Part Four — Danger

Anchor tracks: Rug Pulls Pay My Rent, Keys Please

The reader's question: how do I not get robbed?

This chapter comes before the tutorial chapter. That ordering is the book's central claim about how this should be taught.

1. Thinking like an attacker

Security is always taught from the other side. Not because it is edgy, but because it is the only thing that works.

You cannot defend against an attack nobody has ever described to you. A list of rules — use strong passwords, don't click links — produces compliance without understanding, and compliance collapses the moment the attack does not look like the example. Understanding why someone is doing something lets you recognise a version you have never seen.

Security professionals call this threat modelling: who would realistically come after someone like me, what are they actually after, and what would they have to do to get it? That framing is why this album has a villain, and why he gets two tracks and speaks in the first person.

Three things worth internalising before the specifics.

Almost none of this is an attack on the blockchain. The cryptography is not what fails. Nearly every loss in this chapter is someone being persuaded to hand over a phrase, approve a transaction, or trust a company. The chain does exactly what it was told.

There is no recovery. No chargeback, no fraud department, no reversal. Most of this is never prosecuted — it is cross-border, pseudonymous, and individually small. Prevention is not the best remedy; it is effectively the only one.

Most of it is boring and industrial. Track 8's line is rug pulls pay my rent — not a fortune, rent. This is routine work with volume targets, run by people who do not know or care who you are. You do not have to be wealthy or interesting to be included.

2. Phishing and drainers

This is the highest-volume attack by a wide margin.

Phishing is tricking you into handing over credentials or approving a transaction by impersonating something you trust. A wallet drainer is the code on the other end: once you approve its request, it empties the wallet you connected.

Drainers are sold ready-made, as a service, to people with no technical skill. That is why they are everywhere.

What it actually looks like:

• A sponsored search result sitting above the real site, for a wallet or an exchange
• A fake browser extension with good reviews and a plausible name
• A "support" account that messages you first, after you post a problem publicly
• An airdrop notification telling you to connect and claim
• A mint link in a reply, on launch day, when everyone is rushing
• A message from a friend's compromised account

The request itself looks entirely ordinary. It is a pop-up asking you to sign. What you are signing may be a blanket permission to move your tokens, and once approved, nothing was broken — you authorised it, which is also why nothing can be undone.

The defences, in order of how much they buy you:

1. Reach sites from your own bookmarks. Never from search results, links, or messages. This one habit removes most of the attack surface, and it is free.
2. Read what you are signing. Wallets show you what a transaction does. It is dull and it is the moment that matters.
3. Keep a separate wallet for connecting to sites, holding only what you can afford to lose. Savings stay in a wallet that never connects to anything.
4. Nobody legitimate messages you first about your wallet. Support does not DM. Ever.

3. Contract approvals

This is the slow-motion drain, and it is the one careful people still get caught by.

A contract approval is permission you grant a smart contract to move tokens from your wallet. You grant these constantly and normally — every decentralised exchange needs one to swap on your behalf.

Two properties make it dangerous:

Approvals are usually unlimited. The default request is often permission to move your entire balance of that token, not the amount you are swapping.

Approvals persist. They stay live until you revoke them. An approval you granted eighteen months ago, to a site you have forgotten, to a project that no longer exists, is still active right now.

So the attack does not need to happen while you are watching. If that contract was malicious, or is later compromised, or the team's keys are stolen, it can empty that token from your wallet with no further action from you. People have been drained by approvals granted years earlier.

What to do: review your approvals periodically using a revocation tool and remove everything you no longer use. Do it now rather than after something happens.

This is the only defence in this entire chapter that works retroactively — it can close a hole you already opened. Track 7 gets it exactly right: I'm not signing contracts unless they should be approved.

4. Rug pulls

A rug pull is when a project's operators withdraw the funds backing a token and disappear.

There is no hacking involved. They use access they always had. Afterwards the token is still in your wallet, showing a balance, and there is nothing left to sell it against — the number is visible and unreachable.

Four checks, all free, all public, all taking about ninety seconds:

Is liquidity locked, and until when? A liquidity pool is the shared pot people trade against. If the operators can withdraw it, they can end the token whenever they choose. "Liquidity locked" is claimed far more often than it is true — open the lock contract and read the unlock date. Locked until next Tuesday is not locked.

Can people actually sell? A honeypot is a token you can buy but not sell, with the restriction written into the contract. The chart looks healthy the whole time, because buys succeed and only sells fail. Everyone still holding is someone who has not yet tried to leave. Check that sell transactions are going through.

How concentrated are the holdings? If a handful of wallets own most of the supply, a few people can end it at will. This is visible on any block explorer.

Is the contract verified, and can it be changed? Look for verified code, a real audit naming firm and version, and who holds the upgrade key. A token tax written into the code can often be raised after launch — to near-total — once enough people are in.

Anonymity, on its own, is not the red flag people think. Bitcoin's author was anonymous. Anonymity combined with custody of other people's funds and no delivery history is the red flag.

