Weekly Crypto Web3 Safety Digest CW16 2026
Curated Threat Intelligence for Real-World Web3 Risks
This Weekly Crypto and Web3 Safety Digest for CW16 2026 analyzes real-world loss incidents across scams, hacks, and user mistakes observed during the week.
The report is built from a curated dataset of confirmed incidents, derived from public disclosures, social monitoring, and security reporting. It reflects how losses occur in practice rather than theoretical attack models.
CW16 contains 55 confirmed incidents across the dataset. Scam-classified incidents represent the largest category, while user-originated losses and hack-classified incidents appear at lower levels.
Collection & Curation Scope (CW16)
Each weekly digest reflects a curated intelligence subset derived from review of raw reports, disclosures, and signals observed across public forums, social platforms, incident disclosures, and security reporting during the week.
Only incidents meeting classification, verifiability, and analytical relevance thresholds are normalized into the CW16 dataset. The counts presented in this report represent confirmed cases rather than total observed scam attempts or low-signal activity.
CW16 confirms distribution across categories:
– total incidents: 55
– scams: 38
– hacks: 4
– user_mistakes: 13
CW16 reflects distribution across established incident_type categories without introduction of new classification types.
Table of Contents
Executive Layer — CW16 at a Glance
Derivation declaration (CW16):
– incidents.csv (CW16)
– taxonomy_report (CW16)
– prevention_report (CW16)
– governance_notes.md (CW16)
CW16 contains 55 confirmed incidents across the dataset. Distribution across incident types is as follows:
– scams: 38
– hacks: 4
– user_mistakes: 13
No new incident_type categories are present in CW16.
Key Judgments — CW16
– Scam-classified incidents represent the largest category in CW16, accounting for 38 of 55 total incidents.
– social_engineering appears at the highest count within scam-classified activity in CW16.
– Additional scam activity is present across social_media_scam, smart_contract_scam, phishing, crypto_wallet_scam, exchange_scam, fake_app_or_extension, token_launch_scam, and blackmail_extortion.
– Hack-classified incidents total 4 and are recorded under wallet_software_exploit, trojan, and dns_spoofing.
– User-originated incidents total 13 and include tax_recordkeeping, wrong_network, wrong_address, backup_failure, and lost_wallet_access.
– No new incident_type categories are introduced in CW16.
Positioning note (series continuity)
This weekly series tracks scam-classified incidents, hack-classified incidents, and user-originated losses using a consistent taxonomy and prevention mapping framework.
Canonical authority remains:
– incidents.csv
– taxonomy_report
– prevention_report
– manifest.md
These artifacts enable comparability across weeks without altering classification structure.
Top CW16 prevention levers (prevention_report, CW16 — normalized coverage only) (H3)
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Maintain complete transaction and tax records
These actions are explicitly present in prevention_report (CW16).
Top CW16 prevention levers (prevention_report, CW16 — normalized coverage only)
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Maintain complete transaction and tax records
These actions are explicitly present in prevention_report (CW16).
Notable structural signals in CW16
– no new incident_type categories appear
– scam-classified incidents represent the largest category by count
– user-originated incidents are present at lower levels relative to scam-classified incidents
– hack-classified incidents remain limited in count within CW16
– governance_notes.md (CW16) indicates classification ambiguity and prevention mapping friction are present
Golden Rule governance signal (CW16)
CSF rule registry testing was executed against the CW16 dataset.
No new rule creation thresholds were triggered and no rule logic modifications were required.
Defensive Baseline — Tools Referenced in This Digest
This weekly digest analyzes loss mechanisms observed in CW16.
The defensive tools referenced throughout this report are maintained here:
– tools to reduce exposure to scams and wallet drains
Practical Crypto Web3 Safety Tools | Reference Guide
That page consolidates the core tools used to reduce exposure to:
– fake platforms and pay-to-withdraw schemes
– phishing and impersonation
– malicious tools and endpoint compromise
– irreversible user-originated errors
CW16 defensive sufficiency was assessed via defensive_coverage_gap_report.md (CW16). The audit determined:
All dominant earliest preventable failure points evaluated in CW16 were assessed as covered within the CSF Defensive Canon. None were assessed as uncovered.
