Phishing (Crypto)

How It Works

Crypto phishing attacks use multiple vectors to reach victims. The most common include fake websites that mimic real DeFi protocols or exchanges, malicious links shared via Telegram, Discord, Twitter, or email, and counterfeit wallet pop-ups that request seed phrase entry. Advanced phishing attacks may use compromised DNS records to redirect traffic from legitimate domains to attacker-controlled servers.

A particularly dangerous variant is transaction phishing, where a victim is tricked into signing a seemingly harmless transaction that actually grants the attacker token approvals or transfers assets. Modern phishing sites often present a realistic-looking swap or claim interface, but the underlying transaction data contains malicious contract calls. Once signed, these transactions are irreversible.

Phishing campaigns in crypto are highly targeted and timely. Attackers monitor project announcements and immediately create fake airdrop claim sites, fake customer support accounts, and fraudulent migration portals within minutes of a legitimate announcement.

Why It Matters

Phishing is the single largest cause of individual crypto losses, exceeding even smart contract exploits in total value stolen. Unlike protocol hacks that may be partially recovered through governance votes or insurance, phished funds are almost never returned because they are immediately laundered through mixers and cross-chain bridges.

Even experienced traders fall victim to sophisticated phishing. Bookmark legitimate sites, verify URLs character by character, never enter your seed phrase on any website, and use hardware wallets that display transaction details on a trusted screen before signing. Treat every unsolicited DM, email, or link as potentially malicious.

Real-World Example

A trader receives a Discord DM appearing to be from a popular NFT project, claiming they won a whitelist spot. The link leads to a site that looks identical to the project's official minting page. When the trader clicks "Mint," their wallet prompts a transaction — but instead of a mint function, the transaction calls setApprovalForAll, granting the attacker permission to transfer all NFTs from the victim's wallet. Within seconds, the attacker sweeps every valuable NFT and lists them for sale.