Phishing attacks in crypto: how they work and how to stay safe

Phishing is a scam in which an attacker impersonates a company or person you trust and persuades you to hand over information or approve a transaction with your own hands. In crypto the target is usually your exchange login, your wallet's recovery phrase or a signature from your wallet; once any of these is in the wrong hands, your funds can be drained within minutes.

In banking, a mistaken transfer can sometimes be reversed. A confirmed blockchain transfer cannot. That is why the best defense against phishing is a set of habits that kick in before the moment you act.

How phishing works

Every phishing attack has three parts:

1. The bait: a message designed to make you act. "Suspicious login detected on your account", "your withdrawal is on hold" or "your reward expires in 24 hours".
2. The hook: a page, form or app screen that looks almost exactly like the real one.
3. The harvest: the password, verification code or recovery phrase you type, or the signature you approve. The attacker uses it immediately.

These messages rely on psychological pressure. The four most common levers are urgency (act now or lose out), fear (your account will be closed), reward (free tokens, a bonus) and authority (the exchange security team, an official agency). If a message pulls two of these levers at once, that alone is reason enough to stop and think.

The economics of the attack are revealing too. Suppose an email goes out to 100,000 people. If just 1% click the link and 5% of those enter their details, 50 people fall into the trap. Because sending costs almost nothing, it does not matter to the attacker that most recipients are not fooled.

The many faces of crypto phishing

Attacks arrive through different channels:

• Email and SMS: notifications that appear to come from an exchange or wallet provider. The SMS version is sometimes called smishing.
• Search engine ads: when you search for an exchange or wallet by name, the paid result at the top may lead to a fake site.
• Social media and chat groups: an "announcement" is posted from a hijacked project account, or someone offers "support" in a private message.
• Lookalike domains: addresses with one or two characters changed, such as "examp1eexchange.com" or "exampleexchagne.com" instead of "exampleexchange.com".
• Fake wallet connection pages: pages that ask you not for a password but for a signature from your wallet.

The last type is specific to crypto and especially sneaky. Some signatures give a smart contract permission to spend your tokens. A smart contract is a program that runs on its own on the blockchain, and the permission you grant stays valid after you leave the site. If you cannot understand what a signing screen is asking you to approve, rejecting it is the safest choice.

Fake support accounts, address poisoning and malware that swaps a copied address are close relatives of phishing; each is broad enough to deserve its own article.

Reading an address correctly

Most fake sites exploit the way we skim domain names. A few rules help:

• The real domain is the part right before the extension. In "exampleexchange.com.login-verify.net" the site is actually "login-verify.net"; the "exampleexchange.com" at the front is just a subdomain.
• Watch for lookalike characters. The pair "rn" can pass for "m" at a glance, and in many fonts a capital "I" is indistinguishable from a lowercase "l".
• Letters from other alphabets can be used. The Cyrillic "а" looks identical to the Latin "a". Browsers sometimes display such addresses in a form beginning with "xn--"; be careful when you see one.
• The padlock is not a certificate of trust. It only shows that the connection is encrypted, not who owns the site. Fake sites use encrypted connections just as easily.

The most reliable method is to verify the pages of the exchanges and wallets you use once, save them as bookmarks and always log in through those bookmarks. Never clicking links in messages removes most of the burden of checking addresses.

Habits that protect you

A recovery phrase is only ever entered into the wallet software or device itself, when restoring a wallet. There is no legitimate reason for a web page to ask for it.

Two-factor authentication (2FA) is an important layer, but it does not stop every phishing attempt. If a fake page relays the code you type to the real site in real time, the attacker can open a session. Hardware security keys that check the domain are more resistant to this kind of relay, because they do not work on a fake domain.

Separating your funds also limits the damage. If the wallet you use for everyday transactions holds only what you need, a single bad signature cannot wipe out all your savings.

If you have been caught

Act quickly and in order:

1. If you shared your recovery phrase, treat that wallet as lost. Create a new wallet and move any remaining funds there immediately.
2. If you entered your exchange password, change it and your 2FA, log out of all open sessions and check your withdrawal address list.
3. If you approved a signature, revoke the spending permissions you granted from your wallet's permission management screen.
4. Contact the exchange only through its official app or the site you saved as a bookmark.
5. Do not send money to anyone who promises to "recover your losses". Such offers are usually a second scam.

Key takeaways

• Phishing impersonates an organization you trust to obtain your password, recovery phrase or signature.
• Urgency, fear, reward and authority are the most common pressure tools.
• The real domain is the part right before the extension; a padlock does not prove a site is genuine.
• Using bookmarks, never typing your recovery phrase into a website and rejecting signatures you do not understand are the most effective habits.
• If you are caught, move your funds to a new wallet and revoke permissions first.