Crypto Exchange and Wallet Phishing
Crypto phishing uses fake exchange alerts, fake airdrops and wallet drainer sites that empty wallets in seconds. How it works and how to protect exchange accounts and wallets.
Crypto phishing is unforgiving: once funds move, they are almost impossible to get back. Attackers imitate exchanges and wallet providers, promote fake airdrops and giveaways, and build sites designed to drain wallets the moment you connect and sign.
Common crypto phishing
- Fake withdrawal or login alerts: "A withdrawal of 0.5 BTC was requested. Cancel here."
- Seed phrase requests: "Verify your wallet" pages asking for your recovery phrase.
- Fake airdrops and giveaways promoted on social media. See celebrity giveaways.
- Wallet drainers: sites that ask you to connect and sign an approval that lets them move your tokens.
- Fake support in chat groups or replies.
- Search ads for wallets and exchanges. See search ad phishing.
Never share your seed phrase. No exchange, wallet or support agent will ever need it.
Protecting exchange accounts
- Use passkeys or a security key, not just text codes. See security keys.
- Turn on withdrawal address allow-lists where offered.
- Bookmark the exchange and never log in through links.
Protecting wallets
- Keep your seed phrase offline and private.
- Be very careful what you sign; read approval requests.
- Use a separate wallet for experimenting with new sites.
- Review and revoke token approvals you no longer need.
Got a crypto alert or airdrop offer? Paste it into CyberWatch AI Scan for a free check.
For more, see how to spot phishing in our complete guide.
Frequently asked questions
Would an exchange or wallet ever ask for my seed phrase?
Never. Anyone asking for your recovery or seed phrase is trying to steal your funds.
What is a wallet drainer?
A malicious site that asks you to connect your wallet and sign a transaction or approval that gives it permission to move your funds.
Can crypto stolen by phishing be recovered?
Rarely. Crypto transfers are generally irreversible, so prevention is essential. Beware of 'recovery' services, which are usually scams.
Sources
- What To Know About Cryptocurrency and Scams, US Federal Trade Commission
- Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
- Refund and Recovery Scams, US Federal Trade Commission