For recurring interpretive questions, see the evergreen reference:
→ recurring recovery and scam questions
Crypto Loss FAQ: Why Wallets Get Drained, Scams Work, and Funds Disappear
The public FAQ remains an evergreen downstream reference. CW16 alignment was evaluated via faq_signal_report.md (CW16), which assessed reinforcement, absence, or candidate adjustments strictly against CW16 evidence.
These governance artifacts:
– do not create intelligence
– do not modify taxonomy or prevention mappings
– do not influence weekly synthesis or conclusions
Weekly Synthesis — CW16 Loss Dynamics
Derivation declaration (CW16):
– incidents.csv (CW16)
– taxonomy_report (CW16)
– prevention_report (CW16)
– governance_notes.md (CW16)
CW16 contains 55 curated incidents.
Structural Signal — CW16
CW16 reflects distribution across established incident types without introduction of new incident_type categories.
– scam incidents: 38
– hack incidents: 4
user_mistake incidents: 13
Scam-classified incidents represent the largest category by count in CW16. User-originated losses are also present at higher count than hack-classified incidents.
Threat Pressure Gauge — CW16
– scam pressure: highest by count (38 of 55 incidents)
– hack pressure: limited by count (4 incidents)
– user_mistake pressure: present by count (13 incidents)
Incident type distribution (taxonomy_report, CW16)
– scam: 38
– hack: 4
– user_mistake: 13
Scam-classified incidents represent the largest category by count in CW16. No new incident_type categories appear in CW16.
Scam-Classified Activity — CW16
Within scam-classified incidents, the following subtypes are present in taxonomy_report (CW16):
– social_engineering
– phishing
– social_media_scam
– crypto_wallet_scam
– smart_contract_scam
– fake_app_or_extension
– exchange_scam
– token_launch_scam
– blackmail_extortion
social_engineering appears at the highest count within scam-classified activity in CW16. social_media_scam and smart_contract_scam are also present at higher counts than the remaining scam subtypes.
Hack-Classified Activity — CW16
Hack-classified incidents total 4 in CW16.
Subtypes present in taxonomy_report (CW16):
– trojan
– dns_spoofing
– wallet_software_exploit
wallet_software_exploit appears at the highest count within hack-classified activity in CW16.
User-Originated Activity — CW16
User-originated incidents total 13 in CW16.
Subtypes present in taxonomy_report (CW16):
– wrong_address
– wrong_network
– backup_failure
– lost_wallet_access
– tax_recordkeeping
tax_recordkeeping appears at the highest count within user_mistake activity in CW16. wrong_network is also present at lower but repeated count.
