How to spot crypto phishing: wallet drainers took nearly $84 million in 2025

You can spot crypto phishing by three things: someone poses as an exchange, a wallet provider or a public authority, they put you under time pressure, and in the end they want your seed phrase, your password or a signature in your wallet. No reputable provider will ever ask for your recovery phrase, whether by email, on the phone or on a website. If you remember this one rule, you avoid most of these attacks.

The problem is anything but small. According to the annual report of the security service Scam Sniffer, so-called wallet drainers took around $83.85 million from 106,106 victims in 2025. That is 83 percent less than in 2024, when losses came to almost $494 million, yet the attackers have changed their approach: many small sums instead of a few big hauls. If you keep your coins in your own custody, for instance on a device from our hardware wallet comparison, you are protected against hacks on exchanges. Against phishing, only your own scepticism helps, because here the victim hands over access personally.

This guide sets out the most common crypto scams built on phishing, the warning signs in emails, calls and updates, and what to do if you have already entered your seed phrase.

What is crypto phishing? Fraud behind a borrowed identity

Phishing is a scam in which criminals pose as a trusted sender to obtain login details or money. The word is a play on "fishing": the bait looks genuine, but what the angler is after is your access. With cryptocurrencies the damage is usually permanent, because a blockchain transaction cannot be reversed. A bank may be able to recall a transfer in some circumstances. For bitcoin, ether or stablecoins, no such authority exists.

In crypto phishing, fraudsters go after three kinds of access:

• The seed phrase: the 12 or 24 words from which any wallet can be restored. Whoever knows them owns the coins.
• The signature: an approval in your wallet that allows a smart contract to withdraw tokens from your address.
• The exchange account: email address, password and two-factor code, which attackers use to log in to your exchange and trigger a withdrawal.

Nothing is hacked on the Bitcoin network or on any other blockchain. The blockchain works as designed and simply executes whatever a valid signature authorises. That is exactly why phishing is so effective: the attack targets people, not the technology.

Crypto phishing with wallet drainers and permit signatures: where most money was lost in 2025

A wallet drainer is an off-the-shelf fraud kit that criminals rent and embed in fake websites. Connect your wallet to such a site and confirm the request shown, and the script sweeps up every approved token. These sites copy genuine airdrop campaigns, NFT projects or DeFi platforms down to the last detail.

Scam Sniffer has broken down precisely which signatures proved most costly in 2025. The largest single case, in September, cost $6.5 million and ran through a so-called permit signature. Permit is a function of tokens on Ethereum and compatible networks that lets you grant a spending allowance with a mere signature, without a separate transaction appearing on the blockchain. Eleven cases in 2025 exceeded $1 million each, for a combined $22.98 million. They included three permit cases worth $8.72 million and two cases using the new Ethereum format EIP-7702, which has allowed batched approvals since the Pectra upgrade.

The costliest quarter was the third, at $31.04 million, and the quietest the fourth, at $13.09 million. In the fourth quarter, victims lost $580 each on average. The figures only cover drainer attacks via phishing sites. Seed phrases stolen through fake support chats or phone calls do not appear in them, so the real damage is higher.

In practice this means that a request mentioning "Permit", "Approve", "setApprovalForAll" or an unlimited amount of tokens is a warning sign on an unfamiliar site. Do not confirm anything you do not understand word for word. We explain in detail how signature phishing works with DeFi wallets in our DeFi wallet guide of November 13.

Phishing emails from exchanges and wallet providers: the warning signs listed by the BSI

Phishing emails are the classic route. According to Germany's 2025 federal cybercrime situation report, the consumer advice centre in North Rhine-Westphalia logged 382,470 phishing emails in Germany last year, around ten percent fewer than the year before. Crypto exchanges and wallet manufacturers are a popular target, because their customers hold assets that can be cashed in at once.

