How To Avoid Phishing Attacks Targeting Crypto Users

Key Takeaways

1. Crypto phishing tricks you into handing over control. These attacks focus on deceiving users. Attackers persuade people to reveal a seed phrase, sign a harmful transaction, or send funds to the wrong address.
2. A harmful signature or a copied address can cause a major loss. A wallet connection, a spending approval, and a transfer are different actions, so check exactly what a site asks you to authorize.
3. A few habits reduce your risk. Never share your seed phrase, read what you sign, verify every address in full, and only use bookmarked official links.

What Is Crypto Phishing?

Crypto phishing is a scam where an attacker pretends to be a trusted person, company, or website so you give up access to your crypto. The goal is simple: get your seed phrase, your login details, or your signature on a transaction that moves your funds.

Phishing is not new. Email scams have existed for decades. What makes crypto different is that most blockchain transactions are final. There is usually no bank to call and no chargeback button. A completed transfer cannot normally be cancelled by your wallet provider. Recovery may require the recipient, an exchange, an issuer, or law enforcement to act, and is not guaranteed.

That is why understanding phishing is one of the most valuable security skills a crypto user can learn.

How Big Is the Problem?

These figures describe different datasets. They are useful context, but should not be added together or treated as a single measure of phishing.

Data point	Figure	Scope and primary source
Observed wallet-drainer phishing losses in 2025	$83.85 million, down 83% from $494 million in 2024	Scam Sniffer's January 2026 report; tracked phishing websites on EVM-compatible chains
Victims in that drainer dataset	106,106	Scam Sniffer; not a count of every crypto scam victim
Largest theft in that dataset in 2025	$6.5 million	Scam Sniffer; a September incident involving a Permit signature
Losses in 2025 FBI complaints with a cryptocurrency nexus	About $11.37 billion	FBI IC3 2025 Annual Report; broader than phishing
AI-related complaints in the FBI report	22,364 complaints and about $893 million in losses	FBI IC3; covers multiple crime types, not only crypto

Scam Sniffer calls its figures a lower-bound estimate: they exclude exchange hacks, contract exploits, and other theft methods. The observed decline does not mean that an individual wallet is safe. FBI complaint totals also depend on what victims report; they are not a complete census of crime.

The Most Common Crypto Phishing Attacks

1. Fake Websites and Lookalike Domains

Attackers build copies of exchanges, wallets, and DeFi apps. The URL may differ by one letter, use a different ending, or appear as a sponsored search ad above the real site. A fake login page can steal credentials. A deceptive crypto site may also ask you to connect a wallet and then approve a harmful transaction. Connecting normally exposes your public address and lets the site request actions; it does not, by itself, disclose your seed phrase or authorize token spending.

2. Seed Phrase Theft

Your seed phrase (also called a recovery phrase) is the master key to your wallet. Scammers ask for it through fake "wallet validation" pages, fake support chats, pop ups that claim your wallet needs a sync, or even physical letters that impersonate wallet makers. Support staff do not need your phrase. A genuine wallet may ask you to enter it locally when you deliberately restore an existing wallet, so verify the wallet software and follow its official recovery instructions.

3. Malicious Signatures and Wallet Drainers

A wallet drainer is a toolkit that tricks you into signing a message or transaction that gives the attacker permission to move your tokens. Common methods include:

• Token approvals: permission for a spender to transfer a specified token, sometimes up to an unlimited amount. An NFT operator approval can cover every NFT you hold in a collection. A malicious spender can abuse that permission.
• Permit and Permit2 signatures: signatures that can authorize token spending without the user submitting the initial authorization transaction. A request with no immediate gas charge can still be dangerous. See the ERC-2612 specification and Uniswap's Permit2 documentation.
• Account delegation: EIP-7702 lets an Ethereum account delegate execution to code. A malicious authorization can give dangerous control to that code; it is not simply a batch-payment feature. The EIP-7702 specification warns about unsafe delegates.

