Phishing doesn’t break encryption. It gets you to type a seed phrase, sign a permission or install a fake app. This guide shows how each trick works, what to set up so it fails, and what to do in the first hour if it already happened.
1Lookalike domain. A zero instead of the letter “o”.
2Every NFT in the collection, now and later.
3Unknown operator, not a marketplace you use.
No guarantees. No tool on this page is a guarantee. A hardware wallet can ship with weak randomness, an honest site can be swapped through a dependency, a genuine device can come back from a reseller with an extra board inside, and an audit covers only what was looked at, on that date. We are not offering a perfect product, because none exists. We are offering a setup that survives the failure of any single part, including the one you trust most. Including us.
In short
Keep your seed phrase only on paper or metal, hold savings on a hardware wallet bought from the maker, and use separate vault, daily and burner wallets. Review token approvals monthly, reject signatures you cannot read, open sites from bookmarks and ignore unsolicited support. If drained, contact SEAL 911 first, revoke approvals, move what is left and report.
01Self-check
Fourteen things to have in place
Tick what is already true. Each item links to the part of the guide that explains it. Your answers are saved only in this browser.
A drainer can only take what sits in the wallet that signed. Keep savings in a wallet that almost never signs anything.
Vault
Hardware wallet
Long-term holdings. It rarely connects to anything and only sends to addresses you already know.
SavingsRarely signs
Daily
Hot wallet, small balance
For the few apps you use every week. Keep only what you would be willing to lose this month.
Trusted appsTop up as needed
Burner
Fresh address
For mints, airdrops and any site you have not used before. Assume whatever sits here can be taken.
New sitesNear-empty
Seed phrase rules
The seed phrase is the wallet. Whoever has the words has the funds, on any device.
Write it on paper or stamp it into metal, and store it offline. Two copies in different places protect against fire and loss.
Generate it on the hardware wallet itself. A list of valid words does not prove it was generated with enough randomness: three real wallet failures.
If you add a passphrase (sometimes called the 25th word), store it apart from the seed. It opens a separate wallet, and if you forget it, the funds in that wallet are gone.
Never: type it into a website, a form, a chat or a "wallet validation" page. No real service ever asks for it.
Never: photograph it or keep it in cloud storage, email, notes or a password manager.
Never: use a seed that came printed in the box or that someone else gave you.
Get the wallet from the maker
Order a hardware wallet from the maker’s own site, check the packaging, and set it up yourself from a blank device. Resold devices with hidden implants were used to steal seeds in 2026.
What this does not cover: a bug in the maker’s own code. Buying direct did not help Coldcard owners whose seeds were generated weakly: the weak-seed case file.
Install extensions only through the link on the official site. Fake wallet extensions get into stores: 150+ fake Mozilla extensions.
One seed, one vendor, one point of failure
For larger amounts, split the backup or the signing itself: Shamir shares, or a multisig across devices from different makers, with a recovery path for your heirs.
The useful question is not “is this a good product?” but “what happens when it fails?”. Sooner or later every part fails: a bug, a breach at a supplier, an acquisition, a policy change, or bad luck.
When a trusted name failed
Engineering facts, not accusations. Each row links to the primary source.
Who
What happened
The lesson
Source
Coldcard Jul 2026
A firmware bug weakened seed generation on Mk2/Mk3 (firmware 4.0.1–4.1.9) and on Mk4, Mk5 and Q before the fix. Coinkite puts Mk4/Mk5/Q seeds at about 72 bits instead of 128; BlockSec estimates Mk2/Mk3 at roughly 40 bits as an upper bound. Attackers rebuilt weak seeds offline.
A hardware wallet does not guarantee good randomness.
A marketing database leak exposed about a million emails, and a later dump held names, postal addresses and phones of about 272,000 customers. Phishing followed, and some customers were mailed tampered “replacement” devices.
A vendor can leak you, even when it never touches your keys.
An attacker phished a former employee’s npm access and published a drainer inside a library that dApps load at runtime. The bad version stayed reachable for about five hours through CDN caching.
An optional service that exports encrypted seed shares to three custodians. Critics said it showed a firmware update can open a path for seed-derived data to leave the device; Ledger says it needs explicit consent and exports only encrypted shares.
Trusting a device includes trusting its future firmware.
Criminals fitted genuine devices with hidden LTE implants that capture the 24 words during setup, then resold them in Southeast Asia. Ledger calls it a localized distribution attack; researchers documented Nano X units. Genuine Check cannot detect such add-ons.
A genuine-device check is not a tamper check. Buy direct.
Phishing sent through its Mailchimp newsletter list (2022), a support-portal exposure of about 66,000 contacts (2024), and shipping and email-provider breaches (2026).
Your contact details live with the vendor’s suppliers.
A tampered Safe web app showed Bybit’s signers a routine transfer; they blind-signed a hash that handed the cold wallet to the attacker. About $1.4–1.5 billion, attributed by the FBI to North Korea.
Multisig did not help: every signer trusted the same screen.
TerraUSD lost its peg and collapsed in May 2022. In March 2023 USDC briefly traded below $1 while Circle had more than $3 billion of reserves stuck at the failed Silicon Valley Bank.
Apart from the custodial collapses, none of these were scams. Most are leaders in their category, with open code and audits. That is why the list matters: if the best fail, “pick the right product” cannot work as a strategy. Only “survive the failure of any one of them” does.
