longer be transferred. Tether has, in publicly reported instances, honored law enforcement freeze requests on a credible criminal showing. Decisions are at the issuer's discretion and governed by their policies, not statutory entitlement.
Tainted Cryptocurrency Forensics: Cryptocurrency that has been flagged as associated with criminal activity through forensic analysis or law enforcement action. Tainted coins may be rejected by compliant exchanges when a deposit is screened. Tainting is also used strategically in civil litigation to freeze or flag assets linked to fraud.
Task Scam Scam: A type of fraud where victims are recruited for fake online jobs — typically "reviewing products," "rating apps," or "completing tasks" for crypto rewards. Initial small payments build trust. Victims are eventually told they must deposit funds to "unlock" their earnings or complete a task set — funds they never recover.
Tornado Cash Laundering: An Ethereum-based crypto mixer that pools deposits and allows withdrawals to fresh addresses, breaking the on-chain link between source and destination. OFAC sanctioned in August 2022. Despite the design, forensic counter-techniques — timing analysis, amount correlation, and clustering — can probabilistically link deposits to withdrawals, especially for high-value transactions.
Transaction Graph Analysis Forensics: A forensic technique that maps the complete flow of funds across the blockchain — tracking every transaction from origin through intermediate wallets to final destination. The resulting graph shows exactly how money moved, how it was split or consolidated, and where it ended up. Used to trace stolen funds and document the chain of custody for court submission.
TRC-20 Technical: The Tron blockchain's token standard, equivalent in function to Ethereum's ERC-20. Most USDT in circulation runs on TRC-20 because of its low fees (~$0.001 per transfer) and 3-second block times. TRC-20 USDT is the dominant rail for crypto scams — pig butchering, romance investment fraud, and Telegram-based schemes overwhelmingly route money through it. Fully traceable on Tronscan.
TRO (Temporary Restraining Order) Legal: An emergency court order that freezes assets pending further legal proceedings. In crypto fraud cases, TROs can freeze exchange accounts before stolen funds are withdrawn. Requires swift action — funds can move quickly — and strong forensic evidence identifying the specific exchange and account holding the stolen assets.
TXID (Transaction Hash) Technical: The unique cryptographic identifier of an individual blockchain transaction — a long string of letters and numbers that resolves to one specific transfer on the public ledger. Every TXID is independently verifiable on a block explorer. The TXID is the single most important piece of evidence in any crypto theft case; without it, the trace has no anchor.
UTXO (Unspent Transaction Output) Technical: The accounting model used by Bitcoin and similar chains: instead of account balances, the chain tracks discrete unspent outputs from prior transactions. A user's "balance" is the sum of all UTXOs they control. Common-input ownership analysis — when a single transaction spends multiple UTXOs — is one of the foundational heuristics for clustering Bitcoin wallets.
Wallet Clustering Forensics: The process of grouping multiple wallet addresses that are likely controlled by the same entity, based on transaction patterns, timing, address reuse, and behavioral analysis. Clustering reduces a sprawling network of hundreds of wallets to a manageable set of actors — converting address-level tracing into entity-level attribution.
Wallet Drainer Scam: A malicious smart contract that, once approved by a victim, automatically transfers all of the victim's tokens to an attacker-controlled wallet. Deployed on fake NFT minting sites, phishing platforms, and malicious DeFi interfaces. The approval transaction is the attack — everything after is automatic. Check and revoke existing approvals at revoke.cash.
Wallet Fan-Out Laundering: A laundering technique where stolen funds are immediately split across many wallets after receipt to reduce traceability. A single theft may fan out to 50 or more wallets within minutes. Despite appearing complex, fan-out patterns typically reconsolidate — following all branches usually leads to a limited number of exchange deposit addresses, which are the actual investigative endpoints.
Wire Fraud Legal: A US federal crime (18 U.S.C. § 1343) covering schemes to defraud that use interstate wire, radio, or television communications — which today includes essentially any internet-based fraud. Most crypto theft cases satisfy the wire fraud predicate, which is what gives federal agencies jurisdiction even when the victim and suspect are in different states or countries.

Need deeper definitions with forensic methodology and detection notes? The full glossary with 60+ terms is in the blog.

Read the full glossary →

Glossary

A

B

C

D

E

F

H

I

K

L

M

N

O

P

R

S

T

U

W