Germany's Federal Office for Information Security (BSI) names typical warning signs that apply directly to crypto emails:

• The text claims there is an urgent need to act, such as an alleged account freeze or a security problem.
• The email threatens consequences if you do not respond.
• The message asks you to enter confidential data or to follow a link.
• The request seems unusual for the sender, for example when a wallet manufacturer asks you to "verify" your words.
• A different email address hides behind the displayed sender name.

Two old rules of thumb no longer hold. Flawless language proves nothing about authenticity, because AI tools now let fraudsters write more cleanly than before. And according to the BSI, an "https://" in the address bar is no all-clear, since any phishing site can obtain such a certificate. Look at the exact domain instead: unusual numbers, hyphens or endings such as .cam or .support after a well-known brand name are a clear warning sign. A recent example is the fake site we covered in our article on Trust Wallet phishing.

Fake support calls: no wallet provider phones you about your seed phrase

The second major scam is fake support. A supposed support agent gets in touch by phone, messenger or direct message on social media, after you have described a problem in public or for no reason at all. He sounds competent, sometimes knows your name and your order from an earlier data leak, and presses for a quick "safeguarding" of your coins.

On its warning page about phishing campaigns, Ledger states explicitly that the company never contacts users by text message or phone call and does not send direct messages on social networks either. Anyone who receives such a call should, according to Ledger, hang up immediately and ignore further attempts at contact. The same applies to any reputable exchange or wallet provider: contact starts with you, via the official app or a website whose address you type in yourself.

Typical lines from fake support include: "Your account has been compromised, we need to move the coins to a safe address" or "To confirm, read me the first words of your phrase." There is no exchange that asks you to send coins to a new address dictated to you over the phone. In September we summarised in a separate guide how criminals use customer data from leaks for calls and emails of this kind.

Fake firmware updates and wallet apps: crypto phishing aimed at hardware wallet owners

Hardware wallets are regarded as the safest form of custody, and that is precisely why fraudsters target their owners. The trick: an email or pop-up announces an urgent firmware update and leads to a replica download page. The fake program then asks for the recovery phrase, supposedly to set the wallet up again after the update.

Ledger makes clear that the company does not send emails asking users to install a firmware update, enable two-factor login or take similar steps. The manufacturer also warns against fake versions of its app Ledger Wallet (formerly Ledger Live), which can look very convincing at first glance. The security firm SlowMist reported an example of such sites with a replica authenticity check in October, and we covered it in our piece on fake Ledger updates.

The rule is simple: firmware updates come only through the manufacturer's official app, installed from the official app store or from the manufacturer's site whose address you typed in yourself. According to Ledger, you never enter the recovery phrase anywhere except directly on the device itself. Any program on a computer or smartphone that asks for the words is a fraud attempt.

Crypto phishing by letter and QR code: the post as a new channel

Fraudsters now use ordinary post as well. Owners of hardware wallets receive letters on imitation company stationery announcing a mandatory check or a security update. A printed QR code leads to a phishing site that asks for the seed phrase. Ledger explicitly lists physical mail asking you to scan a QR code or visit a website on its warning page.

A letter seems more credible than any email because it gets your name and address right. That data often comes from earlier leaks at retailers and service providers. We described how such a campaign unfolds in our guide to wallet phishing by letter. A letter asking you to enter your words on a website is always a scam, whatever the sender and letterhead.

Pig butchering and recovery scams: when crypto investment fraud merges with phishing

Not every deception goes straight for the seed phrase. In pig butchering, fraudsters build trust over weeks, often via dating apps, messengers or supposedly misdirected messages. Later they recommend a trading platform that looks real, displays profits and suddenly demands fees or "taxes" when you try to withdraw. This form of crypto investment fraud uses the same tools as phishing: fake websites, false identities and time pressure.

The recovery scam is particularly insidious: people who have already lost money receive offers from supposed recovery services or supervisory bodies that promise to get the funds back and ask for personal data in return. Some of these fake helpers also call their victims directly. Genuine authorities never ask for an upfront fee or login details to recover crypto assets.

You can check yourself whether a provider is licensed at all in the register of the European Securities and Markets Authority, ESMA. Under the MiCA crypto regulation, crypto service providers in the EU need a licence; the details are in our overview of the MiCA licence. A platform you cannot find in any register is off limits for your investments.

