Every guide we have published, newest first. Search by title or filter by topic.
Attestations are not audits, USDC broke its peg because a bank failed, and the major fiat-backed stablecoins can freeze your address. What a stablecoin actually is, and the ten minutes of checking worth doing before you hold one.
Hashing is fine; signatures are not. Which of your coins are exposed today, why an address is not a public key, why 2-of-2 multisig barely helps here, and the one free thing you can do about it.
The thing that makes self-custody frightening is that mistakes are permanent — and that's exactly what a testnet removes. Which six SSP supports, what's genuinely worth rehearsing, why testnet keys come from a different branch of your seed, and the honest limits.
Over $1.5bn from four incidents, and not one was a failure of the underlying chain. A bridged token isn't the asset — it's a claim on a pot someone else holds. What Ronin, Poly Network, Wormhole and Nomad each teach, and why two-device signing can't help once your funds are in a bridge.
An explorer lets you check your wallet's claims against the chain instead of taking them on faith. Which six fields actually matter, what an explorer can't tell you, and an honest note about whose node you're really reading when you tap through from SSP.
Both mechanisms solve the same problem — making participation cost something real so identities can't be faked for free. One spends energy up front, the other risks the attacker's capital afterwards. What each actually buys, and why it matters far less to your security than you'd think.
Bitcoin stores no balances at all, Ethereum stores a balance and a counter, and Solana charges rent for existing. Why that explains high fees on small payments, transactions that fail and still cost money, and tokens that seem to vanish.
An address needs to be linked to you exactly once, and then its whole history — past and future — is linked too. How clustering heuristics work without your cooperation, what actually helps, and the honest limits of what SSP does today.
An unconfirmed transaction isn't broken — you underbid an auction that's still running. Why there's no timeout, how BIP 125 replacement actually works, the fee floor that trips people up, and which chains won't let you fix it at all.
An address is a compressed description of what has to be true for coins to move — which is why a 2-of-2 multisig address is longer than a single-key one. The formats, why SSP's look unusual, and the Bitcoin Cash trap that CashAddr was invented to fix.
The transaction that steals your money is rarely the transaction you signed — you signed permission. Which selectors matter, why 'unlimited' is the word to look for, and why a decoder that guesses is worse than no decoder at all.
No malware, no phishing site, no signature stolen. The attacker just puts a lookalike address in your transaction history and waits for you to copy it. Why 'always double-check the address' fails, and what actually defends against it.
Telestai carried Ravencoin's unvalidated nHeight field for its entire existence. It was never exploited — because someone read another chain's incident report and shipped a patch in two days. What forks inherit, and why upstream attention is most of your security.
A field in the block header that nobody validated made counterfeit blocks nearly free to mine, and three days of Ravencoin history had to be thrown away. What that says about confirmations — and the honest limits of what any wallet can protect you from.
A single 2021 commit made thousands of seeds guessable, and $116M left wallets that had done nothing wrong. Why weak entropy is silent, total loss — and the honest limits of what 2-of-2 protects against.
Threshold signatures split a key; multisig requires several. What the chain enforces, what each one costs, and which failures each model actually survives.
Ravencoin's asset layer, why SSP handles the coin but not the tokens, and the August 2026 consensus exploit that erased three days of chain — including whether SSP users were affected.
SSP holds ZEC in the transparent pool, not the shielded one — custody, not confidentiality. Plus the consensus branch ID that makes staying updated non-optional.
The fork kept Bitcoin's address format, and people lost money to it. How CashAddr and SIGHASH_FORKID fix that, plus the lowest default fee in the wallet.
Seed phrase, hardware wallet, MPC, multisig — an honest comparison of what each model actually guarantees, what it costs you, and how to pick.