Observed Failure Points — CW16
Across CW16 incidents, the following failure points are observable in incidents.csv:
– funds sent after unsolicited contact or direct outreach promising returns or access
– wallet recovery phrases entered into untrusted sites, apps, or setup flows
– interaction with fake platforms, dashboards, exchange-like services, or token participation environments
– additional payment or unlocking conditions presented during withdrawal attempts
– transfers executed to unsupported networks or unintended destinations
– wallet access lost because recovery material was missing, damaged, unavailable, or incorrectly recorded
– transaction or tax records unavailable when reconciliation or filing was required
– malicious software or compromised front ends used during wallet or protocol interaction
Prevention Mapping Signal (CW16)
prevention_report (CW16) shows strongest normalization around:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Maintain complete transaction and tax records
Full normalized action set in CW16 includes:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Never share recovery phrases or private keys
– Do not pay fees to unlock withdrawals
– Use hardware wallets for long term storage
– Enable strong authentication and account security
– Confirm network and address compatibility before transfers
– Test transactions with small amounts first
– Limit browser extensions and keep browsers updated
– Revoke token approvals and review permissions regularly
– Maintain complete transaction and tax records
– Minimize public exposure of crypto holdings
Governance Signal — CW16
governance_notes.md (CW16) indicates:
– classification ambiguity was observed
– no taxonomy pressure signals were observed
– prevention mapping friction was observed
– no reclassification was identified
– no scope changes were identified
– no post-generation modifications were identified
Synthesis — CW16
Across CW16 incidents, loss outcomes are associated with:
– interaction with unverified platforms, apps, dashboards, or exchange-like environments
– engagement through unsolicited messages, social contact, or impersonated outreach
– wallet compromise or fund loss after seed phrase exposure or malicious transaction interaction
– withdrawal barriers or payment demands presented after funds were deposited
– loss of access caused by unavailable or incorrect recovery material
– transfer execution errors involving unsupported networks or unintended destinations
– recordkeeping gaps at the point of tax reconciliation or compliance
In scam-classified incidents, activity is concentrated in social_engineering, with additional presence across phishing, social_media_scam, crypto_wallet_scam, smart_contract_scam, fake_app_or_extension, exchange_scam, token_launch_scam, and blackmail_extortion.
In hack-classified incidents, activity is recorded under trojan, dns_spoofing, and wallet_software_exploit.
In user_mistake incidents, activity is concentrated in tax_recordkeeping, with additional presence across wrong_network, wrong_address, backup_failure, and lost_wallet_access.
CW16 reflects distribution of loss outcomes across established categories and subtypes without introduction of new classification structures.
CW16 Data Snapshot — Evidence Anchors
The tables below ground the CW16 analysis directly in canonical weekly artifacts. Counts are taken from taxonomy_report (CW16) and prevention_report (CW16).
CW16 Incident Classification Overview
Total incidents in CW16 dataset: 55 (taxonomy_report, CW16)
Incident type | Count (CW16) | Primary source |
scam | 38 | taxonomy_report (CW16) |
hack | 4 | taxonomy_report (CW16) |
user_mistake | 13 | taxonomy_report (CW16) |
CW16 Scam Mechanisms Present
Scam Mechanism (Subcategory) | Count (CW16) | Primary source |
social_engineering | 13 | taxonomy_report (CW16) |
phishing | 4 | taxonomy_report (CW16) |
social_media_scam | 5 | taxonomy_report (CW16) |
crypto_wallet_scam | 4 | taxonomy_report (CW16) |
smart_contract_scam | 5 | taxonomy_report (CW16) |
fake_app_or_extension | 2 | taxonomy_report (CW16) |
exchange_scam | 3 | taxonomy_report (CW16) |
token_launch_scam | 1 | taxonomy_report (CW16) |
pump_dump | 0 | taxonomy_report (CW16) |
rug_pull | 0 | taxonomy_report (CW16) |
airdrop_scam | 0 | taxonomy_report (CW16) |
nft_scam | 0 | taxonomy_report (CW16) |
sim_swap | 0 | taxonomy_report (CW16) |
job_scam | 0 | taxonomy_report (CW16) |
blackmail_extortion | 1 | taxonomy_report (CW16) |
romance_scam | 0 | taxonomy_report (CW16) |
CW16 Hack Mechanisms Present
Hack Mechanism (Subcategory) | Count (CW16) | Primary source |
social_engineering_hack | 0 | taxonomy_report (CW16) |
malware | 0 | taxonomy_report (CW16) |
trojan | 1 | taxonomy_report (CW16) |
spyware | 0 | taxonomy_report (CW16) |