Check the domain and use bookmarks: protection against crypto phishing

The best protection consists of habits you set up once and then stop questioning. The first priority is how you reach your exchange: open exchanges, wallets and DeFi applications only via a bookmark you created yourself or the official app, never via a link from an email, a search engine ad or a message.

• Two-factor login with an app or security key: SMS codes can be intercepted through a hijacked phone number. An authenticator app or a hardware key is more robust.
• Anti-phishing code at the exchange: many exchanges let you set a personal code that appears in every genuine email. If it is missing, the email did not come from the exchange.
• Withdrawal whitelist: specify that withdrawals may only go to addresses confirmed in advance. Even with your password, attackers then cannot withdraw to arbitrary addresses.
• Separate wallets: keep a small wallet for experimenting with new DeFi sites and airdrops, and hold the bulk separately on a hardware wallet that is never connected to unknown sites.
• Revoke approvals regularly: old token approvals stay active until you withdraw them. Block explorers and wallet apps show you which approvals are open.
• Compare addresses in full: in address poisoning, fraudsters send tiny amounts from an address that resembles your real destination address at the start and end. Copy the address from your history and the money goes to the wrong place.

If you use a software wallet on your smartphone, you should also look for a provider with built-in warnings about known phishing sites and a transaction preview. Our comparison of software wallets shows which apps offer this.

Seed phrase exposed in a phishing attack: the first hours

If you have entered your words on a third-party site or given them to a caller, every minute counts. Fraudsters often empty wallets automatically, but sometimes only after hours or days, so they can wait for further deposits. The sensible order now is:

1. Create a new wallet: set up a new wallet with a new seed phrase on a clean device. With a hardware wallet, you reset the device and generate new words.
2. Move the remaining funds at once: transfer everything still there to the new address. The old phrase is burned and is never used again.
3. Revoke approvals: if you confirmed a signature on a drainer site but did not reveal the phrase, revoke the approval in the block explorer. This costs a small network fee.
4. Secure exchange accounts: change your password and two-factor settings, log out everywhere and inform the exchange's support via the official website.
5. Preserve evidence: save emails, chat histories, the address of the phishing site and the transaction IDs.

There is no guarantee of getting stolen coins back. Larger sums, however, often end up at exchanges that can freeze accounts following tips from investigators. The sooner the transaction IDs are available, the better the chances.

Reporting crypto phishing: police, consumer advice and evidence

After a crypto fraud, you file a report with the police; in all German federal states this can also be done through the online police station. According to the federal situation report, police registered around 334,000 cybercrime cases in 2025, and the number of unreported cases is considerably higher. Every report helps to identify patterns and to freeze the perpetrators' accounts.

Suspicious emails that caused no damage can be forwarded to the phishing radar of the consumer advice centre in North Rhine-Westphalia (phishing@verbraucherzentrale.nrw), which also publishes current warnings about ongoing campaigns. For larger losses, a capital markets lawyer can check whether an exchange or bank involved is liable. Reputable law firms do not promise a recovery rate in advance.

If you recognised a phishing email or a scam call without entering anything, the matter is simple: delete it, do not reply, do not open any link. A reply only confirms to the fraudsters that the address is active.

Crypto phishing: a seed phrase never belongs in a form

Almost every crypto scam built on phishing ends at the same point: someone wants your words, your password or your signature. Three steps make you a much harder target:

1. Separate your custody: keep most of your coins on a hardware wallet that is never connected to unknown sites. Devices with their own display are listed in the hardware wallet comparison.
2. Choose an everyday wallet with protective features: for small amounts and DeFi, an app with transaction preview and phishing warnings is suitable. The software wallet comparison shows the differences.
3. Trade only on licensed exchanges: an exchange with a MiCA licence is subject to supervision, and many also offer an anti-phishing code and a withdrawal whitelist. The comparison of regulated crypto exchanges shows which providers are authorised.

(As of November 14, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)