What Is Phishing in Crypto? How Attacks Work and How to Stay Safe
Educational content · reviewed for accuracy · not financial advice
Crypto phishing is a social engineering attack designed to trick you into handing over your seed phrase, private key, or a transaction approval that drains your wallet. Unlike traditional phishing, where the worst outcome is a compromised email account, crypto phishing often results in immediate and irreversible total loss of funds. The main defences are: never entering your seed phrase online, verifying URLs manually before connecting a wallet, and reading every transaction before signing.
On this pagetoggle
What Is Crypto Phishing?
Phishing is the practice of impersonating a trusted entity to trick someone into handing over sensitive credentials or taking an action that benefits the attacker. The term originally referred to email scams targeting bank accounts. In crypto, it has expanded into a category of attacks specifically targeting wallet credentials and transaction approvals — with consequences that are often more severe because crypto transactions are irreversible.
A successful crypto phishing attack typically ends in one of two outcomes: the victim reveals their seed phrase or private key (giving the attacker complete control over their wallet), or the victim signs a malicious transaction (giving the attacker permission to drain specific assets). In both cases, the theft happens within seconds of the attacker getting what they need. There is no fraud prevention window, no charge-back, no reversal.
The scale is significant. Chainalysis reported over $1 billion in stolen crypto attributable to phishing and social engineering in 2023. Security firms track hundreds of active phishing sites targeting major wallets at any given time.
The Main Types of Crypto Phishing Attacks
Seed Phrase / Private Key Phishing
The most direct form: you are presented with a fake interface that asks for your seed phrase or private key. The interface might look like your wallet's recovery screen, an exchange login with a second step, or a customer support chat.
Common delivery methods:
- Fake "wallet compromise" emails warning that your account has been flagged and you need to verify by entering your phrase
- Fake wallet apps downloaded from third-party stores or promoted through search ads
- Social media DMs from fake "support" accounts responding to public posts about wallet issues
- Fake browser extension updates that pop up a seed phrase prompt
Why it works: The interfaces are pixel-perfect copies of real wallets. The scenarios are plausible (accounts do get flagged; wallets do need recovery). The urgency ("your funds may be at risk — act now") bypasses careful thinking.
The rule that stops all of them: Your seed phrase does not need to be entered online for any legitimate purpose. If an interface is asking for it, stop immediately. The interface is fake or compromised.
Approval Phishing (Drainer Attacks)
This is more sophisticated and increasingly common. Instead of stealing your seed phrase, the attacker tricks you into signing a real transaction that grants them permission to move your tokens.
The key transaction is typically 'approve' or 'setApprovalForAll' — Ethereum functions that authorise another address to transfer your ERC-20 tokens or NFTs. The attacker's contract is the authorised address. Once you sign, they can drain your approved tokens at any time — immediately, or days later.
Common delivery methods:
- Fake airdrop claims: "You have received X tokens — connect your wallet and approve to claim"
- Fake NFT mints: a counterfeit site for a popular collection, where the mint transaction is actually an approval
- Compromised websites: legitimate sites that were hacked and had their wallet connection scripts replaced
- Discord servers with malicious links in "announcement" channels (often from compromised accounts)
How to protect yourself: Read every transaction before signing. In MetaMask, look at the "Function" field. Any transaction requesting 'setApprovalForAll' from an unfamiliar contract should be rejected immediately. Regularly audit and revoke existing approvals using a tool like Revoke.cash — many wallets accumulate unnecessary approvals from past interactions.
URL Spoofing (Homograph Attacks)
The attacker registers a domain that looks visually identical to the real one. Techniques include:
- Using characters from other alphabets that look like Latin letters (Cyrillic 'а' looks like Latin 'a')
- Adding or removing characters: metamask.io vs metamasks.io, coinbasse.com vs coinbase.com
- Using subdomains: coinbase.support.fakephishing.com
- Adding hyphens: meta-mask.io
Search engines occasionally display paid ads for phishing sites above legitimate results. Users searching "MetaMask download" have clicked ads and downloaded malware.
Check: Bookmark every site you use regularly. Navigate from bookmarks, not from emails, DMs, or search results. Before connecting a wallet or entering any credentials, look at the full URL in the address bar character by character.
Email Phishing
You receive an email appearing to be from Coinbase, Ledger, MetaMask, Binance, or another major service. The subject line suggests urgency: "Suspicious login detected", "Account action required", "Your withdrawal is pending approval."
The email links to a spoofed site designed to capture your login credentials or seed phrase. The sender address often looks legitimate at a glance — but contains a subtle modification ([email protected] rather than [email protected]).
Check: Look at the sender address in full. Do not click links in any crypto-related email. Navigate directly to the service's official site from a bookmark and check for any genuine alerts there. Most major exchanges send authenticated emails — look for the authentication header, but do not rely on it exclusively.
