What is a wallet drainer?

A wallet drainer is malicious code or a malicious contract flow that tricks users into approving transactions that transfer assets away.

Are Google ads safe for crypto websites?

Not always. Phishing sites sometimes use paid ads, so users should verify domains directly instead of trusting search placement.

Can phishing happen without giving away my seed phrase?

Yes. Many attacks work by getting you to sign approvals or malicious transactions rather than asking for your seed phrase directly.

What is the safest way to access a protocol?

Use your own bookmarks or typed official URLs from trusted sources, then verify the domain carefully before connecting a wallet.

What should I do after signing something suspicious?

Disconnect, move assets if needed, review approvals immediately, and stop using the compromised wallet for new interactions.

How to Spot Crypto Phishing Attacks and Fake Websites

Phishing Is Operational, Not Theoretical

Most wallet compromises aren't movie-style hacks that break cryptography. They're operational failures: a fake domain, a spoofed support account, a malicious approval, or an urgent message designed to make you click before you think. Phishing targets the human, not the code. The defense is a set of calm, repeatable habits — this guide gives you those.

How Phishing Usually Starts

Search ads leading to fake versions of real protocol websites.
Direct messages claiming "support" can help recover funds or fix an issue.
Fake airdrop pages asking you to connect a wallet and sign.
Email/SMS alerts about "account problems" pushing you to a clone site.
Malicious tokens or NFTs that appear in your wallet with a link to a scam site.

Recognizing Fake Websites

Clones can look pixel-perfect, but details fail under inspection:

Look-alike domains — misspellings, extra words, or odd endings (e.g., "-app", ".xyz" variants).
Suspicious subdomains designed to hide the real domain.
Wallet prompts appear immediately, before any genuine product interaction.
Pressure-driven popups ("claim expires in 5 minutes").
Broken links, missing pages, or slightly-off branding.

Habit: Never reach a dApp through an ad or a link in a message. Type the URL yourself or use a saved bookmark of the verified site.

The Real Danger: Malicious Signatures and Wallet Drainers

Modern phishing rarely asks for your seed phrase directly (though some still try). Instead it tricks you into signing a transaction or approval that lets a contract move your assets — a wallet drainer.

Be extremely cautious with token approvals, especially "unlimited" ones.
Watch for setApprovalForAll requests (common in NFT drains).
Beware blind signature requests (like Permit/Permit2) that don't look like a normal transaction.
If a signature request is unreadable or unexpected, reject it.

Impersonation and Fake Support

Real support teams never DM you first and never ask for your seed phrase.
Scammers monitor public help channels and jump in as "support" via DM.
Verified-looking accounts can be faked or bought — check history and cross-reference official links.
"Recovery services" that promise to retrieve lost funds are almost always secondary scams — see our scam guide.

Red Flags Before You Click or Sign

Did this come from an ad, DM, or unsolicited message? Treat as hostile.
Is there urgency or a deadline? Scams manufacture urgency.
Does the URL exactly match the official domain?
Is a wallet connection or signature requested unusually early?
Do you understand exactly what you're signing? If not, stop.

Habits That Prevent Compromise

Bookmark the dApps you use and only enter through bookmarks.
Use a hardware wallet so signatures require physical confirmation (see our hardware wallet guide).
Keep a burner wallet for airdrops and untrusted mints.
Revoke old token approvals regularly with a reputable revoke tool.
Never enter your seed phrase anywhere online — see our seed phrase guide.
Ignore and never interact with unsolicited tokens/NFTs that appear in your wallet.

If You Think You've Been Phished

Act fast: move remaining assets to a new, secure wallet.
Revoke approvals granted to the malicious contract.
If your seed phrase may be exposed, consider it fully compromised and migrate everything to a freshly generated wallet.
Warn your community and report the scam site where possible.

Final Thoughts

Phishing succeeds by rushing you. Slow down, verify domains yourself, read every signature request, and route risky activity through a burner wallet and a hardware device. These habits cost seconds and prevent the single most common way people lose crypto. Combine them with our wallet security guide for a complete defense.