Crypto wallet phishing: how to protect yourself

A well-configured cryptocurrency wallet is hard to break into by brute force. That is why most thefts do not attack the technology. They attack the person using the wallet. This is called phishing: messages, websites or apps that pose as something trustworthy to get the victim to hand over data or take an action.

The US cybersecurity agency (CISA) defines phishing as a form of social engineering in which the attacker uses malicious email or websites, pretending to be a trustworthy organization, to obtain personal information (CISA). With digital wallets, the scam takes on its own forms. This article describes the best-documented techniques and what reduces the risk of each.

What the scammer wants from you

In wallets where you control the keys, phishing usually goes after one of three things:

• Your seed phrase. The 12 to 24 words that recreate the wallet on any device. With them, the scammer takes everything. The article how to protect your seed phrase deals with this topic alone.
• Your signature. On networks with smart contracts, such as Ethereum, you sign permissions that let apps move your tokens. A signature given to a malicious contract may be enough to drain the wallet.
• Your transfer. Sometimes the scammer never touches the wallet. They just get you to send the funds to their address, thinking it is someone else’s.

In every case, the result is the same: a valid transaction on the blockchain that cannot be undone. Ethereum.org points out that a sent transaction is irreversible (ethereum.org, Security). If you are not yet familiar with how keys, addresses and the blockchain relate, start with what Bitcoin is and how it works.

The size of the problem

There are no consolidated public Brazilian statistics on crypto wallet phishing. The broadest official data comes from the United States. The annual report of IC3, the FBI’s internet crime complaint center, released in April 2026 with 2025 data, recorded 181,565 complaints involving cryptocurrency, with reported losses of US$ 11.366 billion, up 22% from 2024 (FBI IC3, 2025 report). Of these complaints, 7,164 were classified as phishing or spoofing, with about US$ 111 million in reported losses.

These figures reflect only those who reported to the FBI and mix several types of fraud. They serve as an order of magnitude, not as a measure of individual risk.

Technique 1: fake apps and websites

The most direct scam is to imitate a wallet, an exchange or an investment platform. The fake website or app asks for the seed phrase to “import” the wallet or takes deposits that can never be withdrawn.

An FBI notification from July 2022 described criminals who persuaded investors to download fake cryptocurrency investment apps. The FBI identified 244 victims and estimated losses of US$ 42.7 million. The scammers used the names, logos and details of real companies. When some victims tried to withdraw, they were charged a supposed tax and, even after paying, still could not take their money out (FBI, PIN 20220718-001).

How to protect yourself. Install wallets only from the project’s official website or the operating system’s official store, checking the developer. Be wary of apps recommended by contacts you do not know personally, as the same alert advises. Before opening a wallet or exchange website, type the address yourself or use a saved bookmark, instead of clicking on links you receive or on search ads. Ethereum.org says to always check that you are on the right domain, especially after clicking a link.

Technique 2: airdrops and “free rewards”

An airdrop is the free distribution of tokens to many wallets, sometimes used as marketing. Scammers have copied the format.

In June 2025, the FBI warned about tokens sent to wallets on the Hedera network with a link in the transaction’s memo field. To “claim the reward,” the victim connected the wallet to a website that asked for login details, security information and the seed phrase. The alert also mentions fake airdrop ads on social media and phishing emails (FBI IC3, PSA I-060325).

How to protect yourself. Treat any token that shows up without you asking for it as suspicious. Do not click on links that come with it and do not try to sell or move it through unknown websites. The FBI recommends confirming the offer directly with the provider, through verified channels, before accepting anything.

Technique 3: malicious permissions and signatures

This technique is typical of networks with smart contracts. It does not require the seed phrase.

When you use a decentralized app, it usually asks for an approval: permission for a contract to spend a given token from your wallet. Ethereum.org explains that many projects request unlimited approval and that these permissions do not expire (ethereum.org, revoking access). If the contract is malicious, or is compromised later, it can transfer your tokens whenever it wants.

Theft kits known as drainers exploit exactly this. The fake website looks like a legitimate app, asks you to “connect” your wallet and then presents a signature that, in practice, hands over control of your tokens. Ethereum.org mentions airdrop websites that ask you to approve a transaction that compromises the account.

How to protect yourself.

• Read the transaction message before signing, as ethereum.org advises. If the wallet shows a request you do not understand, reject it.
• Do not grant unlimited allowances. Authorize only the amount needed for that operation.
• Review and revoke old permissions from time to time. Disconnecting your wallet from a website does not remove permissions already granted; they must be revoked, which costs a network fee.
• Use a separate wallet with a small balance to try out new apps. In the newsroom’s assessment, this limits the damage of a wrong signature.

Revoking a permission prevents future use. It does not bring back what has already been taken.

