--- title: "How to Protect Your Crypto Wallet from Phishing" url: "https://bip39-phrase.com/protect-crypto-wallet-from-phishing/" language: "en" published: "2025-01-25T00:00:00+00:00" updated: "2026-10-16T00:00:00+00:00" --- [ Security ](/topics/security/) Published January 25, 2025 Updated October 16, 2026 # How to Protect Your Crypto Wallet from Phishing Читать по-русски: [Фишинг и криптокошелёк: как не отдать сид-фразу мошенникам](/ru/fishing-kriptokoshelek/) ![How to Protect Your Crypto Wallet from Phishing](/wp-content/uploads/2025/01/protect-crypto-wallet-from-phishing-hero.webp) Phishing is the most direct way to lose crypto, because it doesn’t need to break any cryptography. It tricks you into doing one of three things: revealing your seed phrase or a private key, signing a transaction or approval that hands your tokens to someone else, or sending funds to an address the attacker controls. A blockchain has no chargeback, so a confirmed transaction stays confirmed. This guide shows how each kind of attack works and the habit that stops it. ## The Main Phishing Attacks at a Glance | Attack | What it wants from you | What stops it | | --------------------------------------------- | ------------------------------------ | ---------------------------------------- | | Fake wallet website, app or browser extension | Your seed phrase | Official links and bookmarks only | | Fake support by email, DM or phone | Your seed phrase or a “verification” | Knowing that no real support asks for it | | Fake mint, airdrop or “claim” page | A token approval or signature | Reading every request before you sign | | Address poisoning | A payment to a lookalike address | Checking the whole address | | Account phishing | Your exchange password and 2FA code | Passkeys or hardware security keys | ## Reach Wallets and Exchanges Only Through Addresses You Trust Most attacks start with a link in a search ad, an email or a chat message. Type the address of your wallet or exchange yourself once, bookmark it and use the bookmark. Install wallet apps and extensions only through the links on the vendor’s own website: official stores are not a guarantee, and a fake Ledger Live app was listed in the Microsoft Store for weeks in 2023 ([ESET](https://blog.eset.ie/2023/11/08/fake-ledger-live-app-in-microsoft-store-steals-768000-in-crypto/)). The padlock and “https” only mean that the connection is encrypted. Phishing sites get certificates too, which is why the FBI’s IC3 [warned](https://www.ic3.gov/PSA/2019/PSA190610) against trusting a site for its lock icon. Check the spelling of the domain instead: lookalikes swap or add letters, or use another ending such as .app or .io. ## Your Seed Phrase Goes Nowhere but Your Wallet A seed phrase is not a password you log in with. It is the wallet: whoever types it into any app gets every account it controls. No real service needs it from you. MetaMask’s support page says plainly that anyone who asks for your Secret Recovery Phrase is trying to scam you, and that its support has no phone number and never offers help by DM ([MetaMask support channels](https://support.metamask.io/stay-safe/safety-in-web3/what-are-metamasks-official-support-channels/)). Trezor’s August 2026 [security notice](https://trezor.io/blog/news/coldcard-vulnerability-trezor-devices-are-not-affected) says Trezor will never contact you for your wallet backup and that it should never be typed into a website, form, app or message. Typical pretexts are a “security alert”, a “wallet sync” or a firmware problem, usually with a deadline; [nine common seed phrase scams](/seed-phrase-scams/) shows how each one is staged. On a hardware wallet the phrase is entered only on the device itself, when you restore it, and the written copy stays offline ([how to store a seed phrase](/store-a-seed-phrase/)). ## Read What You Sign Many attacks never ask for the phrase. A fake mint, airdrop or “claim” page asks you to approve a token instead. A token approval is permission for a contract to move a specific token from your wallet ([MetaMask: what is a token approval?](https://support.metamask.io/stay-safe/safety-in-web3/what-is-a-token-approval/)), and an unlimited approval to a malicious contract lets it take that token whenever it likes; for NFTs, `setApprovalForAll` does the same for a whole collection. Signatures can do the same without any transaction. Tokens that support [ERC-2612](https://eips.ethereum.org/EIPS/eip-2612) accept a “permit”: a signed message that changes your allowance, which the attacker submits on-chain later. Because signing costs no