These signatures often appear on fake airdrop, mint, or "claim reward" pages.

4. Address Poisoning

In address poisoning, an attacker creates a wallet address that matches the first and last characters of one you use. They send you a tiny transaction so the fake address appears in your history. Later, you copy the wrong one.

Carnegie Mellon researchers reported a $50 million address-poisoning loss on December 19, 2025. A test payment cannot protect a later transfer if you switch to a different address. Use the same independently verified recipient for both.

5. Fake Support and Impersonation

Scammers watch public channels such as Telegram, Discord, and X. When someone asks for help, a fake "support agent" sends a direct message. They may use a real company logo and a name almost identical to a real moderator. Their goal is a seed phrase, a remote access session, or a transfer to a "safe wallet."

6. AI Enabled Phishing

The FBI has warned since at least December 2024 that criminals use AI-generated messages, cloned voices, and synthetic video to make fraud convincing. Good grammar or a familiar face is not proof of authenticity.

Quick Reference: Attack Types and Defenses

Attack	What the attacker wants	Main warning sign	Best defense
Fake website	Credentials or harmful wallet authorization	Slightly wrong URL, unexpected sign-in	Open an independently verified bookmark
Seed phrase theft	Your recovery phrase	A site or person asks you to validate your wallet	Never share it; use only a verified wallet recovery flow
Wallet drainer	A transfer, approval, or delegation	An unexpected claim, mint, or signature	Inspect the request; reject anything you cannot verify
Address poisoning	A misdirected transfer	Unknown tiny deposits in history	Verify the full address, use an address book
Fake support	Trust and access	Unrequested direct message	Contact support only through official sites
AI deepfake	Emotional pressure	Urgent voice or video request for money	Confirm through a second known channel

Step by Step: How to Protect Yourself

Step 1: Lock Down Your Seed Phrase

• Write it on paper or metal and store it offline.
• Never send it to support, enter it into a claim page, or paste it into a chat.
• Only enter it when intentionally setting up or restoring a wallet in verified wallet software or through the hardware maker's documented recovery procedure.
• Never photograph it or save it in ordinary cloud notes.
• For a hardware wallet, follow the manufacturer's device-specific instructions rather than a link in an unsolicited message.

MetaMask's security guidance explains the distinction between legitimate local recovery and requests to disclose your phrase.

Step 2: Use Official Links Only

• Bookmark the exchanges and apps you use and open them from your bookmarks.
• Avoid clicking links in emails, texts, or social media replies.
• Be careful with search ads, which attackers sometimes buy.

Step 3: Read Before You Sign

• Pause on any signature request, especially "Permit," "Approve," or "Set approval for all."
• Use wallet security alerts and transaction previews where available, but do not treat a clean preview as a guarantee. Some signatures authorize future actions rather than an immediate transfer.
• Check the network, recipient or spender, assets, amount, and permission scope. Avoid blind signing when the device cannot show details you can verify.
• If you do not understand a request, reject it.

Step 4: Verify Every Address in Full

• Check the whole address, not just the first and last few characters.
• Save trusted addresses in your wallet's address book or whitelist.
• Never copy a recipient from your transaction history.

Step 5: Separate Your Wallets

• Keep long-term holdings in a hardware wallet with a separate recovery phrase from your everyday wallet, and avoid granting its accounts unnecessary app permissions.
• Use a separate "hot" wallet with small balances for new apps, mints, and airdrops.

Step 6: Review and Revoke Approvals

• Follow your wallet provider's official instructions to inspect approvals on every network you use.
• Revoke permissions you no longer need, especially unnecessarily broad ones. Revocation is an on-chain action and usually requires a network fee.
• Disconnecting a site does not cancel its existing spending approvals. An approval checker also may not reveal an unused off-chain signature or account delegation.

See MetaMask's revocation guide and its explanation of disconnecting versus revoking.

