Crypto phishing is a scam in which an attacker imitates a trusted website, app, person or message to trick you into revealing your secrets or approving a transaction that sends your assets to them. Because blockchain transfers are irreversible, a successful phish is usually permanent: there is no bank to call and no chargeback.
Phishing is the most common way ordinary users lose crypto, and it works on beginners and experts alike. This guide covers the main attack types, the warning signs, a protection checklist and what to do if you think you have been caught. It builds on the wider overview in crypto scams.
Key takeaways
- No legitimate service, wallet maker or support agent will ever ask for your seed phrase or private key.
- Many modern attacks do not steal your password; they trick you into signing a harmful approval or transaction.
- Bookmark the sites you use and never reach them through ads, search results or links in messages.
- Read what a wallet pop-up actually asks you to sign, and use a separate wallet for risky experiments.
- If you suspect a mistake, act fast: move assets, revoke approvals and change passwords from a clean device.
Why phishing works so well in crypto
Traditional finance has safety nets: card issuers reverse fraud, banks freeze accounts. Crypto, by design, has none of that. Whoever controls the keys controls the funds, and a signed transaction cannot be recalled. Attackers know this, so they target the human instead of the technology. A well-made fake page is far cheaper than breaking cryptography.
Crypto also moves fast and is full of new terms, airdrops, wallet pop-ups and urgent announcements. That atmosphere makes pressure tactics believable, which is exactly what phishers rely on.
The most common phishing attacks
| Attack | How it looks | What the attacker wants |
|---|---|---|
| Fake website | A near-identical copy of an exchange, wallet or DeFi site, reached through an ad or a link | Your login, seed phrase or a wallet connection |
| Seed phrase request | A fake support page or app asking you to “restore” or “validate” your wallet | The 12 or 24 recovery words |
| Wallet drainer | A site that asks you to sign an approval or a message, often for a fake mint or airdrop | Permission to move your tokens |
| Impersonation on social media | Replies or direct messages from “support” accounts, or hacked official accounts posting links | Clicks, secrets or deposits |
| Fake apps and extensions | Counterfeit wallet apps or browser add-ons in official-looking stores | Secrets typed into the fake app |
| Address poisoning | A tiny transaction from an address that looks almost identical to one you use, hoping you copy it later | Your future transfer sent to the wrong address |
| Email and SMS lures | Urgent notices about withdrawals, security alerts or account suspension | A click on a malicious link or a login |
Wallet drainers and bad approvals
Many people think they are safe because they never typed their seed phrase. Drainers exploit something different. When you connect a wallet and approve a token “spending allowance”, you may be giving a contract permission to move that token later, sometimes without limit. A fake mint page that asks for such an approval can empty your wallet within moments. Understanding private versus public keys helps explain why your signature, not your password, is what counts.
Address poisoning
Attackers create addresses that start and end with the same characters as one of your frequent contacts and send you a zero-value or tiny transfer so the lookalike appears in your history. If you later copy from the history instead of from a verified source, the money goes to the attacker. Always compare the whole address, not only the first and last characters. See what a crypto wallet address is for how addresses are built.
Red flags that should make you stop
- Urgency: “act within an hour or lose your funds”.
- Anything that asks for your seed phrase, private key or screen sharing.
- Offers that are too good: guaranteed returns, free tokens, surprise airdrops.
- A direct message from “support” or an unknown person offering help.
- A web address with small differences, extra words or a different ending, such as an extra letter or a hyphen.
- A wallet pop-up that you do not understand, with unlimited approvals or unreadable data.
- A request to move funds to a “safe wallet” supplied by someone else.
A useful rule: you start the interaction, not them. If you did not initiate the contact, treat it as hostile until verified through a channel you found yourself.
A practical protection checklist
- Bookmark your exchange and wallet sites once, from a trusted source, and only use the bookmarks.
- Never type your seed phrase into any website, chat or form. Only use it on a wallet device during a genuine recovery. More in seed phrase security.
- Use a hardware wallet for meaningful amounts, and verify transaction details on its screen. Compare options in hot wallet vs cold wallet.
- Separate wallets. Keep savings in one wallet you rarely connect to anything, and use a small second wallet for new apps.
- Enable strong two-factor authentication on exchange accounts, preferably with an app or a security key, and set an anti-phishing code if the exchange offers one.
- Check approvals regularly with a reputable approval-checking tool and revoke permissions you no longer need.
- Install software only from official sources linked from the project’s verified site, and check the publisher name.
- Slow down. For any large transfer, send a small test amount first and verify the full address.
What to do if you think you were phished
Speed matters, but so does calm. Work through these steps:
- Stop interacting with the site and disconnect your wallet.
- If you entered a seed phrase anywhere, treat that wallet as compromised. From a clean device, create a new wallet with a new seed phrase and move remaining assets there immediately.
- If you only signed an approval, revoke it using an approval-management tool and move valuable tokens to a fresh wallet.
- Change passwords and two-factor settings for related accounts, starting with your email, and check for unknown devices or sessions.
- Contact the exchange if funds went to a centralised platform; they may be able to flag the receiving account.
- Report the scam to the platform hosting it and to your local fraud or cybercrime authority. Keep screenshots and transaction hashes.
Be wary of anyone who offers to “recover” your funds for a fee. Recovery scams target victims of earlier scams, and genuine recovery of blockchain transfers is rare.
What is the difference between phishing and a hack?
Phishing tricks you into giving access or approving something yourself. A hack exploits a technical flaw without your participation. Phishing is far more common against individual users.
Can stolen crypto be recovered after phishing?
Rarely. Transfers cannot be reversed. If the funds went to an exchange, quick reporting may help, but recovery is never guaranteed.
Is connecting my wallet to a website dangerous?
Connecting only shares your public address and is usually low-risk. The danger comes from what you sign or approve afterwards, so always read each request.
How can I check if a website is real?
Use your saved bookmark, compare the full address letter by letter, and find links from the project’s verified channels. Do not trust sponsored search results.
Do hardware wallets prevent phishing?
They keep your keys off your computer, which blocks many attacks, but you can still be tricked into approving a harmful transaction. Always verify details on the device screen.
Next step: strengthen your accounts with two-factor authentication for crypto and protect your savings by learning to set up a hardware wallet in our hardware wallet checklist.