Social Engineering via "Support"
You post in a public forum, Discord, or Telegram about a problem you are having with your wallet or an exchange. Within minutes, accounts posing as official support staff respond — often with usernames nearly identical to the real support team.
They ask you to go to a specific URL, share your screen, or provide your seed phrase "for verification." None of these are legitimate support procedures.
Check: Official support for any major platform does not operate through DMs you did not initiate. Verify any support channel against the official website. How to keep your crypto safe covers the full security posture for wallet protection.
The Practical Habits That Prevent Phishing
These are not technical skills — they are simple habits that eliminate the vast majority of phishing risk:
1. The seed phrase rule. Never enter your seed phrase on any website or in any app, for any reason, in any scenario. It is never required for legitimate recovery, support, or verification online. Write it down and store it physically offline.
2. The bookmark habit. Only access exchanges, wallets, and DeFi protocols through bookmarks you set yourself. Never navigate from an email link or a search result to a site where you will enter credentials or connect a wallet.
3. The transaction read habit. Read every wallet transaction prompt before signing. Check the function name, the contract address you are approving, and the amount. If you do not understand what the transaction does, do not sign it.
4. The private key ownership rule. Your private key is the master credential for your wallet. No exchange, no support agent, no wallet company, and no developer ever needs it. Anyone asking for it is attempting theft.
5. Approval audits. Periodically review and revoke unnecessary token approvals. A wallet can accumulate dozens of approvals over years of DeFi use — each is a potential attack surface if the approved contract is later exploited.
6. Separate hot wallets for DeFi. Keep the majority of your holdings in a cold storage wallet (hardware wallet or an address that never connects to dApps). Use a separate hot wallet with only the funds needed for active DeFi interactions.
What to Do If You Think You Have Been Phished
If you entered your seed phrase on a phishing site, act immediately:
- Open your legitimate wallet interface on a clean device.
- Transfer all assets to a new wallet address (one generated fresh on a clean device) as quickly as possible.
- Do not use any assets until the transfer is complete — the attacker's bot may already be monitoring the compromised wallet.
- Report the phishing URL to your browser's Safe Browsing system (Google Safe Browsing for Chrome/Firefox) so it gets flagged for other users.
- Report to the FTC, FBI IC3, or relevant authority in your jurisdiction.
If you signed a malicious approval, revoke it immediately on Revoke.cash — if the attacker has not already used it, you may still be in time.
You can also track crypto prices live to check whether any assets you hold have been affected by broader market movements versus a direct wallet compromise.
This article is for educational purposes only and does not constitute financial, legal, or investment advice. If you believe you have been the victim of a crypto phishing attack, contact your relevant law enforcement authority and the platform involved. Cryptocurrency losses from phishing are generally unrecoverable.
Frequently asked questions
What is approval phishing in crypto?+
Approval phishing tricks you into signing a real transaction — typically an 'approve' or 'setApprovalForAll' call — that grants a malicious contract permission to transfer your tokens or NFTs. Unlike seed phrase phishing, you do not give up your credentials; instead, you authorise the attacker's contract to move specific assets from your wallet. The authorisation persists until you revoke it.
How do phishing sites get found by victims?+
Phishing sites are spread through search engine ads (sometimes ranked above legitimate results), malicious links in Discord and Telegram, emails impersonating legitimate services, and social media posts. Some attacks also compromise legitimate websites and inject malicious connection scripts, so even bookmarked sites can occasionally serve malicious content after a compromise.
Can a hardware wallet protect against phishing?+
A hardware wallet protects your private key from software-based attacks — malware cannot extract the key from the device. However, it does not protect against phishing attacks where you physically approve a malicious transaction on the device. If you are tricked into signing an approval or a transfer on your hardware wallet screen, the attack succeeds. Always read what you are signing, even on a hardware wallet.
What should I do immediately after entering my seed phrase on a phishing site?+
Act immediately: generate a completely new wallet on a clean, uncompromised device. Then transfer all your assets to that new wallet as fast as possible, because the attacker may already be watching the compromised wallet with automated bots ready to drain it. Do not assume the attacker has not seen your phrase yet — assume they have and race to move your funds.
How do I know if a crypto website is fake?+
Check the full URL character by character in your browser address bar — look for subtle misspellings, added hyphens, or subdomains. Do not trust a padlock icon alone (phishing sites can have valid HTTPS). Do not navigate to the site from an email or DM link. If you are not 100% certain the URL is correct, navigate from a bookmark you set yourself by visiting the official site through a search result you verified previously.
Our editorial team covers cryptocurrency market data, on-chain metrics and beginner education. Every guide is fact-checked against live market data from CoinMarketCap and Binance and reviewed for accuracy. Content is educational only and not financial advice. Learn about our data & methodology →
Track the market live
Real-time prices, market cap and trends for the top 100 coins.