keylogger | 0 | taxonomy_report (CW16) |
clipboard_hijacker | 0 | taxonomy_report (CW16) |
ransomware | 0 | taxonomy_report (CW16) |
cryptojacking | 0 | taxonomy_report (CW16) |
network_mitm | 0 | taxonomy_report (CW16) |
wifi_sniffing | 0 | taxonomy_report (CW16) |
dns_spoofing | 1 | taxonomy_report (CW16) |
session_hijacking | 0 | taxonomy_report (CW16) |
ssl_stripping | 0 | taxonomy_report (CW16) |
fake_app_or_extension_hack | 0 | taxonomy_report (CW16) |
exchange_vulnerability | 0 | taxonomy_report (CW16) |
insider_attack | 0 | taxonomy_report (CW16) |
wallet_software_exploit | 2 | taxonomy_report (CW16) |
CW16 User-Originated Loss Patterns Present
Subtype | Count (CW16) | Primary source |
wrong_address | 2 | taxonomy_report (CW16) |
wrong_network | 3 | taxonomy_report (CW16) |
seed_phrase_exposure | 0 | taxonomy_report (CW16) |
approval_misunderstanding | 0 | taxonomy_report (CW16) |
backup_failure | 2 | taxonomy_report (CW16) |
address_poisoning_copy_paste | 0 | taxonomy_report (CW16) |
lost_wallet_access | 1 | taxonomy_report (CW16) |
poor_wallet_backup_practice | 0 | taxonomy_report (CW16) |
tax_recordkeeping | 5 | taxonomy_report (CW16) |
CW16 Prevention Coverage (Most-cited prevention actions)
Prevention Action | Count (CW16) | Primary source |
Verify platform legitimacy before use | 28 | prevention_report (CW16) |
Avoid unsolicited messages calls and DMs | 16 | prevention_report (CW16) |
Never share recovery phrases or private keys | 4 | prevention_report (CW16) |
Do not pay fees to unlock withdrawals | 4 | prevention_report (CW16) |
Use hardware wallets for long term storage | 1 | prevention_report (CW16) |
Enable strong authentication and account security | 1 | prevention_report (CW16) |
Confirm network and address compatibility before transfers | 4 | prevention_report (CW16) |
Test transactions with small amounts first | 2 | prevention_report (CW16) |
Limit browser extensions and keep browsers updated | 0 | prevention_report (CW16) |
Revoke token approvals and review permissions regularly | 1 | prevention_report (CW16) |
Maintain complete transaction and tax records | 5 | prevention_report (CW16) |
Minimize public exposure of crypto holdings | 0 | prevention_report (CW16) |
Scam-Classified Incidents — CW16
Derivation declaration (CW16):
– incidents.csv (CW16)
– taxonomy_report (CW16)
– prevention_report (CW16)
CW16 contains 38 scam-classified incidents.
Subtypes present
Subtypes present in taxonomy_report (CW16) with count > 0:
– social_engineering
– phishing
– social_media_scam
– crypto_wallet_scam
– smart_contract_scam
– fake_app_or_extension
– exchange_scam
– token_launch_scam
– blackmail_extortion
social_engineering appears at the highest count based on taxonomy_report (CW16).
Entry & interaction patterns
Observed behaviors in incidents.csv (CW16) include:
– interaction initiated through unsolicited or externally controlled communication channels
– redirection from communication channels into platform or interface environments
– engagement framed through investment, reward, account access, or platform participation narratives
– continued interaction within environments presented as legitimate without independent verification
prevention_report (CW16) includes:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
Platform trust & execution environments
Observed behaviors in incidents.csv (CW16) include:
– deposits made into externally controlled or unverified platforms
– interaction with exchange-like dashboards or wallet-linked interfaces
– engagement with token participation pages, staking pages, or application-based workflows
– reliance on displayed balances, account states, or platform outputs
These behaviors are observed within:
– exchange_scam
– crypto_wallet_scam
– social_media_scam
– smart_contract_scam
– fake_app_or_extension
– token_launch_scam
prevention_report (CW16) includes:
– Verify platform legitimacy before use
Withdrawal restriction / continuation patterns
Observed behaviors in incidents.csv (CW16) include:
– balances or profits presented prior to withdrawal attempts
– withdrawal restrictions introduced after deposit or interaction
– additional payment conditions presented during withdrawal attempts
– continued restriction after prior engagement or payment
These behaviors are observed within:
– exchange_scam
– crypto_wallet_scam
– token_launch_scam
prevention_report (CW16) includes:
– Do not pay fees to unlock withdrawals
Prevention alignment
prevention_report (CW16) includes:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Do not pay fees to unlock withdrawals
Hack-Classified Incidents — CW16
Derivation declaration (CW16):
– incidents.csv (CW16)
– taxonomy_report (CW16)
– prevention_report (CW16)
CW16 contains 4 hack-classified incidents.