gas, it feels harmless. Before you confirm anything: - Check which site is asking, for which token and amount, and refuse requests you don’t understand. - Lower the spending cap to what the transaction needs instead of accepting “unlimited”. - Review old approvals from time to time and revoke the ones you don’t use, for example with the [Etherscan token approval checker](https://etherscan.io/tokenapprovalchecker) or MetaMask Portfolio. Revoking is an on-chain transaction and costs a fee. ## Check Every Address Before You Send In address poisoning, the attacker creates an address with the same first and last characters as one you use and sends you a transaction of negligible value from it, hoping you will later copy their address from your history ([MetaMask: address poisoning](https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/)). These transfers often look like [dust transactions](/dust-transaction/). Clipboard malware does the same job on your computer by swapping an address you copy for its own. The defense is the same for both: don’t copy addresses from transaction history, save the ones you use often in your wallet’s address book, and compare the whole address, including the middle characters, before you confirm ([how an EVM address is built](/format-evm-addresses/)). For a large amount, send a small test payment first. ## Use a Hardware Wallet, and Know Its Limits [Hardware wallets](/hardware-wallets-explained/) such as Ledger or Trezor keep private keys on the device and sign transactions there, so malware or a fake website cannot copy keys that never leave the device. A hardware wallet cannot help if a phishing page tricks you into typing your seed phrase or approving a malicious transaction, so check the address and amount on the device’s own screen before you confirm, and be wary of any request the device cannot show in readable form. ## Lock Down Exchange and Email Accounts Two-factor authentication protects accounts: an exchange, an email inbox or a custodial wallet. It does nothing for a self-custody wallet, where the seed phrase alone is enough to move the funds (see [custodial vs non-custodial wallets](/custodial-vs-non-custodial-wallet/)). A [CISA fact sheet](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) calls FIDO/WebAuthn methods, such as passkeys and hardware security keys, phishing-resistant; codes from authenticator apps can be phished by a fake login page that relays them in real time, and SMS codes are also exposed to SIM swapping. Use a passkey or security key where the exchange offers one, an authenticator app otherwise, and avoid SMS. Protect your email account the same way, since it can reset your exchange password. ## If You Already Clicked - **You typed your seed phrase somewhere.** Treat the wallet as compromised. Create a new wallet with a new phrase on a device you trust and move everything to it at once; Trezor’s guide to [moving crypto to a wallet with a new backup](https://trezor.io/guides/backups-recovery/general-standards/move-crypto-to-a-wallet-with-a-new-wallet-backup) shows the steps for its devices. [Is my seed phrase compromised?](/bip39-seed-phrase-compromise/) covers the warning signs and the false alarms. - **You signed an approval.** Revoke it immediately and move the remaining tokens to a fresh address. - **You entered exchange credentials.** Change the password on the official site, sign out other sessions, reset 2FA and contact the exchange through its website. - **Report the site** to the company it imitates and, in the US, to the [IC3](https://www.ic3.gov/). Ignore offers to recover your funds for a fee: the FTC warns that [recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) target people who have already lost money. ## Frequently Asked Questions ### Can a hardware wallet be phished? Its keys can’t be copied, but you can still be tricked into typing the seed phrase into a fake app or approving a malicious transaction. It protects you only if you read its screen before you confirm. ### Does 2FA protect my MetaMask or other self-custody wallet? No. 2FA protects accounts that a company runs, such as an exchange or email. Anyone who has the seed phrase or private keys of a self-custody wallet can move its funds without any second factor. ### Can I get my crypto back after a phishing attack? Usually not. Confirmed transactions can’t be reversed, and only the recipient can send the funds back. If the coins reached an exchange, report the theft quickly to that exchange and to the police, and never pay a “recovery service” up front. [ Back to Blog ](/blog/)