Crypto Phishing Scams Explained (And How to Spot Them)

Phishing is the oldest trick in the online-crime book, and crypto has made it more profitable than ever. Instead of stealing a credit-card number that a bank can refund, a phishing scammer aims for your seed phrase or a wallet approval — and once those are gone, the money is gone for good. This guide shows you exactly how crypto phishing works and how to defend against it.

How phishing works

A phishing attack impersonates something you trust — an exchange, a wallet, a popular project — to get you to act. The message usually arrives by email, text, social media DM, or a sponsored search result, and it carries a link to a fake site that looks almost identical to the real one.

Once you're on the fake site, one of two things happens. Either you type in your login details or seed phrase and hand them straight to the attacker, or you connect your wallet and approve a transaction that quietly drains your funds. The second type — a 'wallet drainer' — is now the most common and the most dangerous.

• Fake login pages harvest your username and password.
• Fake seed-phrase prompts ask you to 'restore' or 'validate' your wallet.
• Malicious approvals trick you into signing a transaction that gives the attacker permission to move your tokens.

Red flags to watch for

Phishing relies on you reacting quickly instead of checking carefully. These signals should make you stop:

• Urgency: 'Your account will be locked', 'Verify within 24 hours', 'Suspicious login detected'.
• A link whose address is subtly wrong — an extra letter, a different ending, or a hyphen that shouldn't be there.
• Any request for your seed phrase, private key, or full password.
• Unexpected 'airdrop', 'refund' or 'reward' messages with a claim link.
• A wallet pop-up asking you to approve something you didn't initiate.

How to defend yourself

Good habits beat clever attacks. Build these into your routine and most phishing simply bounces off you:

• Type addresses yourself or use your own bookmarks. Never reach an exchange or wallet through an email link or search ad.
• Check the URL character by character before connecting a wallet or logging in.
• Turn on app-based two-factor authentication so a stolen password alone isn't enough.
• Review wallet approvals and revoke ones you no longer use with a trusted approval-checker tool.
• Slow down. Legitimate services don't punish you for taking five minutes to verify.

If you think you've been phished

Act fast. If you entered an exchange password, change it immediately and enable two-factor authentication. If you connected a wallet, move any remaining funds to a fresh wallet with a brand-new seed phrase and revoke the malicious approval. If you typed your seed phrase into a site, assume that wallet is compromised forever — create a new one and never reuse the old phrase.

Then learn the wider pattern in our guide to avoiding crypto scams, and read about fake support scams, which often follow a phishing attempt.

Frequently asked questions