Research · History · Reference
Topics
Understand wallets, scams, markets, DeFi and the technology underneath.
Image & sources
Editorial selection from separate research topics.
18 · Articles and references
MASTR research
- Following sale proceeds without counting the same money twice
- LAPTOP: pre-launch inventory and $2.34 million in sale receipts
- LAPTOP: 2 connected claims, 647,428.93 USDC in receipts
All entries A–Z
- LAPTOP: the completed 49-sale record
- LAPTOP, TRUMP and MELANIA: which connections were established?
- From decentralisation to attention capture
- ANSEM: volume, valuation and the pools underneath
- BlockLayerPod and BeaconLayerPod: the interview invitation
- When a prediction-market win is staged
- SecondFi: wallet reputation and incident communication
- BONK DAO: the governance question in MASTR's July essay
- MASTR's Crypto Survival Guide
- TRUMP: the wallets used again after the rally
- TRUMP: 30 pools, two dominant markets
- FOMO / MEME: launch timing and investor conflicts
- The MiCA migration scam
- Copy trading: the leader's profit is not your result
- MASTR on X: incentives, influence and exchange flows
19 · Articles and references
KOLs & promotion
- Kim Kardashian and EthereumMax
- Floyd Mayweather, DJ Khaled and ICO promotion
- TRX and BTT: the 2023 celebrity-promotion cases
All entries A–Z
- KOL investors: same token, different deal
- Paid promotion: what the audience needs to know
- Referral income: a promoter can profit when you overtrade
- Manufactured social proof
- PnL screenshots: the missing denominator
- Similar balances do not prove coordinated entry
- Survivorship bias in calls, rankings and research
- Paid promotion: preserve the incentive trail
- KOL investment rounds
- Discounted OTC tokens promoted at market price
- Referral conflicts
- Affiliate-link concealment
- Cherry-picked leaderboards
- PnL screenshots without cash reconciliation
- Copy-trading execution gaps
- Survivorship in call channels
77 · Articles and references
Scam patterns
- Fake support: urgency with borrowed branding
- Recovery scams: the second loss
- Relationship-based investment fraud
All entries A–Z
- Fake airdrops and claim pages
- Address poisoning and clipboard mistakes
- Rug pulls: identify which control caused the loss
- Fake listings and borrowed exchange credibility
- Seed-phrase harvesting
- Wallet-app impersonation
- Fake browser extensions
- Search-ad poisoning
- Discord account takeovers
- Telegram admin impersonation
- X reply-bot traps
- Fake airdrop claims
- Malicious token approvals
- Permit phishing
- Blind-signature phishing
- Simulation spoofing
- Clipboard-address substitution
- Address-poisoning transfers
- QR-code substitution
- SIM-swap attacks
- Number-porting fraud
- MFA fatigue attacks
- Session-cookie theft
- OAuth-consent phishing
- Fake support screen sharing
- Remote-access tool abuse
- Cloud-backup seed exposure
- Hardware-wallet tampering
- Fake firmware updates
- Recovery-phrase verification scams
- Wallet drainer services
- Relationship investment fraud
- Crypto pig-butchering operations
- Task and optimisation scams
- Liquidity-mining impostors
- Cloud-mining fraud
- Fixed-return staking fraud
- Arbitrage-bot scams
- Front-running bot scams
- Fake MEV-bot contracts
- Trading-bot key theft
- Exchange API-key theft
- Fake exchange deposit pages
- Withdrawal-fee escalation
- Advance-fee recovery scams
- Fake law-firm recovery
- Token-migration scams
- Fake bridge interfaces
- Counterfeit DEX frontends
- Fake NFT mints
- Counterfeit NFT listings
- Fake token presales
- Clone tokens and ticker theft
- Counterfeit stablecoins
- Fake proof-of-reserves claims
- Audit-badge laundering
- Fake partnership announcements
- Fake exchange-listing announcements
- Deepfake executive livestreams
- Impersonated crypto giveaways
- Malicious calendar invitations
- Poisoned software dependencies
- Compromised package maintainers
- DNS hijacking
- Homoglyph domains
- Compromised analytics scripts
- Wallet-connect session abuse
- Dust-token message scams
- Memo and destination-tag scams
- OTC escrow impersonation
- Peer-to-peer payment reversals
- Money-mule recruitment
- Crypto-ATM impersonation scams
- Fake crypto recruitment tests
48 · Articles and references
Wallets & security
- Custody: what you control and what you depend on
- Token approvals outlive a trade
