What is phishing?

A scam that tricks you into revealing keys or approving a transaction by impersonating an exchange, a wallet, or a support agent.

Phishing is the most common way individuals lose crypto. No legitimate service asks for your seed phrase, and the usual delivery routes are email, search ads, and unsolicited direct messages.

The mental model most people carry is out of date. Classic phishing wanted your password. Crypto phishing increasingly wants a signature: you keep your keys, you type nothing secret, and you still lose the balance because you approved a transaction whose meaning you could not read. That variant is a wallet drainer, and it defeats the advice to simply never share your seed phrase.

How it works

There are three broad routes, and defenses that stop one do nothing about the others.

1. Credential capture. A cloned login page harvests your exchange password and, if the site is proxying in real time, the one-time code as well. This is why an app-based two factor authentication code is weaker than a passkey or a hardware security key, which will not authenticate to the wrong domain.
2. Seed extraction. A fake support agent or a fake wallet recovery flow asks you to enter your twelve or twenty-four words. Anyone who receives them controls the wallet immediately and permanently.
3. Malicious signature. You connect a wallet to a site and approve what looks like a routine action. The signature actually grants a spending allowance over your tokens or transfers them outright. See token approval and blind signing.

Delivery is mundane: a search advertisement above the real result, a reply in a support channel within seconds of a public complaint, a direct message about an airdrop, an email that matches the real one because the sender copied it.

Example

You search for a wallet's website and click the first result, which is a paid advertisement pointing at a lookalike domain. The site loads a real-looking interface and asks you to connect and then "verify" your wallet. The prompt you sign is an unlimited approval on a stablecoin. Nothing appears to happen and no funds move that minute.

Two days later the balance is gone. Reviewing the transaction on a block explorer shows a transfer executed by a contract you approved, not by you. The approval, not the transfer, was the moment you could have stopped it, and revoking it afterwards changes nothing about tokens already taken.

Why it matters when you buy

The step after buying is where most losses happen: the withdrawal, the first wallet connection, the first token approval. Getting that sequence right is worth more than any fee saving, and moving crypto off an exchange and how to spot a crypto scam walk through it. Where you keep an account, a withdrawal whitelist limits what a compromised login can do.

Related terms

wallet drainer — the signature-based version; token approval — the permission that gets abused; seed phrase — never enter it anywhere; two factor authentication — weaker than a hardware key; withdrawal whitelist — limits damage from a stolen login; blind signing — approving what you cannot read.

Questions

Can a phishing site steal my crypto without my seed phrase?

Yes. If you approve a transaction or a spending allowance, the site never needs your keys. This is now the more common route, and it is why "I never shared my seed phrase" is not proof you are safe.

Is two-factor authentication enough?

It helps and it is not sufficient. A real-time proxy site can relay a one-time code within its validity window. A passkey or hardware security key is bound to the real domain and will not authenticate to a lookalike.

Someone from support messaged me first. Is that normal?

No. Exchanges and wallet makers do not open unsolicited direct messages, and they never ask for a recovery phrase. Treat first contact from support as an attack regardless of how convincing the profile looks.