What makes crypto phishing different from regular phishing?

Crypto phishing is more damaging because transactions are irreversible. If a regular bank phishing attack succeeds, the bank can often reverse charges. In crypto, once you sign a malicious transaction or hand over a seed phrase, the funds are gone with no recourse. This irreversibility makes crypto an especially attractive target.

What is approval phishing?

Approval phishing tricks you into signing an ERC-20 token approval transaction, giving a malicious contract unlimited permission to spend a specific token from your wallet. You may think you are doing something harmless (like claiming an airdrop), but the signature grants the attacker's contract the ability to drain your wallet of that token at any time.

Can phishing attacks bypass hardware wallets?

A hardware wallet prevents private key theft but does not prevent approval phishing. If you sign a malicious approval transaction on your hardware wallet — even without knowing it — the approval is valid. Always read the full transaction data on the hardware wallet's screen before confirming.

What is a DNS hijacking attack in crypto?

DNS hijacking replaces a legitimate website's DNS record so that visitors are redirected to an attacker's identical-looking clone. The URL in the browser may look correct but the website is controlled by the attacker. Several major DeFi protocols have been compromised this way.

Security · Phishing

How Crypto Phishing Scams Work

Understanding the mechanics of crypto phishing is the first step to avoiding it. Here are the five most common attack types — with exactly how each works and how to defend against it.

By Ashir Khan3 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated: September 1, 2026

Crypto phishing is uniquely dangerous because transactions are irreversible. Unlike bank fraud, there is no chargeback mechanism and no customer support line that can recover stolen funds.

The five attack types

Seed Phrase Phishing

How it works

Fake wallet websites or apps prompt you to enter your seed phrase to 'restore' or 'verify' your wallet. Once entered, your funds are immediately drained. These sites are often promoted through paid search ads.

Defence

Your seed phrase is never needed by any online service. Never enter it anywhere except on your hardware wallet device itself during initial setup.

Approval Phishing

How it works

You are asked to sign a transaction that appears routine (claiming a reward, minting an NFT) but is actually an ERC-20 approval granting an attacker's contract unlimited spending rights for a token you hold.

Defence

Read every transaction detail before signing. If a site asks you to approve spending of tokens when you just wanted to claim something free, that is a red flag.

DNS Hijacking

How it works

Attackers compromise the DNS records of legitimate DeFi protocols. Users who navigate to the correct URL are served the attacker's clone site. The URL looks legitimate but the site is controlled by attackers.

Defence

Bookmark trusted DeFi sites rather than searching or following links. Check social media for warnings before interacting with a protocol during market volatility when attacks often occur.

Spear Phishing

How it works

Targeted attacks against specific individuals — developers, influencers, or large holders. Attackers impersonate colleagues, investors, or journalists and send tailored messages with malicious links or attachments.

Defence

Verify unexpected contact through a secondary channel. Never open unsolicited attachments. Use a separate air-gapped machine for signing large transactions.

Browser Extension Attacks

How it works

Malicious browser extensions can intercept wallet connection requests, modify transaction data on-the-fly, or read clipboard content to replace addresses. Extensions with broad permissions are dangerous.

Defence

Minimise browser extensions on any browser used for crypto. Use a separate browser profile or dedicated browser solely for Web3 interactions.

Universal anti-phishing habits

Never click crypto-related links from email, Discord, Telegram, or Twitter DMs
Bookmark all sites you use regularly — never search for them
Verify the exact URL character-by-character, including TLD (.com vs .io vs .net)
Read every transaction on your hardware wallet screen before confirming
Never share your seed phrase or private key with anyone or anything