Subtypes present
Subtypes present in taxonomy_report (CW16):
– trojan
– dns_spoofing
– wallet_software_exploit
wallet_software_exploit represents the highest count within hack-classified incidents in CW16.
Observed compromise behavior
Observed behaviors in incidents.csv (CW16) include:
wallet_software_exploit:
– loss associated with wallet software conditions
– asset exposure occurring within wallet-managed environments
trojan:
– loss associated with compromised software environments
– interaction with environments influenced by externally introduced software
dns_spoofing:
– redirection into unintended platform or interface environments
– interaction occurring within environments reached through altered routing conditions
Environment characteristics
Observed characteristics in CW16 incidents include:
– impact occurring within wallet or software-managed environments
– interaction with environments not matching intended destinations
– asset exposure occurring within user-accessed software or platform contexts
No CW16 incident describes consensus-level failure or cryptographic compromise.
Prevention alignment
prevention_report (CW16) includes:
– Enable strong authentication and account security
User Mistakes — CW16
Derivation declaration (CW16):
– incidents.csv (CW16)
– taxonomy_report (CW16)
– prevention_report (CW16)
CW16 contains 13 user_mistake incidents.
Subtypes present
Subtypes present in taxonomy_report (CW16) with count > 0:
– wrong_address
– wrong_network
– backup_failure
– lost_wallet_access
– tax_recordkeeping
tax_recordkeeping appears at the highest count based on taxonomy_report (CW16).
Observed behaviors
Observed behaviors in incidents.csv (CW16) include:
– inability to access wallets due to missing or unavailable recovery material
– failure of stored backup or inability to retrieve backup at time of access
– transfers executed on unintended or incompatible blockchain networks
– transfers executed to unintended destinations due to incorrect address usage
– absence of complete transaction or account records when required
These behaviors are observed in incidents associated with:
– lost_wallet_access
– backup_failure
– wrong_network
– wrong_address
– tax_recordkeeping
Access and recovery conditions
Observed behaviors in incidents.csv (CW16) include:
– loss of access identified during wallet recovery attempts
– absence of sufficient recovery information at the time access was required
– reliance on previously stored backup data that could not be retrieved
These behaviors are observed in incidents associated with:
– lost_wallet_access
– backup_failure
Transaction execution conditions
Observed behaviors in incidents.csv (CW16) include:
– transfer submission on unsupported or unintended blockchain networks
– assumptions of compatibility between sending and receiving environments
– transaction finalization based on submitted parameters without correction mechanisms
– transfer execution to unintended addresses due to address handling errors
These behaviors are observed in incidents associated with:
– wrong_network
– wrong_address
Prevention alignment
prevention_report (CW16) includes:
– Confirm network and address compatibility before transfers
– Test transactions with small amounts first
– Maintain complete transaction and tax records
Rule & Tool Mapping Frequency — CW16
Derivation declaration (CW16):
– CSF Rule Alignment Dataset
– Tool Mapping Dataset
Rules Mapping Frequency — CW16
This section reflects the frequency of rule alignment across CW16 incidents based on the CSF Rule Alignment Dataset. Each count represents direct mappings between observed incidents and applicable behavioral safety rules, without normalization or weighting. The distribution shows how frequently specific rules are triggered across real-world loss cases in CW16.
