# Crypto scam and wallet safety glossary Source: https://pausebeforesend.com/glossary/ Last updated: 2026-10-19 AI-assisted, human-reviewed by J (2026-10-24). Short, plain definitions. Where a definition comes from a source, we link it. Where it is our own wording, we say so. **Recovery phrase (seed phrase, Secret Recovery Phrase)**: The 12–24 words a wallet generates at setup. Anyone who has them can rebuild the wallet on another device and move the funds. Ledger: "You should never enter your 24 words anywhere other than directly into your device." ([Ledger](https://www.ledger.com/phishing-campaigns-status); [The Crypto Times](https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/)) **Hardware wallet (signer)**: A physical device that keeps private keys offline and is used to approve transactions. ([The Crypto Times](https://www.cryptotimes.io/2026/10/16/fake-ledger-firmware-update-scam-exploits-cryptobilis-hack-slowmist-warns/)) See the [wallet safety guide](https://pausebeforesend.com/wallet-safety/). **Secure Element**: The chip inside some hardware wallets that protects private keys. In the Oct 2026 CryptoBilis attack, the implant left it untouched, which is why integrity checks missed it. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/)) **Genuine Check**: Ledger's test of whether a device is authentic. Ledger warns it cannot detect added implants when the original Secure Element is intact. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/)) Scammers fake this screen: see [fake firmware updates](https://pausebeforesend.com/scams/fake-ledger-firmware-update/). **Supply-chain (distribution) attack**: Tampering with a product after it leaves the maker and before it reaches you. Ledger called the CryptoBilis case "a localized distribution attack." ([Ledger](https://www.ledger.com/blog-response-hardware-implant-attack)) **Phishing**: A fake message or website that pretends to be a trusted company to get you to hand over a secret, such as a password or recovery phrase. (Our wording.) **Address poisoning**: Planting a lookalike address in your transaction history so you copy it by mistake. ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)) See [our guide](https://pausebeforesend.com/scams/address-poisoning/). **Vanity address**: An address generated to start or end with chosen characters. Scammers use them to make lookalikes. ([Etherscan](https://info.etherscan.com/what-is-address-poisoning/)) **Zero-value (dust) transfer**: A transfer of zero or nearly zero tokens, sent only to put an address into your history. It doesn't harm the wallet by itself. ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)) **Token spoofing**: A fake token that uses the name and symbol of a real one, such as "USDT," to make fake transfers look real. ([Etherscan](https://info.etherscan.com/what-is-address-poisoning/)) **Crypto kiosk (crypto ATM, Bitcoin ATM)**: An ATM-like machine that exchanges cash for cryptocurrency. Criminals often direct victims to send money through one. ([FBI IC3](https://www.ic3.gov/PSA/2026/PSA260515-2)) See [Kansas & Missouri data](https://pausebeforesend.com/scams/crypto-atm-scams-kansas-missouri-2025/). **Kiosk spread (markup)**: The gap between the market price and the kiosk's price. Kansas law counts it as a charge under its fee cap. ([HB 2591 §10](https://sos.ks.gov/publications/sessionlaws/2026/Chapter-102-HB-2591.html)) **Government / warrant impersonation scam**: A caller poses as police, a court or an agency and demands immediate payment, often through a crypto ATM, to "clear a warrant." ([Sedgwick County DA](https://www.sedgwickcounty.org/district-attorney/consumer-protection-division/consumer-protection-media-releases/new-consumer-protection-law-helps-scam-victim-recover-money-lost-to-cryptocurrency-atm/)) **Tech-support scam**: A fake pop-up or call claiming to be Apple, Microsoft or similar. It leads to a "fix" that requires moving money. ([KMBC](https://www.kmbc.com/article/crypto-atm-scam-warning-signs-how-to-avoid-losing-money/73987866)) **Pig butchering (crypto investment fraud)**: A scammer builds a friendship or romance online, then steers the victim into a fake crypto "investment" they can never withdraw from. ([FBI](https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/operation-level-up)) **Recovery scam**: A follow-up scam that promises, for a fee, to recover money you already lost. The FBI warns about these. ([FBI](https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/cryptocurrency-investment-fraud)) **Wallet drainer**: A malicious website or contract that gets you to sign a transaction or approval, then moves your tokens out. (Our wording; examples are logged in the [tracker](https://pausebeforesend.com/scams/).) **Token approval (allowance)**: Permission you sign that lets a smart contract move a token from your wallet. Drainers abuse unlimited approvals. MetaMask lists "unlimited token approvals" among common scam methods. ([MetaMask](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)) **TXID (transaction hash)**: The unique ID of a blockchain transaction. Include it in any IC3 report, along with wallet addresses and the kiosk location. ([IC3](https://www.ic3.gov/PSA/2026/PSA260515-2)) **IC3**: The FBI's Internet Crime Complaint Center, where you report online fraud: [ic3.gov](https://www.ic3.gov/). It received 1,008,597 complaints in 2025. ([FBI](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)) ## Changelog - 2026-10-19: 20 terms.