What is phishing in crypto?

Phishing in crypto is a scam in which criminals pretend to be a trusted company, person or authority to trick you into giving away your login details, two-factor codes or seed phrase, or into signing a transaction that empties your wallet. Because cryptocurrency transfers can’t be reversed, a single click on a fake link can cost you everything you hold.

What is phishing in crypto, and why it works

Phishing is social engineering: the scammer doesn’t hack the blockchain, they hack you. They send a message that looks official, create a sense of urgency, and lead you to a fake website, fake app or fake support agent where you hand over sensitive information yourself.

Cryptocurrency is a favourite target for fraud for three reasons. Transactions are final, so there is no bank to call back a cryptocurrency transaction. Stolen funds can move across borders in minutes. And whoever holds your seed phrase or private keys fully controls your cryptocurrency assets, with no password reset.

How crypto phishing scams work

Most crypto phishing scams follow the same path from lure to theft:

1. The lure. An email, text, social media message or search ad warns that your account is locked, a withdrawal is pending, or you’ve won an airdrop.
2. The urgency. “Act within 24 hours or lose access.” Pressure stops you from checking.
3. The fake page. A link takes you to fake websites that copy the real login page, often on lookalike domain names such as an extra letter or a different ending.
4. The theft. You enter your password and 2FA code, type in your seed phrase, or connect your wallet and approve a request. The scammer uses it within seconds.

An example in euros

Say you hold €3,000 of crypto on an exchange. You get a text: “Unusual login detected, verify your account”. The link opens a perfect copy of the login page. You enter your email, password and the 2FA code from your app. The scammer logs in to the real exchange at the same moment and withdraws all €3,000 to their own wallet address. Withdrawal address whitelisting, a delay on new addresses, or a hardware security key would have stopped this attack.

What attackers want

Scammers want one of four things: your exchange login and one-time codes, your seed phrase or private keys, your signature on a malicious transaction, or you to send cryptocurrency to them directly. A real exchange or wallet provider never needs your seed phrase, and never asks you to share a 2FA code with a person.

Common cryptocurrency scams linked to phishing

Phishing is the doorway into many wider cryptocurrency scams. One crypto scam often combines several tactics.

Fake websites and fake apps

Fake websites copy exchange branding down to the last pixel, and these phishing sites are pushed through search ads, social media and messages. Fake apps imitate popular wallets, sometimes even in the Apple App Store or Google Play Store for a while. Always check the developer name and type the official address yourself.

Impersonation scams

In impersonation scams, scammers impersonate your exchange’s support team, your bank, a wallet maker or a government agency. They call, email, reply to your posts on social media or message you on messaging apps about a “security problem” and ask you to move funds to a “safe” wallet. Leaked customer data makes this convincing: after a 2020 data leak at hardware wallet maker Ledger, customers received phishing emails and even fake devices by post.

In the EU, watch for emails claiming you must “re-verify for MiCA” or share wallet data with tax authorities. Real requests appear inside your exchange account, not through links in emails.

Investment scams, fake investment managers and pig butchering

Crypto investment scams use fake trading dashboards that show huge profits. In pig butchering scams, a form of romance scams, a stranger you met on social media or a dating app builds trust over weeks, then steers you to an “investment opportunity” on fake cryptocurrency platforms. When you try to withdraw, a so-called investment manager demands payment of “taxes” or “fees” first, so you lose more money. Other investment fraud uses paid groups that push a coin in a pump and dump. Do your own research, check the platform’s licence, and treat promised fixed high returns and any investment opportunity that sounds too good to be true as red flags.

Crypto ATM scams

Crypto ATM scams target people who don’t own crypto. A caller posing as the police, a utility company or a bank tells you to take money from your bank account, convert cash at a cryptocurrency kiosk and send it to a QR code they provide. No real authority asks for cryptocurrency payments this way.

Crypto wallet drainers

A wallet drainer is a phishing tool that empties a self-custody wallet once you connect it and approve a request. Drainers hide behind fake airdrops, fake NFT mints and copied DeFi sites. The dangerous part is the approval: a single signature can give a smart contract permission to move all tokens of a certain type, now and later.

Fake giveaways, browser extensions and other drainer tricks

Giveaway scams promise to double any cryptocurrency you send, or offer tokens if you connect your wallet. Fake giveaways often run on hacked or lookalike social media accounts of well-known people and companies. Watch for these drainer tricks:

• Malicious approvals. “Approve”, “Permit” or “SetApprovalForAll” requests on a site you don’t fully trust.
• Fake browser extensions. Lookalike wallet extensions that steal your seed phrase when you “restore” your wallet.
• Address poisoning. Scammers send you a tiny transaction from an address that looks like one you use, hoping you copy it from your history next time.

Review and revoke old token approvals regularly, for example with the token approval checker on Etherscan.

How to spot crypto scams and avoid phishing

Our security best practices guide goes further, including device updates and removing browser extensions you don’t recognise.

What to do if you fall victim

If you clicked a phishing link or think you have been scammed, act fast:

• Stop talking to the scammer and don’t send more money.
• Contact your exchange through official channels, such as its app. It can lock your account and sometimes freeze stolen funds that land on a regulated platform.
• Move remaining assets to a new wallet with a new seed phrase if your seed phrase or device may be compromised.
• Save evidence: wallet addresses, transaction hashes, screenshots and messages.
• Report it to your local police and, where relevant, your national regulator, such as the AFM or BaFin. In the Netherlands you can also contact the Fraudehelpdesk.

Be wary of anyone who promises to recover stolen funds for a fee. Recovery scams target victims a second time.

How financial institutions and exchanges fight crypto fraud

Financial institutions and crypto exchanges are a second line of defence. Some banks show warnings or add checks before a first payment to a crypto platform. Licensed cryptocurrency exchanges in the EU must monitor transactions, can block withdrawals to known scam addresses, and can freeze stolen cryptocurrency that arrives on their platform. Blockchain analytics firms help police trace fraudulent schemes across other countries. None of this replaces your own caution: once your digital asset leaves your wallet, it is usually gone.

Crypto phishing scams: key takeaways

Phishing is manipulation first and theft second. Never share your seed phrase, check every website and request independently, and treat urgency as a warning sign. Even with perfect security, crypto-assets are volatile and can lose all their value, so only invest money you can afford to lose.

Related terms

• Scam
• Security
• Seed phrase
• 2FA
• Private key