- Signed permits: a message can authorise spending
All entries A–Z
- A valid signature can approve the wrong action
- After a suspected scam or compromise
- What an audit or scanner actually covers
- Upgrade authority and the limits of renounced ownership
- A running chain can have an inaccessible app
- Token-2022: read every authority, not just the ticker
- Permanent delegates: a control the holder cannot revoke
- Transfer hooks: the extra programme inside a transfer
- Typed data: readable fields still need interpretation
- EIP-7702: delegation deserves its own review
- Multisig modules: the threshold is only part of the story
- A trusted frontend can still ask for the wrong transaction
- Transaction simulation: useful evidence with a state boundary
- Upgradeable proxies: the address can stay while the rules change
- Multisig security depends on independent control
- ERC-4337: programmable accounts without assuming one private key is enough
- Proxy-upgrade rugs
- Mint-authority dilution
- Freeze-authority coercion
- Transfer-tax honeypots
- Private whitelist sales
- Selective blacklists
- Anti-bot exemptions for insiders
- Multisignature thresholds
- Smart-account validation
- Proxy implementation changes
- Delegatecall authority
- Reentrancy
- Role-based access control
- ERC-20 allowances
- Token-2022 extensions
- ERC-1271: a contract decides whether a signature is valid
- EIP-712 domains: what stops a signature travelling to another application?
- ERC-2612: a permit deadline is not an allowance expiry
- ERC-1967: finding the implementation behind a proxy address
- ERC-1155: one operator approval can cover many token IDs
- Permit2: token approval and downstream signatures are separate permissions
- PSBT: moving an unsigned Bitcoin transaction between devices
- BIP-39 passphrases: the wrong phrase can open a different wallet
- Closing a Solana token account: check where its SOL goes
- Passkeys and crypto wallets: easier login, a new recovery map
- ENS names: why a reverse record needs a forward check
- ERC-7579: wallet modules are part of the authority map
- ERC-6492: signatures from an account that is not deployed yet
- Sign-In with Ethereum: what a login signature actually opens
56 · Articles and references
Market structure
- Wash trading and the appearance of demand
- Market makers: inventory, fees and conflicts
- Market cap is not money available to withdraw
All entries A–Z
- Concentrated liquidity: TVL can sit outside the trading range
- Slippage, price impact and the price you actually receive
- A ticker is not an asset identifier
- MEV: measure the execution, not just the chart
- PnL screenshots: reconcile the money before admiring the return
- Token unlocks: measure the newly transferable supply
- Constant-product pools: where price impact comes from
- Divergence loss: what a liquidity position gives up relative to holding
- Last price, index price and mark price answer different questions
- Perpetual funding: a transfer between position holders
- Insurance funds and ADL: who absorbs a derivatives shortfall?
- Undisclosed insider allocations
- SAFT discounts and public-market asymmetry
- Vesting side letters
- Launch sniping and privileged block access
- Bundled launch wallets
- Creator-wallet mapping
- Liquidity withdrawal as an exit
- LP-lock marketing
- Market-maker token loans
- Wash trading
- Spoofing and layering
- Self-trade volume
- Rebate-driven fake activity
- Token-unlock framing
- Circulating-supply manipulation
- FDV as a valuation weapon
- TVL without executable depth
- Oracle override power
- Liquidation priority and privileged keepers
- Exchange mark-price discretion
- Opaque insurance funds
- Auto-deleveraging externalities
- Customer-asset rehypothecation
- Related-party lending
- Oracle staleness
- Time-weighted average prices
- Constant-product pool arithmetic
- Stablecoin reserve models
- Maximal extractable value
- Sandwich attacks
- Perpetual futures
- Funding payments
- Lightning inbound liquidity: why a funded wallet may still fail to receive
- Jito bundles: ordering, tips and the limits of protection
- Jupiter quotes: expected output, minimum output and the actual exit
- TWAP and VWAP: averages answer different questions
24 · Articles and references
DeFi & governance
All entries A–Z
- Bridges and wrapped assets
- Oracles: which price controls the contract?
