Crypto Gloss

Crypto Phishing

Crypto phishing is a form of social engineering that uses deception to steal cryptocurrency or obtain control over a wallet. Attackers may impersonate a wallet team, exchange, project, friend, or support agent; send victims to a fake site; or trick them into revealing a recovery phrase or approving an action they do not understand. The term covers several methods, and not every wallet loss or suspicious transaction is phishing.

Common Attack Paths

Recovery-phrase and fake-support scams

A scammer may claim that a wallet needs to be verified, migrated, recovered, or protected, then ask for a secret recovery phrase or private key. Anyone who obtains that secret can control the wallet. A legitimate support agent should not ask a user to reveal it. Some attackers instead ask victims to install remote-access software or share a screen, which can expose credentials or let the attacker manipulate what the victim sees.

Fake websites and compromised accounts

Lookalike domains, search advertisements, fake airdrop pages, and cloned applications can imitate a real service. A legitimate project’s social account can also be compromised and used to distribute malicious links. The visual design or account name is not proof that a page is genuine; the domain and the requested wallet action matter.

Malicious approvals and signatures

Some sites ask a user to sign a transaction or typed-data message that authorizes token spending, an NFT transfer, or another action. An on-chain ERC-20 approve call is different from an off-chain permit signature: the former is a transaction submitted to the network, while standards such as ERC-2612 let a token holder sign an approval message that another party can submit. Permit2 uses signature-based permissions for compatible flows. The scope, spender, token, amount, and expiration depend on the specific request; a signature is not automatically harmless just because it costs no gas to sign.

Address poisoning and payment redirection

Address poisoning relies on a lookalike address appearing in transaction history or other wallet activity so a user may copy it by mistake. It does not normally reveal a recovery phrase or grant an attacker wallet access by itself; the loss occurs if a victim sends funds to the wrong address. Similar impersonation can redirect a payment or replace a recipient address in a message.

Approval Phishing and Wallet Drainers

A wallet drainer is a tool or contract flow designed to move assets out of a connected wallet after a user signs a deceptive request. It is a common label for several techniques, not one single contract type. A malicious request might ask for an on-chain token allowance, an NFT operator approval, a permit signature, a transfer, or a batch of actions. Some authorizations are limited by token, amount, nonce, or time; others can be broader. The wallet prompt and the exact signed data determine what permission is being granted.

Connecting a wallet to a site, on its own, does not hand over the private key. Risk rises when the user shares a secret, signs a harmful message, approves a malicious contract, sends assets, or uses a compromised device. A hardware wallet can protect a private key from being copied, but it cannot make a harmful transaction safe if the user approves it.

Warning Signs and Safer Habits

  • Do not share a recovery phrase or private key with a person, website, or support account.
  • Open important services from a saved bookmark or a verified project link; inspect the domain after redirects.
  • Read the wallet prompt. Check the network, recipient or spender, asset, amount, and permission being requested. Reject a request you cannot explain.
  • When an app supports it, set an allowance only for the amount and period needed. Avoid broad permissions when a narrower one will work.
  • Use a separate wallet for unfamiliar applications and keep only the funds needed for that activity there.
  • Treat security scanners, audits, community endorsements, and hardware wallets as risk-reduction tools, not guarantees.

What to Do After a Suspicious Interaction

If a user shared a recovery phrase or private key, revoking token approvals alone will not secure that wallet; the secret should be treated as exposed, and remaining assets may need to be moved to a newly created wallet using a clean device. If the user signed an approval, a reputable chain-specific explorer or approval manager may show whether that permission can be revoked. Revocation requires a valid transaction and network fee, does not undo transfers already completed, and does not fix malware or a compromised recovery phrase. Use independently verified tools and beware of anyone promising to recover stolen funds for an upfront payment.

Common Misconceptions

  • “A wallet connection instantly drains funds.” A connection usually exposes public wallet information; a harmful signature, approval, transaction, exposed secret, or device compromise is a separate step.
  • “Every signature gives the same permission.” Signatures can authorize different actions. Their meaning depends on the message format, contract, chain, and values shown in the request.
  • “Revoking an approval recovers stolen funds.” Revocation can stop some future uses of a permission, but cannot reverse a completed transfer.
  • “A hardware wallet prevents phishing.” It helps protect the key, but a user can still approve a malicious request on the device.

Criticisms

Wallet prompts often show technical data that is difficult to interpret, and legitimate applications also need users to approve transactions and permissions. This makes it hard to distinguish a normal request from a malicious one, especially across different chains and signing standards. Security tools can help explain or flag a request, but they can miss new scams or produce false alarms; clear transaction details and careful domain checks remain important.

Social Media Sentiment

In a July 9, 2026 r/CryptoCurrency discussion about a reported approval-phishing loss, commenters focused on token permissions, wallet safety, and the limits of advice such as routinely revoking approvals or using cold storage. The post cites a reported incident; its comments are an anecdotal reaction to that case, not a survey or a measure of broader crypto-user opinion.

Last updated: 2026-10

Related Terms

See Also

Sources