Phishing and Wallet Drainers

Why attackers target wallets

Crypto transfers are generally irreversible and do not need the owner’s name, only a valid signature. Attackers therefore aim to get you to hand over a secret or to sign something yourself. Phishing is the practice of impersonating a trusted party to manipulate you into doing that. A wallet drainer is the kind of malicious tool, usually a website or a smart contract, designed to take assets after the victim approves a request.

This article describes patterns for recognition and defence only. Nothing here is financial or legal advice, and cryptocurrency losses are often unrecoverable.

Pattern one: asking for your seed phrase

The oldest and simplest attack. A message, fake support agent, pop-up or cloned wallet page claims there is a problem such as “wallet validation”, “sync error” or “claim your reward” and asks you to enter your recovery words. Anyone with those words controls the wallet. Legitimate wallets, exchanges and support staff do not need them. The article on private keys and seed phrases explains why they are the master secret.

Pattern two: lookalike websites and fake apps

Attackers register web addresses that resemble real ones, run advertisements that appear above genuine search results, or publish fake browser extensions and mobile apps. The page may look identical to the real one and prompt you to connect your wallet or “restore” it. Warning signs include small spelling differences in the address, an unexpected redirect, an app with few reviews or an unfamiliar publisher, and a link received through a message rather than typed or bookmarked.

Pattern three: malicious approvals and signatures

Many wallet-connected applications ask you to approve actions. Two kinds are worth understanding in plain terms:

• Token approvals. Applications often ask for permission to spend a certain token from your wallet. A malicious site can request an unlimited permission, after which the attacker’s contract can move that token whenever it likes, with no further action by you.
• Signed messages. Some requests are not transfers but off-chain signatures that can later be used to authorize actions. Because they look harmless, people sign them without reading.

A hardware wallet does not stop this, because it faithfully signs what you approve, a point raised in the article on hardware wallets. The practical defense is attention to what the request says before approving, and distrust of any request you did not initiate.

Pattern four: impersonation and social engineering

• Direct messages from “support” after you post a question publicly.
• Fake giveaways or “send one coin and get two back” claims, often using hijacked or fake accounts of well-known people. These match the general pattern described in the article on crypto scams.
• Urgent messages about locked accounts, tax problems or suspicious logins, pushing you to click a link.
• Fake job offers or investment “opportunities” that ask you to install software or connect a wallet.
• Romance or friendship approaches that slowly lead to a fake trading platform.

Common to all is pressure, secrecy and a request that bypasses normal checks.

Pattern five: address tricks

• Address poisoning. An attacker sends a tiny transaction from an address that looks similar to one you use, hoping you later copy it from your history by mistake. Checking the full address, not just the first and last characters, helps.
• Clipboard malware. Software silently replaces a copied address with the attacker’s. Comparing the address on your device screen to the intended one before approving is a defence.
• Wrong network or contract. Sending to the wrong place can be unrecoverable.

Warning signs

• Anything that asks for your seed phrase or private key.
• Unsolicited messages with links, from anyone.
• Offers that are too good to be true, or that require you to act quickly.
• A request to connect a wallet to a site you reached through an advert or message.
• An approval request with unlimited spending permission or confusing wording.
• Support that contacts you first.

Protective habits

1. Bookmark the sites you use and open them from the bookmark.
2. Never share the seed phrase; type it only when restoring your own wallet on a trusted device.
3. Read each approval prompt and reject anything unexpected.
4. Use a separate wallet with a small balance for experiments or unfamiliar applications.
5. Review and revoke old token permissions periodically using the tools provided by your wallet or a block explorer.
6. Use unique passwords, a password manager, and an authenticator app or security key for exchange accounts rather than text-message codes where possible.
7. Keep software updated and install apps only from official sources.
8. Be slow: scammers rely on speed.

If something goes wrong

Acting quickly can sometimes limit damage, though recovery is not guaranteed. People commonly move any remaining funds to a new wallet created on a clean device with a fresh seed phrase, revoke permissions, change passwords on linked accounts, and report the incident to the relevant platform and local authorities. Be careful about “recovery services” that contact you after a loss, because they are a frequent second scam.

Because large thefts also make news and can influence sentiment, they sometimes appear in discussions of security incidents and prices. For an individual, though, the lesson is more direct: the strongest protection is understanding what you are being asked to sign.