- DAO governance: transparent votes can still concentrate power
- Contagion: one asset, several dependent products
- Governance proposals: read the transaction that will execute
- Bridged assets: the same symbol does not mean the same claim
- Oracle freshness: a valid number can still be unusable
- Liquidation: the threshold, the execution and the remaining debt
- Lock-and-mint bridges: the token depends on both sides
- Liquid staking: a tradable receipt for a less immediate underlying position
- Flash loans
- Overcollateralised debt positions
- Liquid staking receipts
- Restaking and correlated risk
- Bridge trust models
- Collateral liquidation
- ERC-4626: a vault share is not an immediately withdrawable balance
- Concentrated liquidity: ticks, active capital and fee growth
- Uniswap v4 hooks: a shared exchange core, different pool behaviour
- Aave health factor: a moving buffer, not a safety rating
- Governance checkpoints: whose votes counted, and when?
11 · Articles and references
Research methods
- Wallet attribution: an address is not a person
- How to write a finding people can check
- Checking a crypto-provider authorisation
All entries A–Z
- Evidence snapshots: make a finding reproducible
- Wallet clusters: confidence is not ownership
- Audit scope drift: the badge can outlive the reviewed code
- Incident updates: distinguish containment from repair
- From lead to finding: a claim ladder for crypto research
- Reserve assets and liabilities: the missing half of a solvency claim
- ERC-165: interface support is a claim, not a security certificate
- eth_getProof: check the state, then check the root you trusted
74 · Articles and references
Crypto history
- 2008–2009: Bitcoin and the problem of double spending
- Mt. Gox: the long tail of a custody failure
- The DAO: code, governance and the 2016 split
All entries A–Z
- The ICO era: selling access to a future product
- OneCoin: a cryptocurrency story without the promised system
- BitConnect: promised returns and the supposed trading bot
- Terra and UST: the peg, the collapse and the fraud cases
- FTX and Alameda: customer money, privileged accounts and the bankruptcy
- Ronin: bridge theft and attribution
- 2015: Ethereum makes shared computation a public service
- 2017: SegWit changes Bitcoin transaction accounting
- 2018: Lightning reaches a mainnet beta
- 2018: Uniswap makes pooled liquidity a trading venue
- 2020: liquidity mining turns usage into a token reward
- 2021: the NFT boom connects provenance, art and speculation
- 2021: EIP-1559 changes Ethereum fees and introduces base-fee burning
- 2022: Ethereum replaces mining with proof of stake
- 2023: Shapella enables staking withdrawals
- 2024: Dencun gives rollups a separate data market
- 2024: US spot Bitcoin ETPs change the access route
- 2023: USDC's peg encounters a banking failure
- 2025: the Bybit theft and the limits of a transaction signature
- 2016–2024: the Bitfinex theft, laundering and later sentencing
- 2022–2025: Celsius, promised yield and CEL price support
- 2022: BlockFi and the regulation of crypto interest accounts
- 2021–2023: Gemini Earn connects a retail interface to Genesis credit risk
- 2021: Tether's reserve representations face an enforcement finding
- 2021: Taproot changes Bitcoin's spending paths
- Coincheck NEM theft
- QuadrigaCX and the missing custody record
- Cryptopia exchange liquidation
- PlusToken investment scheme
- AirBit Club
- IcomTech
- Forsage smart-contract pyramid
- SafeMoon: the liquidity claim, conviction and 2026 sentence
- HyperFund and HyperVerse
- Mining Capital Coin
- Three Arrows Capital collapse
- Voyager Digital collapse
- FTX privileged Alameda account
- FTX bankruptcy-claim valuation
- Celsius CEL market support
- Genesis and Gemini Earn structure
- BlockFi interest accounts
- Wormhole message-verification failure
- Nomad trusted-root failure
- Harmony Horizon bridge
- Poly Network cross-chain exploit
- Euler donation-to-reserves exploit
- Mango Markets oracle manipulation
- Beanstalk governance takeover
- Cream Finance lending exploits
- BadgerDAO frontend compromise
- Curve Vyper reentrancy incident
- Multichain bridge collapse
- KyberSwap concentrated-liquidity exploit
- BitMEX Bank Secrecy Act case
- Binance 2023 criminal resolution
- Bybit February 2025 theft
- Ronin validator compromise
- The DAO exploit and Ethereum fork
- EthereumMax paid promotion
- Mayweather and Khaled ICO promotions
- TRX and BTT celebrity promotion cases
- OneCoin without a public blockchain
- BitConnect lending programme
- Tornado Cash: the 2025 delisting belongs in the history too
