The risks that empty wallets are rarely the ones people worry about. They are not dramatic protocol failures but ordinary permissions granted once and never revoked, and infrastructure whose trust assumptions were never explained to the people relying on it.
A token approval is the clearest example. Interacting with almost any on-chain application requires granting a contract permission to move a token on your behalf, and by default that permission is frequently unlimited and permanent. It survives the transaction, the session and often the application itself. Years-old approvals to contracts that no longer have maintainers are a standing exposure sitting in a large share of active wallets.
Bridges are the other. A bridge is not one design but several, and they fail in a small number of recognisable ways — custody of the locked asset, the validator set attesting to it, the message-passing layer, and the contract on the receiving chain. Knowing which design a bridge uses tells you which of those failures you are exposed to, and that is knowable before you use it.
A cross-chain bridge locks or pools your asset on one chain so an equivalent can move on another.
A walkthrough of what happens on-chain when you click "approve" in a wallet, why the permission does not expire on its own, and what revoking one…
The arithmetic behind the DeFi liquidity-provider risk, reproduced across four sources and three different dollar scales, and what the formula leaves out.
We do not publish live exploit walkthroughs or anything that helps drain a contract still holding funds. Where an incident is over and the mechanism is public, we explain how it worked, because the same pattern recurs and readers are entitled to recognise it.