Rule mapping in CW16 is distributed across multiple categories, with Scam Defense Rules accounting for the highest number of mappings, followed by Operational Rules, Technical Security Rules, and Golden Rules. The counts reflect direct incident-to-rule associations derived from the dataset and illustrate how existing rules align with observed incident patterns during the week.
Rule ID | Rule Name | Rule Category | Incidents |
SDR-007 | VERIFY PROJECTS BEFORE INVESTING | Scam Defense Rules | 12 |
SDR-001 | NEVER TRUST UNSOLICITED CRYPTO CONTACT | Scam Defense Rules | 5 |
OR-005 | ALWAYS VERIFY THE DESTINATION BEFORE SENDING CRYPTO | Operational Rules | 5 |
OR-003 | DOCUMENT HOW YOUR WALLET WAS CREATED | Operational Rules | 5 |
SDR-003 | NEVER PAY TO UNLOCK OR WITHDRAW FUNDS | Scam Defense Rules | 4 |
SDR-009 | VERIFY ALL LINKS BEFORE LOGGING IN | Scam Defense Rules | 4 |
SDR-005 | NEVER CONNECT YOUR WALLET TO UNKNOWN WEBSITES | Scam Defense Rules | 4 |
TSR-001 | NEVER INSTALL CRYPTO SOFTWARE FROM UNOFFICIAL SOURCES | Technical Security Rules | 3 |
GR-005 | NEVER FOLLOW URGENT SUPPORT OR SECURITY INSTRUCTIONS | Golden Rules | 3 |
GR-001 | NEVER SHARE YOUR SEED PHRASE | Golden Rules | 2 |
OR-002 | NEVER RELY ON A SINGLE SEED PHRASE BACKUP | Operational Rules | 2 |
SDR-002 | NEVER SEND CRYPTO TO RECEIVE CRYPTO | Scam Defense Rules | 2 |
TSR-007 | SLOW DOWN BEFORE CLICKING OR INSTALLING | Technical Security Rules | 2 |
OR-001 | TEST YOUR WALLET RECOVERY BEFORE TRUSTING IT | Operational Rules | 1 |
GR-004 | ALWAYS REVOKE UNUSED TOKEN APPROVALS | Golden Rules | 1 |
Tools Mapping Frequency — CW16
This section reflects the frequency of tool alignment across CW16 incidents based on the Tool Mapping Dataset. Each count represents direct associations between observed incidents and referenced defensive tools, without normalization or weighting. The distribution shows how frequently specific tools are referenced in relation to incident patterns observed during CW16.
Tool mapping in CW16 spans multiple categories, including scam detection, monitoring and recovery, threat intelligence, and core protection. The counts reflect direct incident-to-tool associations from the dataset and illustrate how available defensive tools align with observed incident scenarios during the week.
Tool ID | Tool Name | Tool Category | Incidents |
TOL-012 | Domain Intelligence Tool | Scam Detection | 22 |
TOL-011 | Portfolio & Transaction Tracking Tool | Monitoring & Recovery | 11 |
TOL-014 | Threat Intelligence Scanner | Threat Intelligence | 7 |
TOL-016 | Web3 Transaction & Signature Security Tool | Web3 Transaction Security | 5 |
TOL-002 | Offline Seed Backup Storage | Core Protection | 4 |
TOL-001 | Hardware Wallet | Core Protection | 1 |
TOL-005 | Token Approval Revocation Tool | Smart Contract & Approval | 1 |
TOL-006 | Password Manager | Account Security | 1 |
TOL-009 | Endpoint Protection Tool | Device Security | 1 |
Coverage Notes
– Counts reflect mapping frequency across dataset rows.
– Rule and tool counts are derived directly from the provided dataset.
– No normalization, weighting, or inference applied.
– Rows include only rules and tools present in the dataset.
Conclusion
CW16 records 55 confirmed incidents across the dataset.
Distribution by category:
– scam: 38
– hack: 4
– user_mistake: 13
Scam-classified incidents represent the largest share of activity in CW16, with activity led by social_engineering and additional presence across phishing, social_media_scam, crypto_wallet_scam, smart_contract_scam, fake_app_or_extension, exchange_scam, token_launch_scam, and blackmail_extortion.