Technique 4: address poisoning

Wallet addresses are long strings of letters and numbers. Many people do not check the full address and copy the destination from their own transaction history. Address poisoning exploits this habit.

According to the CyLab research center at Carnegie Mellon University, the scammer generates an address whose beginning and end match those of an address you have already transacted with and sends you a small amount, or even zero, from it. The fake address then appears in your history. If you later copy from there, the money goes to the scammer (CyLab, January 2026).

The study presented at the 2025 USENIX Security symposium measured two years of transactions on the Ethereum and BNB Smart Chain networks. The authors found 270 million attempts against 17 million victims and at least US$ 83.8 million in losses (Tsuchiya et al., USENIX Security 2025). According to CyLab, only about one attempt in 10,000 succeeds, but the volume makes the scam profitable. On December 19, 2025, the researchers’ tool detected a single successful attack of about US$ 50 million.

Wallets do not always help. An August 2025 study tested 53 popular Ethereum wallets: 16 posed a high risk because they displayed the fake token transfers in the history, and only 3 showed an explicit warning when the user tried to send to a phishing address (Guan and Li, arXiv 2025).

The studies cited deal with Ethereum-compatible networks. The principle, however, applies to any blockchain where you copy addresses from your history.

How to protect yourself.

• Do not copy addresses from your transaction history. Get the address from the original source or from a contact list saved in the wallet.
• Check the entire address, not just the beginning and end. For large amounts, first make a small test transfer and confirm with the recipient through another channel.
• Be wary of tiny or zero-value transfers you were not expecting, as CyLab recommends.

Technique 5: fake support and fake recovery

Scammers pose as support agents for wallets, exchanges and even government agencies. Ethereum.org states that legitimate teams do not communicate through private, unofficial channels, and recommends never sharing keys, phrases or passwords, and never allowing remote access to your computer.

One variant targets people who have already lost money. The IC3 report counted, in 2025, 10,516 complaints of recovery scams, with US$ 1.4 billion in reported losses; the FBI notes that this figure may include losses from the earlier scam. An August 2025 alert describes fake law firms that claim to work with government agencies, know the amounts and dates of the victim’s transfers and charge fees, often in cryptocurrency, to “recover” the funds (FBI IC3, PSA I-081325). The FBI states that no law firm is an official partner of US government agencies.

How to protect yourself. Do not respond to requests for data that you did not initiate. Seek support through the official website, typed in by you. Treat any crypto recovery offer, especially one requiring upfront payment, as likely fraud.

Warning signs in any message

The guide published by CERT.br, Brazil’s computer security incident response center, lists signs that recur in almost every scam: threats, urgency, emotional appeal, requests for secrecy, deals too good to be true, exclusive opportunities and invoking authority (CERT.br, Golpes: Não se Deixe Enganar). The FBI and ethereum.org alerts cited above add crypto-specific signs:

• a request for your seed phrase, password or one-time code in a contact you did not initiate;
• a token or “reward” that arrived without you asking, accompanied by a link;
• a website that asks you to connect your wallet and sign something you do not understand;
• a website address that differs from the official domain, even by a single letter.

CERT.br notes that scammers are increasingly convincing and even use artificial intelligence. Well-written text is not a sign of legitimacy. The guide’s rule applies: be suspicious, get informed, verify.

If you have fallen for a scam

CERT.br advises acting quickly (CERT.br, Caiu? Veja o que Fazer). Adapting the guide’s general recommendations to crypto wallets:

1. Cut off contact with the scammer. Do not send more money or data and do not try to negotiate.
2. If your seed phrase was exposed, create a new wallet with a new phrase and transfer what is left to it. The old phrase cannot be changed.
3. If you signed a suspicious permission, revoke it immediately and move the remaining tokens.
4. If you installed an app or opened a file suggested by the scammer, consider the device compromised. The guide recommends restoring the phone to factory settings or reinstalling the computer.
5. Keep evidence: links, messages, profiles, screenshots, receipts and the transaction addresses and identifiers.
6. File a police report, which in most cases can be done online, and report the profile or ad on the platform where the scam began.
7. If the money left via Pix (Brazil’s instant payment system) to buy crypto from the scammer, dispute the transfer with your bank to trigger the MED, Pix’s Special Return Mechanism. Transfers made directly on the blockchain have no equivalent mechanism.

After that, expect recovery scam attempts and do not pay anyone who promises to bring the funds back.

Key takeaways

• Crypto phishing wants your phrase, your signature or your transfer. Protecting all three is what matters.
• No legitimate support team, airdrop or app asks for your seed phrase. Read what you sign, do not grant unlimited permissions and check the entire address before sending.
• There are no chargebacks on the blockchain. If you fall for a scam, act quickly to save what is left and be wary of anyone promising to recover the rest.