Crypto phishing explained: how scammers steal your access

Many crypto thefts begin without any technical break-in. Someone simply persuades the owner to hand over access, whether by typing a password into the wrong page, reading out a code, or approving something they didn’t understand.

That’s phishing: tricking you into giving up the things that control your accounts and funds. Here’s what attackers want, how fake sites, fake support, and fake airdrops work, and what to check before you act. This article describes patterns, not scripts.

What attackers are really after

There are four prizes. The first is your login for an account, the password and often the email behind it. The second is a one-time code that completes a sign-in. The third is a seed phrase or private key, which Ethereum’s security guidance calls the master key to a wallet, since anyone who has it can access all of your accounts and drain every asset. The fourth is your permission, a signature or approval that lets someone move your tokens without ever needing your keys.

Ethereum’s guidance puts the rule plainly: no legitimate service, support agent, or website will ever ask you for a recovery phrase or private key.

Fake websites and links

Phishing emails and messages often send you to an imitation site that asks you to enter your seed phrase, reset your password, or send crypto, according to Ethereum’s security guidance. Links can arrive by email, direct message, an advertisement, or a QR code. Even a link preview can be spoofed, so it may show a trusted name while the link leads somewhere else, which is why the guidance says to check that you’re on the right domain, especially after clicking a link. A bookmark you saved yourself avoids relying on a link someone sent you.

A second factor doesn’t always stop this. A fake login page can pass your password and your one-time code to the real site in real time, and the NCSC finds that all traditional second factors are vulnerable to that kind of relay, while passkeys and security keys are bound to the real site and resist it. Text-message codes carry an extra risk, since the FTC warns they may not stop a SIM swap. No technology helps, though, if you type a code or seed phrase into the page yourself.

Fake support and impersonation

In a support scam, the attacker pretends to be help staff for a wallet, exchange, or blockchain. Ethereum’s guidance describes them finding people who ask for help in public channels and then sending a private message offering support, building trust until the target reveals private keys or sends funds. The same pattern can happen on any chat app or by email.

The rules of thumb from that guidance are that staff never contact you through private, unofficial channels, that you should never allow anyone remote access to your computer, and that you should never communicate outside an organization’s designated channels. A fake agent who offers to return lost crypto in exchange for your keys is relying on a misunderstanding, since a decentralized network has no such function. The FTC adds that crypto payments typically can’t be reversed, and that no legitimate business or government agency will demand payment in cryptocurrency.

Fake airdrops and approval requests

An airdrop scam starts with an unfamiliar token or NFT showing up in your wallet. A website then invites you to claim it, asks you to connect your wallet, and prompts you to approve a transaction. Ethereum’s guidance says that transaction can compromise your account, or it may simply send funds to the scammer.

The mechanism behind it is the token approval. On Ethereum, an approval creates an allowance that lets another address spend your tokens, and that address can then move them on its own, up to the approved amount. That’s why the guidance warns against unlimited spend limits and says to set only the amount a transaction needs, and it points to a guide on revoking contract access you no longer want. Giveaways follow a simpler pattern, where you send some crypto and are promised double back, and the guidance states that giveaways are always scams.

What to check before you click, sign in, or sign

A few questions catch most cases. Did you start this contact, or did someone reach out to you? Is the address exactly right, not just similar? Is anyone asking for a seed phrase, a code, or remote access, or creating urgency, or offering free crypto? Ethereum’s guidance reduces it to three reminders: always be skeptical, no one will give you free or discounted crypto, and no one needs access to your private keys.

Before you sign anything, read what your wallet shows you and limit what an approval allows. If something feels off, stop and go to the official site yourself, instead of through the message that reached you.

WEEX Reminder: go to the official site yourself

WEEX reminds users not to rely on links, QR codes, or attachments in messages and ads, and to open official sites and apps yourself. No genuine service or support team needs your seed phrase, verification code, backup code, setup key, or remote access to your device, and official support doesn’t reach out through private, unofficial channels. Don’t approve a token or sign a transaction you don’t understand. Nothing here is financial advice.

Conclusion

Crypto phishing aims at four things: your login, your one-time codes, your seed phrase or private key, and your permission to move tokens. It arrives as fake sites, fake support, and fake airdrops, and a second factor helps only if it can’t be relayed or handed over. Most attacks fail when you start the contact yourself, share none of the secrets, and read what you’re asked to sign.

FAQ

1. What is crypto phishing?
It’s tricking you into giving up the things that control your crypto, such as a password, a one-time code, a seed phrase, or approval for a transaction, usually through a fake site, message, or support contact.

2. Can phishing steal crypto without my seed phrase?
Yes. A malicious approval can give an address permission to spend your tokens, or you may be tricked into sending funds yourself, and a stolen password and code can take over an account.

3. Does two-factor authentication stop phishing?
Not always. According to the NCSC, traditional second factors can be relayed by a fake login page in real time, while passkeys and security keys are bound to the real site and resist it.

4. How can I tell fake support from real support?
Ethereum’s guidance says genuine staff never contact you through private, unofficial channels, never ask for your seed phrase or private keys, and never need remote access to your computer.

5. Can stolen crypto be recovered?
Usually not. The FTC notes that crypto payments typically can’t be reversed, and Ethereum’s guidance warns that people offering to return lost funds in exchange for your keys are scammers. Report what happened to the service involved and your local authorities.