DeFi wallet explained: signature phishing cost users $83.85 million in 2025

A DeFi wallet is a crypto wallet whose private key you keep yourself and with which you connect directly to applications on the blockchain: to decentralised exchanges such as Uniswap, to lending protocols or to staking services. There is no account at a provider, no bank and no password reset. Whoever holds the twelve or 24 words of the recovery phrase owns the coins. That is exactly what makes the DeFi wallet the gateway to decentralised finance and, at the same time, the most common way in for scammers.

The crypto angle goes beyond technology: anyone who holds ether, stablecoins or other tokens in a DeFi wallet decides with every confirmation who gets access to their funds. Nobody recovers stolen amounts. How dangerous this can be is shown by the annual report of the security service Scam Sniffer: through signature phishing and so-called wallet drainers, users lost around $83.85 million in 2025, spread across 106,106 victims. That was 83 percent less than the $494 million from 2024, but still more than $790 per case on average.

This guide explains how a DeFi wallet works, which types exist, what really happens when you connect to a decentralised application and which EU rules apply to self-custody and transfers. The focus is on the moment when most losses occur: confirming a signature or a token approval.

What is a DeFi wallet? Self-custody with your own private key

DeFi stands for decentralised finance, meaning financial services that run as smart contracts on a blockchain. A smart contract is a program that executes rules automatically as soon as someone sends a matching transaction. To use such programs, you need an address that can sign transactions. That signature is created with the private key, a long number from which your public address is derived.

A DeFi wallet is the software that manages this key, displays transactions and signs them after you confirm. The technical term is self-custody: nobody but you can trigger a transfer, and nobody but you can replace a lost phrase. Well-known examples are MetaMask for Ethereum and compatible networks, Phantom for Solana and Trust Wallet for many networks at once. How setup works in detail is shown in our guides to setting up MetaMask and setting up Trust Wallet.

One point is key to understanding this: the coins never sit "in" the wallet. The balance is recorded on the blockchain under your address. The wallet is merely the key ring that grants access to it. That is why you can restore the same address in another wallet app as soon as you enter the recovery phrase. And that is why the phrase belongs on paper or metal in a safe place, never in a photo, a cloud or a chat window.

DeFi wallet versus exchange wallet: whoever holds the key controls access

At a crypto exchange such as Coinbase, Kraken or Bitpanda, you have a customer account. The exchange holds the keys, executes your orders and is liable within the scope of its licence. In the EU, such providers have needed authorisation as crypto-asset service providers since the transition period of the Markets in Crypto-Assets Regulation, MiCA, ended. Forgotten passwords can be reset, a support team checks suspicious withdrawals, and a suspicious activity report can stop a transfer.

A DeFi wallet has none of this. In return, you get access to applications an exchange does not offer: tokens traded only on decentralised exchanges, liquidity pools, on-chain loans or votes in a DAO. The trade-off is therefore between convenience and protection on one side and freedom and personal responsibility on the other. Many investors use both, buying ether on a regulated exchange and sending part of it to their own DeFi wallet when they want to use a particular application.

One often overlooked difference concerns liability. If someone hacks an exchange, the exchange is accountable to its customers. If you sign a fraudulent approval in your DeFi wallet, that was a valid transaction from the blockchain's point of view. There is no authority that can reverse it.

Browser extension, app or hardware wallet: the three types of DeFi wallet

Browser extension

The most common form is the extension for Chrome, Brave or Firefox. The window pops up as soon as a website requests a connection or a signature. That is convenient for trading on a computer, but the key sits encrypted on a device that is connected to the internet. Such a wallet therefore counts as a hot wallet. If malware gets onto the computer, in the worst case it can read inputs or display fake windows.

Mobile app

Apps such as Trust Wallet or the mobile version of MetaMask contain their own browser for decentralised applications. Alternatively, you connect the app to a website on your computer via WalletConnect. Thanks to sandboxing and the device lock, a smartphone is often better protected than a desktop browser full of extensions, but it remains a device with internet access.

Hardware wallet as a signing device

A hardware wallet is a small device from which the private key never leaves. You can pair it with a DeFi wallet such as MetaMask: the software shows balances and applications, but the actual signature is only created after you press a button on the device. That protects well against malware on the computer. Against an approval you confirm yourself, it only protects if the display shows the transaction legibly and you read it before pressing. Which devices do this reliably and which software wallets work well as an interface is compared in our software wallet comparison.

Connecting a wallet via WalletConnect or extension: what the connection allows and what it does not

When you click "Connect Wallet" on a decentralised application, little happens at first. The site learns your public address and can read your balance, which anyone can see on the blockchain anyway. It cannot move money with that yet. WalletConnect is an open protocol that pairs a website with your wallet app via a QR code without the key leaving your smartphone.

It only becomes risky with the next steps: the application sends a request, and your wallet shows a window asking you to sign or confirm something. Only that confirmation has an effect. You can disconnect the connection itself at any time in the wallet's settings. But that only removes the visibility of your address for that site, not the rights you have already granted to a smart contract.

A common trick is therefore the fake site: a copy of Uniswap, Lido or an airdrop portal, reached via a search engine ad or a link on social media. The connection looks harmless; the next confirmation is not. Read the address bar before every connection and bookmark the applications you use regularly.

Signature and transaction: two confirmations with very different weight

A DeFi wallet knows two kinds of confirmation. A transaction is sent to the blockchain, costs a fee and changes something immediately by transferring tokens, executing a swap or granting an approval. A signature, by contrast, is a digital signature on a message. It costs nothing, is not sent immediately and therefore looks harmless.

