TL;DR
Vocabulary is a security control. This module defines the 24 terms that appear in every attack — and maps each to the one tool that defuses it. Bookmark it. If a new “AI tool” cannot define its terms, do not connect it.
| TERM | PLAIN DEFINITION | TOOL / PANEL |
|---|---|---|
| Private key / seed | Ownership itself. Whoever holds it holds the funds. | Hardware wallet · cold storage |
| Allowance / approval | Permission for a contract to move your tokens. | Revoke manager · limited approvals |
| Drainer | Contract that takes everything you approved. | Simulation · blocklist / explorer flags |
| Phishing kit | Fake site clone that harvests keys/cards. <$500 infra. | Typed domains · bookmarks · paste-check |
| Smishing | SMS phishing. “Toll due” → kit. 330K texts/day. | Ignore. Open official app directly. |
| Clipboard hijacker | Malware swaps copied address to attacker. | First-6 + last-6 paste-check ritual |
| ENS squat | Display name lies; hex address is truth. | Verify raw 0x… address on explorer |
| Session key | Short-lived, scoped permission for agents/apps. | 4337 smart account · expiry · revoke |
| Prompt injection | Hidden text that hijacks an agent’s actions. | Allow-lists · human confirm · quote, don’t obey |
| Deepfake | AI face/voice that defeats video verification. | Second channel · code word · official-handle only |
| x402 | Machine micropayment rails (per-API pay). | Agent budgets · allow-lists · recipient alerts |
| Anonymity set | Size of crowd you hide in (mixer pool). | Fixed denoms · delay · fresh withdraws |
| Clustering | Analysts group your wallets as one identity. | One wallet per identity · no reuse |
| Bridge | Cross-chain messenger with its own trust model. | Validator vet · size caps · exit plan |
| Audit | Security review. Narrows risk; never closes it. | Auditor + date + scope + follow-ups |
| Oracle | Price feed that can be manipulated. | Fallbacks · deviation guards · caps |
| MEV | Searchers profit by ordering your trade. | Private routing · slippage caps |
| Slippage | Price move tolerance. Too high = sandwich. | Tight caps · small tests |
| Rug pull | Liquidity withdrawn / sells blocked. | Lock check · owner check · explorer |
| Multisig | N-of-M signatures to move funds (e.g. 2-of-3). | Safe / equivalent · timelock |
| Soulbound badge | Non-transferable proof (completion, passport). | Base · Panther Passport pattern |
| Kill chain | FBI freeze sequence before funds exit CEX. | Report fast (5-min response) |
| WalletDNA | Behavioral signals: smart money, churn, early, whale. | /dna · isSmartMoney filters |
| Hunt score | PNTHR 1–99 momentum + volume/cap blend. | /radar · ranking aid, not advice |
Keep the tool map tight. Explorers verify raw addresses and contract state. Revoke managers kill unlimited approvals. Simulators show what a signature actually does before you sign. Blocklists and explorer flags surface known drainers. WalletDNA tells you whether a counterparty behaves like smart money or churn. Every SCHOOL checklist maps to one of these — that is the live loop: the lesson is incomplete until you touch the tool.
For agents and builders: expose the same truths as APIs, not dashboards. A boolean — isDrainer, isRevoked, isAudited, isSmartMoney — beats a paragraph. That is the WalletDNA thesis: models are equal, measurements are not. Safety tooling should be machine-readable because the next user is a machine.
FREE + VERIFIED
Core curriculum: free forever. No paywalled safety.
Explo rer + revoke + simulator flows: embedded in terminal.
Soulbound completion badge: earned, not bought.
PAID (OPTIONAL, NEVER FOR KNOWLEDGE)
Verified certificate issuance (optional commercial layer).
Team / wallet embed licensing (B2B distribution).
Grant funding: Base / L2 public-good programs for impact reports.
BEFORE YOU LEAVE
Run the before-you-sign checklist once on a live panel (simulate + revoke), then print Module 08. You now have vocabulary, tools, and muscle memory — the full loop from lesson to live terminal.
DEFENSE CHECKLIST — MODULE 09
[01] Book this page. Lookup beats guessing under pressure.
[02] If a tool cannot define its terms in plain English, do not connect it.
[03] Run simulate + revoke weekly. Tools only protect if they are habits.
[04] Cite WalletDNA / explorer data before trusting any counterparty.
[05] Finish on the terminal: one live check > ten pages read.
SCHOOL INDEX
← PREVIOUS · MODULE 08
Field Checklists
Printable playbooks: new-user setup, before-you-sign, before-you-bridge, and a 5-minute / 1-hour / 24-hour incident response.
FINISH → CHECKLISTS
Print the Field Checklists
Setup · Before You Sign · Before You Bridge · Incident Response.
PNTHR SCHOOL · FREE + OPEN · SOURCES: FBI IC3 2025 · CHAINALYSIS 2026 · TRM LABS · CERTIK · IMMUNEFI · TUTELA · EDUCATION ONLY · NOT FINANCIAL ADVICE · NOT LEGAL ADVICE