Guides · Updated 19 September 2026
How the tricks actually work
Not a list of warnings. An explanation of the mechanism, so you can recognise it yourself.
Every guide here covers one technique the scanner looks for. Each explains how the trick is built, why it is convincing, how to check for it using more than one method — and, in every case, what a clean result still cannot tell you.
No affiliate links. No token recommendations. Nothing here is financial advice.
Published
Honeypot tokens: why you can buy but can't sell
The purchase goes through. The sale fails, every time. The restriction isn't in the price — it's written into the token's contract, and it can be checked in seconds before you spend anything.
The Text You Can't See
Two messages can look exactly the same and contain completely different characters. Zero-width characters, direction controls, the Unicode Tags block and look-alike letters — with a prepared example on the page you can copy and scan yourself.
The Instruction You Didn't Write
You paste something into an AI assistant and it contains instructions you never wrote. The four patterns they use, why indirect injection is the harder half of the problem, and why the same text matters more the more your assistant is allowed to do.
The Twelve Words
The single most expensive message in crypto, taken apart line by line. Why no support desk, migration, airdrop or security check has ever needed your recovery phrase — and what to do in the first ten minutes if you already entered it.
Read It From the Right
A web address tells you exactly where it goes — just not in the order you read it. How to inspect a link without opening it, the main tricks used to disguise one, and what a structural scan can and cannot tell you.
In preparation
Listed so you know what's coming, not to pad the page. Each one ships when it is actually written.
What you actually sign when you approve a token
An approval is not a payment. It is a standing permission, often unlimited and often permanent until you revoke it — and it is the loss most people never see coming.
Sanctioned addresses: what a match does and does not mean
Why a sanctions hit is a match against a specific list at a specific moment, why the lists lag reality, and why exposure to a flagged address is not the same claim as guilt.
Suggestions for what to cover next are welcome through the project's issue tracker.