Phishing patterns that target crypto users specifically

Standard phishing advice — check the URL, look for the padlock — was written for a world where the worst case was a stolen password you could change. Crypto attacks are built for an audience whose mistakes are irreversible, and they are shaped accordingly. The patterns repeat, and recognising the shape is more reliable than inspecting every link.

The fake support agent

You post a problem publicly — a forum, a chat, a social platform — and someone helpful appears in your direct messages within minutes, presenting as support for whatever you mentioned.

The tell is the direction of contact. Legitimate support does not initiate a private conversation because you complained publicly. Everything that follows, whether a “validation” site, a “sync” tool, or a screen-share, exists to reach your seed phrase or get you to sign something.

The habit that defeats it is absolute: nobody who contacts you first is support. Not if the display name matches, not if the avatar is right, not if they know details from your public post.

The approval that is not a transfer

The most effective attacks do not ask you to send anything. They ask you to sign an approval that grants a contract permission to move a token on your behalf, often without limit and without expiry.

It works because the prompt does not look like a payment. No amount leaves your wallet at the moment of signing, the wallet may show a small or zero value, and the funds move later. People who would never send funds to a stranger will approve a contract to claim an airdrop or connect to a site.

The defence is to read the device or wallet screen rather than the website, and to be suspicious of any unlimited allowance. Periodically reviewing and revoking standing approvals is maintenance that most people never perform.

The address that looks right

Two variants, both exploiting the fact that nobody reads a full address.

Clipboard malware replaces a copied address with the attacker’s at the moment you paste. Address poisoning sends you a tiny transaction from an address whose first and last characters match one you use, so that when you later copy from your history you take the wrong one.

Both defeat the habit of checking the first four and last four characters, which is the habit almost everyone has. Verifying the middle, using a saved address book, and sending a small test first are the countermeasures — and the test transaction is worth its fee on anything substantial.

Urgency about your own security

“Your wallet is compromised, migrate immediately.” “Suspicious activity detected, verify now.” The message is engineered so that the emotion it produces — fear about security — pushes you toward the action that destroys it.

Nothing in crypto genuinely requires action within minutes. There is no migration a real wallet provider will demand, no validation step involving your phrase, and no legitimate reason for anyone to need it. Time pressure applied to a security decision is itself the signal.

The search result and the paid ad

Searching for a wallet or exchange returns paid placements above the real result, and those placements are periodically bought by attackers pointing at a convincing clone. The site is pixel-accurate and the domain is a near-miss.

Bookmarks solve this completely and cost nothing. Reach anything holding value through a bookmark you created, never through a search result, and the entire category stops applying.

Why intelligence is not the defence

Worth saying because the shame of falling for one of these keeps people from reporting them. These attacks succeed against experienced, careful people, because they are designed to be caught during ordinary moments of distraction rather than during careful inspection.

What actually protects you is a small number of habits that do not depend on judgement in the moment: bookmarks rather than search, nobody who messages first is support, read the device screen not the website, a test transaction on anything large, and periodic approval review. Each removes a whole category regardless of how convincing an individual attempt is. Our note on what each security measure protects against covers the tooling side.

The fake airdrop and the token you did not buy

Unexpected tokens appearing in a wallet are a standing pattern rather than an occasional nuisance. The token is created by an attacker, distributed widely, and named to suggest value and a claim process.

Interacting with it is the trap. Attempting to sell or claim routes you to a site that requests an approval, and the approval is the attack. Holding the token costs nothing; touching it is what carries risk.

The correct response to an unexpected token is to ignore it. Most wallets allow hiding it from view. There is no version of this where a token you did not expect turns out to be a windfall, and the emotional pull of the possibility is exactly what the pattern is built on.

Compromised official channels

The hardest variant, because the usual advice fails. A project’s own social account, community server, or occasionally its website is taken over, and the malicious link is posted from the genuine source.

Every heuristic based on checking the sender breaks here. What still works is not depending on any single channel: confirming an announcement across the project’s other channels before acting, treating anything time-limited with additional suspicion, and reaching sites through bookmarks so a compromised post cannot route you anywhere.

It also argues for a habit that feels excessive until it isn’t — never connecting a wallet holding significant value to a site you reached from a link, whatever posted it.

Separate wallets do most of the work

The highest-leverage structural defence is not vigilance, which fails eventually, but separation. A wallet holding long-term assets that never connects to any site, and a separate wallet with a small balance used for everything interactive.

This converts a category of catastrophic outcomes into an annoyance. An approval signed from the interaction wallet exposes what is in it, which by design is little. The holdings wallet is unreachable because it has no relationship with any application.

It costs some inconvenience and removes the requirement that you never make a mistake — which is a better foundation than any amount of care, because care is a resource that runs out on a bad day and structure is not.