A crypto phishing attack tricks you into signing a malicious transaction, approving a drainer contract, or entering your seed phrase on a fake website. Unlike traditional phishing (stealing passwords), crypto phishing often needs just one signed transaction to permanently steal all your assets. There is no change password recovery because blockchain transactions are irreversible.
What Is a Phishing Attack (Crypto-Specific Mechanics)?
3 min read
The short version
Crypto phishing is like someone handing you a document to sign that looks like a routine form but actually signs over the deed to your house. One signature and your assets are gone. The fake site looks identical to the real one. The transaction pop-up looks normal. But hidden in the details is permission for a drainer contract to take everything from your wallet.
How It Works
Common crypto phishing vectors: (1) Fake websites: cloned interfaces of legitimate DeFi sites (uniswop.com instead of uniswap.org). You connect your wallet and sign what looks like a swap but is actually an unlimited token approval to a drainer. (2) Approval phishing: a signed EIP-712 message or setApprovalForAll transaction that grants a malicious address permission to move all your NFTs or tokens. (3) Seed phrase phishing: fake wallet validation sites that ask you to enter your 12/24 words. Once entered, the attacker imports your wallet and drains it within seconds. (4) Airdrop phishing: tokens appear in your wallet uninvited. Interacting with them (trying to sell, clicking links in their metadata) leads to drainer sites. (5) Social engineering: fake support accounts on Discord/Twitter DMing help that leads to malicious sites. The common thread: you are tricked into authorizing something that looks normal but gives an attacker access to your funds.
How a $1.4M NFT collection was drained in one signature
A collector received a DM about a collaboration opportunity linking to what appeared to be a legitimate NFT platform. The site asked them to connect their wallet and sign a message to verify ownership. The message was actually a setApprovalForAll transaction granting a drainer contract permission to transfer all NFTs from their wallet. One signature. Within 30 seconds, a bot transferred 14 high-value NFTs (Bored Apes, Mutant Apes, CryptoPunks) to a new wallet and immediately listed them for sale. Total value drained: approximately $1.4M. The victim's wallet was fully compromised through a single approval they thought was a harmless verification step.
What People Get Wrong
Phishing only happens to beginners
Experienced users, crypto-native developers, and even security researchers have been phished. Sophisticated attacks use legitimate-looking domains, cloned UIs pixel-for-pixel, and social proof (fake engagement, impersonated accounts). Complacency from experience can actually increase vulnerability.
Hardware wallets fully protect against phishing
Hardware wallets prevent key extraction but cannot prevent you from signing a malicious transaction. If you approve a drainer contract on your Ledger (because the transaction looks legitimate), your funds are still gone. The device signs whatever you approve.
You can reverse a phishing transaction
Blockchain transactions are final. Once signed and confirmed, there is no chargeback, no reversal, no customer support. The only post-compromise action is revoking remaining approvals (revoke.cash) to prevent further drainage of assets the attacker has not yet taken.
Keep Reading
Sources & Further Reading
- Revoke.cash
Check and revoke token approvals that could be exploited by drainers
- Pocket Universe
Transaction simulation extension that warns about malicious approvals before you sign
Questions People Also Ask
- How do I protect myself from crypto phishing?
- Bookmark legitimate sites (never click links from DMs or ads). Verify URLs character by character. Use a hardware wallet (still verify what you sign on the device screen). Never enter your seed phrase anywhere online. Revoke unnecessary token approvals periodically at revoke.cash. Be suspicious of any unexpected DM offering help, collaboration, or free money.
- What should I do if I signed a malicious transaction?
- Immediately: (1) Revoke all token approvals from the compromised wallet at revoke.cash. (2) Transfer remaining assets to a NEW wallet (new seed phrase, not a derivation of the compromised one). (3) Do not interact with the compromised wallet again. Speed matters: drainer bots often take minutes to sweep everything.
- Can wallet software detect phishing attempts?
- Some wallets (MetaMask, Rabby) include phishing detection that warns when you visit known malicious sites or sign suspicious transactions. Transaction simulation (showing what will actually happen before you sign) is the most powerful defense. Rabby and Pocket Universe excel at this. But no tool catches everything.