5. Social engineering

The attacks that work best do not target your software. They target the fact that you are a person having a day.

The support account that DMs first. You post a problem in a public channel; within minutes someone helpful appears. Real support does not initiate contact, and no support anywhere needs your seed phrase.

The recovery scam. This targets people who have already been robbed once, which is what makes it the ugliest thing in this chapter. Someone offers to trace and return your stolen funds, for a fee, or for your phrase. Nobody can recover a lost or stolen seed phrase — not a company, not a specialist, not law enforcement. Anyone claiming otherwise is taking what is left. Track 10 has this line word for word: Need help? Lost your seed phrase? You got me.

Romance and job scams. Long, patient, and often multi-month. A relationship or a job offer leads to a trading platform that shows excellent returns and permits small withdrawals — until the withdrawal you actually need is blocked pending a "tax" or "fee." The early withdrawals are the mechanism, not evidence against it.

Affinity fraud. The most common serious loss pattern, and the least discussed. Someone you know offers to manage funds for family or friends, holds a single wallet, and can leave with everything whatever was agreed. Track 8: stole from your family managing Robinhoods. If money must be pooled, use a multisig with genuinely independent signers so no one person can move it alone.

SIM porting. An attacker moves your phone number to their device, and every code sent by SMS goes to them — including the ones protecting your email, which protects everything else. Move two-factor authentication off SMS onto an app or hardware key, starting with your email account, and ask your provider for a port-out PIN.

Older relatives are targeted deliberately. Give them two rules that cover most of it: nobody legitimate asks for a recovery phrase, and nobody who contacts you first can get your money back.

6. Physical coercion

Sometimes there is no software involved at all.

Coercion — often called the wrench attack, from the observation that no encryption strength survives someone with a wrench — is forcing a person to hand over keys through threat or pressure. Cryptography protects keys from computers. It does nothing about a person standing in front of you.

Be honest about proportion. Most readers are not plausible targets, and telling people otherwise makes them stop listening. This happens to an identifiable group: people who post publicly about what they hold, people known locally as traders, people who turn up to events visibly wearing it, people whose home address has been linked to their name. Nobody needs a safe deposit box or a security detail.

The countermeasures, in order:

Do not be identifiable as a holder. This is the largest defence by a distance, and the only one that works before anyone chooses you. Do not publish addresses beside your name — on a public ledger that links your identity to your balance permanently. Do not post gains. Check what your photographs reveal about where you live.

Keep savings where a phone does not reach them. Only spending money belongs in a hot wallet. If having you and your device is sufficient, the rest of this is theoretical.

Multisig, genuinely separated. Two-of-three where one key sits with a trusted person elsewhere means no single moment of pressure can move the funds. Keys all in one house is not multisig in any meaningful sense.

A duress wallet with a believable balance. Something real to hand over, with genuine past activity, on the device someone would actually find. Track 9 names the failure mode precisely — gave me his phrase but his keys were fake. An empty or obviously staged wallet reads as staged and invites another round.

If it happens: comply. Hand over what is asked for. Nothing on a chain is worth harm. This book does not suggest resistance anywhere. The preparation exists so that complying costs you a decoy rather than everything.

7. Your own head

The attacker who is already inside, and statistically the most expensive one in this chapter.

FOMO. Peak attention and peak price arrive together. The moment something is most talked about is the moment earlier buyers have someone to sell to, and the people posting gains bought long before the post. Urgency is manufactured precisely because deliberation kills the sale. Nothing legitimate requires you to act within the hour.

Sunk cost. "I've already lost so much I can't sell now." The money spent is gone regardless of what you do next. The only question is whether you would buy this today at this price.

Revenge trading. After a loss, taking a larger position to make it back. This is how a single survivable loss becomes a pattern, and it is why track 5's empty wallet, left me wit anger is annotated as a danger rather than a feeling.

Identity. The culture supplies labels — diamond hands, paper hands, degen — that convert decisions into character traits. Refusing to reassess is not conviction; it is a decision made once and then defended. Anyone who benefits from you holding has a reason to call selling weakness.

The defence is a plan written in advance, on paper, while calm: what you hold, why, what would make you sell some, and what you could lose entirely. Any rule beats no rule, because the alternative is deciding under emotion at the worst available moment.

And the plainest thing in this chapter, from track 6: grief can end lives. Losses here have caused real harm, and the culture's habit of laughing them off makes asking for help harder. If a loss is affecting your health or your sleep, that is the emergency — not the balance. Position sizing exists for that reason before any financial one.

Design note

Both villain-POV tracks get a facing Defense Sheet. Every attack described gets a countermeasure. If there is no countermeasure, it does not go in.

Written outcome

You can name five specific attacks and the specific defence for each.

Try it now without looking. If you can get to five, you are better prepared than most people who have been doing this for years.

Next: Part Five is the tutorial chapter — and it comes after this one for a reason.