Guides · Updated 26 October 2026
How the tricks actually work
Not a list of warnings. An explanation of the mechanism, so you can recognise it yourself.
Every guide here covers one technique the scanner looks for. Each explains how the trick is built, why it is convincing, how to check for it using more than one method — and, in every case, what a clean result still cannot tell you.
No affiliate links. No token recommendations. Nothing here is financial advice.
Want to practise instead of read? Spot the Trap has short challenges: read an invented message, choose your next step, and see the explanation.
Published
Honeypot tokens: why you can buy but can't sell
The purchase goes through. The sale fails, every time. The restriction isn't in the price — it's written into the token's contract, and it can be checked in seconds before you spend anything.
The Text You Can't See
Two messages can look exactly the same and contain completely different characters. Zero-width characters, direction controls, the Unicode Tags block and look-alike letters — with a prepared example on the page you can copy and scan yourself.
The Instruction You Didn't Write
You paste something into an AI assistant and it contains instructions you never wrote. The four patterns they use, why indirect injection is the harder half of the problem, and why the same text matters more the more your assistant is allowed to do.
The Twelve Words
The single most expensive message in crypto, taken apart line by line. Why no support desk, migration, airdrop or security check has ever needed your recovery phrase — and what to do in the first ten minutes if you already entered it.
Read It From the Right
A web address tells you exactly where it goes — just not in the order you read it. How to inspect a link without opening it, the main tricks used to disguise one, and what a structural scan can and cannot tell you.
The Address You Can't Pay
A sanctioned wallet looks like every other wallet, and the blockchain will pay it without a pause. What a listing means, how you can touch one without asking, why "I didn't know" doesn't make it legal — and what a check can and can't see.
The Address That Looks Like Yours
It starts like yours. It ends like yours. It is not yours. How address poisoning plants a look-alike in your transaction history, the $68 million case, and the five habits that beat it.
AI Leftovers
The chatbot's "Certainly! Here is a message you can send:" that rode along into your email. What AI leftovers are, why your eyes skip them, and how to catch them before you send — without pretending to detect AI.
Give Your Agent a Second Opinion Before It Acts
Your coding agent installs what a README or an issue comment tells it to. How a local guard checks every npm install first, why the scan and the decision are kept apart, and what it still cannot see.
What you actually sign when you approve a token
An approval is not a payment, but it is permission to spend. What approve, set approval for all, Permit and Permit2 can authorise, five checks before you sign, and how to review and revoke what you have already granted.
The domain that looks right
A look-alike address only has to look familiar for a moment. How to find the domain that matters, the alphabet and spelling tricks behind look-alikes, what threat lists can and cannot tell you, and habits that reduce the risk.
Is my phone being watched?
Someone knows things they should not. Account access, shared settings, monitoring apps and mercenary spyware need different responses: what deserves a closer look, how to get help safely, and what our spyware check can and cannot tell you.
Suggestions for what to cover next are welcome through the project's issue tracker.