Many signatures are harmless, such as logging into an application with "Sign-In with Ethereum". Other signatures, however, contain a complete permission that a third party can later put on the blockchain themselves. These include Permit signatures under the EIP-2612 standard and the related Permit2 method. In legal terms, such a signature is a signed power of attorney that the recipient can redeem at any time as long as it has not expired.

A good DeFi wallet therefore shows you, before every signature, which type is being requested. If it says "Permit", "Spending Cap" or "Approve" together with a token and a destination address you do not recognise, it is about access to your balance. If it shows only a readable login text with no amount, it is usually not critical.

Token approvals: why an unlimited allowance keeps running after you disconnect

Before a smart contract may move your tokens, for example to swap USDC for ether, you have to grant it an approval. In technical jargon this is called an allowance or approval: the amount a specific contract may debit from your address. Many applications request an unlimited allowance by default, so that you do not pay a second fee on your next swap.

The developers of ethereum.org describe the risk clearly in their guide to revoking token access: once granted, a permission has no expiry date and remains valid even when you have long stopped using the application and have disconnected your wallet. If the contract is later hacked or was malicious from the start, it can drain the approved tokens. Revoking itself costs a small transaction fee and, according to the guide, does not put any funds at risk.

This leads to a simple habit: where the wallet allows it, approve only the amount you need for the current swap. MetaMask shows a "Spending Cap" field for this, in which you enter your actual amount instead of the suggested maximum. You check old approvals with tools such as Revoke.cash or Etherscan's token approval checker, which list all open allowances of your address per network. A detailed step-by-step guide with the three questions to ask before every confirmation can be found in the article Wallet drainers: what you really approve when you confirm.

Permit signatures and EIP-7702: the schemes behind $83.85 million in losses in 2025

According to Scam Sniffer's annual report, Permit signatures were the dominant form of signature theft in 2025. In the large cases above $1 million, 38 percent of the losses were attributable to Permit and Permit2. The largest single case of the year, in September, cost one victim around $6.5 million, triggered by a single Permit signature. Among the cases with losses above $1 million, three each were due to Permit signatures and to classic approve permissions.

A new attack route has emerged via EIP-7702. This extension arrived with Ethereum's Pectra upgrade in May 2025 and allows a normal address to temporarily use a smart contract's code, for example to bundle several transactions. If you sign such a delegation to a malicious contract, it can take control of your address. Scam Sniffer counted two cases in August 2025 with combined losses of $2.54 million.

This matters for ether holders because almost all of these schemes run on Ethereum and compatible networks. One feature many users overlook helps with security: modern wallets simulate a transaction before confirmation and show which tokens would leave your account. If this preview is empty or unclear, or if the wallet warns of a known scam address, you cancel.

Gas fees and networks: every blockchain needs its own fuel

Every transaction in a DeFi wallet costs a network fee, the so-called gas fee. On Ethereum you pay it in ether, on Solana in SOL. If you lack the right coin, your balance stays stuck, even if there are enough stablecoins at the address. This is one of the most common beginner mistakes: sending USDC to a layer-2 network such as Arbitrum and then finding that ether on exactly that network is missing for the next step.

Choosing the right network when depositing is just as important. An Ethereum address looks the same on Arbitrum or Base. If you send tokens via the wrong network to an exchange that does not support that network, in the worst case they are lost. A DeFi wallet usually shows the active network at the top of the window. Fake network entries with manipulated addresses for the data interface are another attack route, so you add new networks only via known directories or the project's official site.

DeFi wallets and EU rules: MiCA, the Transfer of Funds Regulation and the €1,000 threshold

You do not need a licence to use a DeFi wallet, and the makers of pure self-custody software do not fall under the MiCA regulation's licensing requirement either. Anyone who holds other people's keys instead, such as an exchange or a custodian, needs a licence; the MiCA rules set out the obligations of these providers.

Regulation becomes noticeable at the interface. The EU Transfer of Funds Regulation for crypto-assets, Regulation (EU) 2023/1113, has applied since December 30, 2024. If you transfer from an exchange to a self-hosted address, the provider must collect information on the sender and recipient. For amounts above €1,000, under Article 14(5) it must also establish whether the address belongs to you or is controlled by you. In practice, exchanges ask for a small test transfer, a signed message from the wallet or a screenshot as proof. Plan for this step before sending a larger amount to your DeFi wallet.

The same applies the other way round when depositing: if money comes back to the exchange from a DeFi wallet, the provider can ask about the origin and ownership of the address. So keep the link between your exchange account and your own address traceable. Swaps between tokens can also have tax consequences depending on where you live, so keep a complete record of your transactions from the start.

DeFi wallet: with no open approvals, a drainer comes up empty

A DeFi wallet is not a product you set up once and then forget. It is a tool whose security depends on your habits: separate addresses for experiments and savings, limited approvals, a look at every signature and regular clean-up of old allowances. Three comparisons help with the next steps:

1. Take the keys offline: pair your DeFi wallet with a signing device. Which models display transactions legibly is shown in the hardware wallet comparison.
2. Start with a licensed provider: buy ether or stablecoins on an exchange with MiCA authorisation and transfer only the part you actually use in DeFi. The comparison of regulated crypto exchanges provides an overview.
3. Keep tax records from day one: import your wallet addresses into a tax tool before hundreds of swaps pile up. Suitable programs are listed in the comparison of crypto tax software and portfolio trackers.

(As of November 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)