- DMM Bitcoin, 2024: a recruitment lure reached a custody workflow
- OneCoin, 2026: asset recovery is not the same as repaying every victim
- Hashcash: proof of work before Bitcoin
- b-money: shared balances before the blockchain
- RPOW: reusable tokens and the hardware trust boundary
- Bitcoin’s genesis block: what the record establishes
27 · Articles and references
Chains & networks
- Bitcoin: settlement, mining and custody
- Ethereum: applications share a settlement system
- Solana: wallets, token accounts and authority
All entries A–Z
- BNB Chain and Binance are different subjects
- TRON: resources, tokens and issuer control
- XRP Ledger: validators, XRP and issued assets
- Arbitrum: rollups and AnyTrust have different assumptions
- Optimism: fault proofs and withdrawal assumptions
- Base: familiar addresses, separate balances
- Polygon PoS: checkpoints are not the whole security model
- Avalanche: C-Chain, other chains and bridge exposure
- Cosmos: a framework is not one shared security guarantee
- Sui: objects and ownership
- Cardano: extended UTXO and application risk
- Layer 2: five separate questions
- Solana PDAs: an address can be controlled without a private key
- Solana CPI: follow permissions into the called program
- Solana address lookup tables: compressed references, full responsibilities
- Solana transaction expiry: submitted is not confirmed
- Solana priority fees: the compute limit is part of the price
- EIP-4788: a beacon root is a commitment, not the whole beacon state
15 · Articles and references
Web fundamentals
- HTTP: what your browser asks a server to do
- DNS: the name is part of the security boundary
- TLS: encrypted traffic can still reach a scam website
All entries A–Z
- Cookies: how a website remembers a session
- Same-origin policy: the browser's boundary between sites
- Content Security Policy: limit what a page may execute
- Session theft: account access without another password prompt
- Password storage: why hashing and encryption serve different jobs
- A Web3 trust map: the chain is only one layer
- IPFS: content identity is not a storage guarantee
- IPNS: a stable name for content that can change
- DNSSEC and HTTPS: two checks behind a wallet website
- EIP-6963: choosing between browser wallets without trusting the icon
- Service workers: why a web app can show yesterday’s interface
- CORS: a browser reading rule is not API authentication
52 · Articles and references
Blockchain fundamentals
- Reading the Bitcoin white paper: what each part actually solves
- A transaction's path from signature to confirmation
- Blocks: ordered transactions and a commitment to state
All entries A–Z
- Proof of stake: agreement has rules, participants and penalties
- Nodes, clients and RPC providers
- Gas: resource usage and transaction price
- Merkle proofs: verify inclusion against a known commitment
- Bitcoin UTXOs: the outputs behind a wallet balance
- Bitcoin halvings: a programmed subsidy reduction
- Transaction malleability: when an identifier changes
- Contract storage: the persistent state a transaction changes
- Optimistic rollups: claims, challenges and the exit route
- Validity rollups: proving a state transition
- Data availability: can the state be independently reconstructed?
- Chain reorganisations: why recent inclusion can change
- NFT metadata: where the image and its description actually live
- Private keys and control
- Mnemonic recovery phrases
- Hierarchical deterministic derivation
- Transaction nonces
- Public mempools
- Confirmations and reorganisations
- Economic and protocol finality
- Proof-of-work mining
- Proof-of-stake validators
- Slashing conditions
- UTXO selection
- EVM account state
- Solana account ownership
- Gas limits and execution cost
- EIP-1559 base fees
- Blob data for rollups
- Calldata
- Contract storage layout
- Events and transaction logs
- Integer precision and rounding
- Light-client verification
- Optimistic rollups
- Validity-proof rollups
- Data availability
- Sequencer control
- NFT metadata persistence
- Token-standard boundaries
- Cross-chain message execution
- Replace-by-fee: an unconfirmed payment is not final settlement
- Bitcoin output descriptors: the wallet backup beyond a seed
- Schnorr and MuSig2: several signers, one Bitcoin signature
- Bitcoin timelocks: a calendar condition versus a coin’s age
- Bitcoin coinbase maturity: why a new mining reward cannot move immediately
- BOLT 11 invoices: what a Lightning payment request actually says
- CREATE2: knowing an address before the contract exists
- Bitcoin payment links: read the request behind the QR code