What is crypto phishing?
DefinitionCrypto phishing is a scam that impersonates a trusted wallet, exchange, project or support agent to trick you into revealing your recovery phrase or approving a harmful transaction. Because blockchain transfers are final, one mistake can empty a wallet.
Common phishing lures
Crypto phishing rarely looks like hacking. It looks like help, a reward or an urgent problem, and it pushes you to act before you think.
- Fake support agents in chats or comments who ask for your recovery phrase to “fix” or “verify” your wallet
- Look-alike websites and search ads that copy a real wallet or exchange, with a web address one letter off
- Fake apps and modified APK files that send your phrase to the attacker as soon as you type it
- Airdrop or giveaway messages that ask you to connect your wallet or “claim” tokens on a website
- Urgent warnings about a locked account, a failed payment or a security breach
Phrase phishing vs approval phishing
The oldest trick is getting your recovery phrase. With those words, an attacker can restore your wallet on their own device and take everything, on every network.
The newer trick needs no phrase at all. A malicious site asks you to sign a token approval or a permit message that gives a contract the right to spend your tokens. It looks like a routine confirmation, but once it is signed, the attacker can drain the approved tokens later.
How to protect yourself
Most phishing fails against a few firm rules:
- No real support team will ever ask for your recovery phrase; anyone who does is a scammer
- Type website addresses yourself or use your own bookmarks instead of links in messages or ads
- Install wallet apps only from the official website or store, and check the address bar first
- Never enter your phrase on a website, in a form or in a chat
- Don’t sign approvals you don’t understand, and be wary of urgency and free tokens
Phishing protection in Waletifi
Waletifi’s support will never ask for your recovery phrase. Download the app only from waletifi.com and check the address bar before you install. Inside the app, the phrase is never put on the clipboard, phrase screens block screenshots, and the review screen warns you about look-alike addresses and fake tokens before you send.
