Crypto phishing is a form of attack that tricks you into handing over your keys or signing a malicious transaction by impersonating a trusted website, app, person, or support channel. Unlike a brute-force hack, phishing targets you rather than the technology, and it works because a single convincing message or lookalike page can persuade you to approve something you never intended. Since blockchain transfers cannot be reversed, beating phishing means recognising the deception before you click, connect, or sign.
Key takeaways
- Phishing manipulates you into revealing secrets or approving transactions, not by breaking cryptography.
- Modern attacks often ask you to sign something rather than type a password, which many people underestimate.
- Your seed phrase is never required by any legitimate site, wallet, or support agent.
- Bookmark official sites, read every signing request in full, and use a hardware wallet to confirm what you approve.
How crypto phishing works
Phishing follows a simple formula: create trust, create urgency, and capture an action. The attacker mimics something you recognise, whether an exchange login page, a popular wallet, a project's airdrop announcement, or a support agent, then presents a reason to act right now. That reason might be a security alert, a limited-time reward, or a warning that your funds are at risk. Under pressure, you reveal a secret or approve a transaction, and the funds move.
The defining feature of crypto phishing is that the final step is often a wallet interaction. Instead of stealing a password, the attacker gets you to connect your wallet and sign a request that grants them control of your assets. Because the wallet prompt looks routine, this is where many otherwise careful people are caught.
Common phishing attacks
Fake websites and lookalike domains
Attackers register domains that closely resemble real ones, swapping a letter, adding a word, or using a different extension. The cloned page captures your login or prompts a malicious wallet connection. Search ads and unsolicited links are common delivery routes.
Seed phrase harvesting
A pop-up, email, or "wallet validation" tool claims you must enter your recovery phrase to restore, verify, or secure your wallet. Entering it hands over full control. No legitimate process ever needs your seed phrase.
Malicious signature requests
You connect to a site and are asked to sign a message or approve a transaction. The request may grant unlimited spending permission on your tokens or, in the case of blind signatures, authorise a transfer whose real effect is hidden. This is the mechanism behind many wallet-draining attacks; our guide on token approval risk explains how these permissions work and how to revoke them.
Impersonation and fake support
After you post a question publicly, someone posing as official support messages you, often first, and steers you to a phishing site or asks for your secret. Real support does not initiate contact this way.
Address poisoning
An attacker sends a tiny transaction from an address that looks almost identical to one you use, hoping you later copy it from your history and send funds to the wrong place.
Red flags to watch for
- Any request for your seed phrase or private key. This is always fraud, with no exceptions.
- Unsolicited messages claiming to be support, security, or a surprise airdrop.
- Urgency and fear. "Your account will be locked" or "claim in the next 10 minutes" exist to rush you.
- Slightly wrong URLs. Misspellings, extra words, or unusual domain endings on a page that otherwise looks perfect.
- Signing prompts you did not initiate, or ones requesting broad or unlimited spending approval.
- Links from search ads, DMs, or comments instead of your own bookmarks.
- Copied addresses that don't match the start and end characters you expect.
How to beat phishing
Defeating phishing is about routine, not reflexes. Build these habits so that safe behaviour is automatic even when a message is convincing.
- Bookmark official sites and reach them only through your bookmarks, never through ads, emails, or messages.
- Never enter your seed phrase online. Keep it offline, and treat any request for it as instant proof of a scam.
- Read every signing request. Understand exactly what a transaction does before approving. If it asks for unlimited spending or you cannot tell what it does, reject it.
- Use a hardware wallet so critical actions are confirmed on a separate screen that shows the real details, defeating many blind-signature attacks.
- Verify addresses fully. Check the whole address, not just the first and last few characters, and re-enter or re-scan rather than copying from transaction history.
- Enable strong two-factor authentication on exchange and email accounts, preferably an authenticator app or security key rather than SMS.
- Compartmentalise. Keep long-term holdings in a wallet you never connect to new sites, and use a small separate wallet for experiments.
Phishing rarely arrives alone; it overlaps with fake platforms and impersonation, so it helps to also understand how to avoid crypto scams generally. You will find more defensive walkthroughs across our guides.
What to do if you fall for a phishing attack
If you suspect you have signed a malicious request or exposed a secret, act immediately. Revoke any token approvals you granted to the suspicious contract using a reputable approval-management tool. If your seed phrase may be compromised, move your remaining assets to a brand-new wallet with a fresh phrase as fast as possible, since a leaked seed means every asset is at risk. Change passwords and strengthen two-factor authentication on connected accounts, especially email. Finally, record the addresses and transaction hashes, report the incident, and stay alert for follow-up "fund recovery" offers, which are themselves scams preying on victims.
It is worth remembering that phishing constantly evolves in surface detail while staying identical underneath. The specific story changes, a new airdrop, a fresh "security upgrade," a different impersonated brand, but the underlying request is always the same: reveal a secret or approve something now. Because the pattern is stable even when the packaging is novel, you do not need to recognise every new variant. You only need to recognise the shape: unsolicited contact, manufactured urgency, and a push toward a secret or a signature.
The cryptography behind your wallet is extremely hard to break, so attackers go after the person instead. That is the good news: with a bookmarked-only routine, a habit of reading every signature, and a hardware wallet standing between you and any transfer, phishing loses almost all of its power.