Step 7: Harden Your Accounts

• Prefer phishing-resistant passkeys or security keys where supported. An authenticator app is an alternative, but its codes can still be phished. Never share one-time codes with a caller or support impersonator.
• Use unique passwords stored in a password manager.
• Turn on exchange anti phishing codes and withdrawal whitelists where offered.

What to Do If You Think You Were Phished

Act promptly, but avoid rushed transfers or links offered by strangers. The right response depends on what happened.

1. Stop interacting. Close the suspicious page and reject new requests. If you only connected a wallet, disconnect it and check whether you also signed or approved anything. Connection alone does not prove your keys were stolen.
2. If you exposed a seed phrase or private key, create a genuinely new wallet. Use a trusted, clean device and a new recovery phrase. A new account under the old phrase is not enough. Move remaining assets only if it can be done safely and retire the compromised accounts. If incoming funds disappear immediately, do not keep adding gas money; seek help through your wallet provider's official support. MetaMask's incident guidance explains this risk.
3. If you signed a harmful request, identify its scope. Revoke malicious token or NFT approvals where applicable. Unused Permit signatures and account delegations may need different remediation; ordinary approval revocation is not a universal fix. Do not replenish an affected account until the risk is understood.
4. If you disclosed an exchange password or code, secure the exchange account. Reach it through the official app or saved website, reset exposed credentials, end unauthorized sessions, and contact support.
5. Save evidence and report. Keep addresses, transaction hashes, timestamps, messages, and screenshots. Contact the relevant exchange and local authorities. In the United States, use the FBI's IC3. Freezing or recovering assets is case-dependent and cannot be promised.
6. Watch for a second scam. Ignore unsolicited recovery offers, especially guarantees or requests for advance fees or your recovery phrase.

FAQ

What is crypto phishing in simple terms?

Crypto phishing is a scam where someone pretends to be a trusted source to trick you into revealing your seed phrase, logging into a fake site, or signing a transaction that lets them take your funds.

Can a hardware wallet stop phishing?

A correctly used hardware wallet helps keep private keys off your computer. It cannot make an unsafe approval or transfer safe, and an exposed recovery phrase can bypass its protection. Verify what the device is asking you to authorize.

Will a real exchange or wallet company ever ask for my seed phrase?

Support staff should never ask you to disclose it. Entering a phrase locally in genuine wallet software to restore a wallet is different; only do that deliberately through verified recovery instructions.

Are test transactions enough to prevent address poisoning?

No. A test only confirms the address you used for the test. If you copy a different, poisoned address for the main transfer, the funds still go to the attacker.

Can stolen crypto be recovered?

Sometimes, but there is no guaranteed recovery process. An exchange, token issuer, or law-enforcement investigation may be able to help in a particular case. Report promptly and avoid anyone promising guaranteed recovery for an advance fee.

Related Terms

• Seed Phrase: A list of words that can restore full access to a crypto wallet and must never be shared.
• Wallet Drainer: A malicious toolkit that obtains harmful transfers or permissions and uses them to steal assets.
• Address Poisoning: A scam that plants a lookalike address in your transaction history so you copy it by mistake.
• Token Approval: A permission allowing a designated spender to transfer a particular token up to an approved limit.
• Hardware Wallet: A physical device that stores private keys offline and requires manual confirmation for transactions.

Sources

• Scam Sniffer: 2025 wallet-drainer phishing report, January 3, 2026
• FBI: 2025 IC3 Annual Report
• FBI: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, December 3, 2024
• Carnegie Mellon CyLab: Address-poisoning research and December 2025 incident
• MetaMask: Basic security tips
• MetaMask: Token approvals
• MetaMask: Revoking approvals
• MetaMask: Responding to a compromised wallet
• ERC-2612: Signed token approvals
• Uniswap: Permit2 overview
• EIP-7702: Account code delegation

Sources checked October 16, 2026. This guide is educational and does not guarantee the safety or recovery of funds.