Hack-classified incidents remain limited in count and are recorded under wallet_software_exploit, trojan, and dns_spoofing, with no indication of consensus-level or cryptographic failure.
User-originated losses account for 13 incidents, led by tax_recordkeeping, with additional activity across wrong_network, wrong_address, backup_failure, and lost_wallet_access.
Observed loss patterns in CW16 align with:
– interaction with unverified platforms or interfaces
– engagement through unsolicited or externally initiated communication
– withdrawal restriction and continuation conditions in scam environments
– loss of access due to missing or unavailable recovery material
– transfer execution without confirmed network or address compatibility
– absence of complete transaction or tax records
– interaction with compromised or redirected software environments
Prevention alignment remains concentrated in:
– Verify platform legitimacy before use
– Avoid unsolicited messages calls and DMs
– Maintain complete transaction and tax records
This conclusion reflects aggregation of validated CW16 artifacts without introduction of new interpretations or extensions.
Disclaimer — Read Before Acting on This Digest
This Weekly Crypto and Web3 Safety Digest CW16 2026 is based on curated open-source intelligence (OSINT), including public Reddit posts, social media reports, incident disclosures, and security reporting. While every effort is made to accurately summarize observed patterns and incidents, details such as loss amounts, timelines, and technical specifics may be incomplete, inaccurate, or later revised.
This digest is provided for educational and awareness purposes only. Nothing in this report constitutes financial, investment, legal, cybersecurity, or tax advice.
Methodology & AI Disclosure
This report is derived from the canonical weekly incident dataset and associated analytical artifacts for CW16.
Incidents are sourced from publicly available disclosures, community reporting, security research, and reputable media. Each record undergoes structured normalization, taxonomy classification, and prevention mapping prior to inclusion in the weekly dataset.
Only incidents that meet sourcing, consistency, and taxonomy validation thresholds are included in the published weekly corpus. Reports that are incomplete, unverifiable, duplicative, or represent unsuccessful attempts are excluded to preserve analytical integrity and longitudinal comparability.
Incident Volume Context
Weekly incident counts reflect curated, validated cases — not total observed scam outreach or attempted activity.
Each reporting period involves review of substantially more raw signals than are ultimately normalized into the dataset. Published counts represent confirmed and classified incidents only.
AI-Assisted Workflow Disclosure
Portions of the workflow use AI-assisted tooling to support:
– structuring and formatting normalized records
– summarizing verbose or technical source material
– drafting image descriptions
– improving structural consistency across sections
AI tools are used for workflow efficiency and formatting support only.
All incident inclusion decisions, classification judgments, taxonomy applications, and analytical interpretations are reviewed and validated by human editors prior to publication.
AI does not determine incident validity, taxonomy structure, prevention mappings, or analytical conclusions.
CSF Rule Alignment Analysis
In addition to taxonomy classification and prevention normalization, CW16 incident patterns are evaluated against the Crypto Safety First (CSF) Defensive Canon.
The CSF rule registry contains four rule layers:
– Golden Rules (GR)
– Operational Rules (OR)
– Scam Defense Rules (SDR)
– Technical Security Rules (TSR)
This evaluation examines whether the earliest preventable failure boundaries observed in the CW14 incident corpus correspond to one or more rules already present in the CSF registry.
Rule alignment analysis is conducted as a research layer only.
It does not influence:
– incident classification
– taxonomy structure
– prevention normalization
– weekly synthesis conclusions
The purpose of this evaluation is to assess how frequently observed loss mechanisms correspond to existing defensive rules and to identify potential recurrence clusters that may justify future rule creation or rule refinement.
Governance Position
Canonical authority resides in:
– incidents.csv
– taxonomy_report
– prevention_report
– manifest.md
This narrative digest is a publication-layer rendering of those artifacts and does not override them.