Build something that survives any single failure
Mix vendors in a multisig. A 2-of-3 on three identical devices shares one bug. Use different makers, chips and codebases so one flaw cannot take the quorum.
Use independent seeds, not branches of one root. Vault, daily and burner wallets from one seed are one point of failure. Give each its own seed.
Keep a passphrase apart from the seed. Stored and entered separately, it protects funds even if the seed or a device is compromised.
Split storage methods and assets. Hardware, multisig, a little on an exchange behind an allowlist, an offline backup: they fail in different ways. One stablecoin means one issuer and one bank.
Burn in new hardware with a small amount. Use a new device or firmware with a test balance before trusting it with savings.
Write an access and inheritance plan. Who can reach the funds if you cannot, and how, without handing anyone the seed today.
Re-check your assumptions every six months. Read your wallet maker’s security advisories. Coldcard owners lived with a weak-seed bug without knowing it until the advisory.
A safe deposit box protects the object, not the secret
A vault, a bank box or a trusted custodian sounds like full protection. It covers theft of the item, which is a different threat from a leaked seed.
The seed may have been compromised before the device went into the box: weak generation, an implant, a photo.
The seed works without the device. A thief needs the words, not the hardware.
Trusted custody adds people, processes and their mistakes.
Paper and metal burn, flood, get lost and get seized.
Reputation is not proof: xmrwallet.com
For ten years xmrwallet.com presented itself as a free, open-source Monero wallet run by volunteers. Our forensic work showed it sent users’ private view keys to its server on every login and swapped outgoing transactions server-side. Three registrars suspended its domains; NameSilo publicly defended the operator.
Ten years without a scandal is not proof of honesty. Reputation measures only what has become known.
Why it lasted ten years. None of these layers is technical sophistication:
Reputation: a decade presented as a free volunteer project.
Narrative: challenged, the operator replied that he had been running for years; the registrar then called the domain “compromised”.
The coin: on Monero, a victim struggles to prove the theft did not start on some other phishing site.
Infrastructure:bulletproof hosting behind DDoS-Guard, a registrar-run privacy service as the only public registrant, and a registrar that sided with the operator. Abuse reports had no one accountable to reach.
Nobody signed up to be responsible for your savings, and they said so in writing. The only person responsible for your crypto is you: not because it sounds braver, but because legally and technically there is nobody else. Plan from that, not from the logo.
04Approvals and signing
One signature can empty a wallet
A drainer does not need your seed phrase. A single approval gives it the right to move your tokens or NFTs, and it can use that right days later. Details in Crypto drainer anatomy.
approveincreaseAllowanceGrantsLets a contract spend one of your tokens, often with no limit on the amount.DoCheck who the spender is. Set an exact amount when the wallet lets you.
setApprovalForAllGrantsGives an operator every NFT you hold in that collection, including ones you get later.DoOnly for a marketplace you chose to use. Never for a "claim" or a "free mint".
permit and Permit2GrantsA signature with no gas and no transaction. It still grants an allowance that the other side can use later.DoTreat an unexpected gasless signature that names a token or an amount as an approval.
Marketplace ordersGrantsA listing signature (Seaport, Blur and others) can sell your NFTs to the attacker for zero.DoRead the price and the recipient. Reject any listing you did not create.
Unreadable dataGrantsRaw hex in the wallet or a bare hash on the hardware screen hides what you agree to.DoIf you cannot read it, reject it. If your device has a blind-signing setting, leave it off.
EIP-7702 authorizationGrantsPoints your ordinary address at a contract. From then on that code runs your account with full access, until you clear it. Anyone can submit your signed authorization for you.DoReject it unless you started the upgrade in your own wallet. Etherscan shows whether your address is delegated; clear it in the wallet, because Revoke.cash only lists it.
Before you sign, check four things
1Site. Is this the real domain, opened from your own bookmark?
2Action. Is it a login message, a transfer, an approval or a listing?
3Spender. Is the address a known contract or a random wallet?
4Amount and network. Is the amount exact, and is the wallet on the chain you expect?
A phishing site may switch your wallet to another network. If the chain changes without you asking, stop.
Let the wallet warn you
Rabby scans each transaction for risks and shows the balance change before you sign.
MetaMask shows security alerts and estimated balance changes by default. Both depend on Basic Functionality in Settings, Privacy, so leave it on.
Scam Sniffer’s free extension warns when a site or an address is on its blocklists.
A simulation is a preview, not a guarantee. A malicious contract can behave differently on-chain than it did in the test run, so the four checks still apply.
Clean up old approvals once a month
Approvals do not expire. Revoke anything you no longer use, especially unlimited ones. Revoking is a transaction, so it costs a little gas.
Everything above is about Ethereum-style chains. Elsewhere drainers ask you to sign different things, and Revoke.cash does not help. Know what your network’s dangerous signature looks like.
Network
What you might be asked to sign
How to check
How to clean up
Solana
Batch requests (signAllTransactions) the site can broadcast later; durable-nonce transactions that never expire (Drift lost about $270M to pre-signed ones in April 2026); token delegates; Assign/SetAuthority that hands over account ownership with no balance change.
Read every transaction in a batch. Turn off Phantom auto-confirm. Treat an authority change with “no balance change” as a red flag, not a reassurance.
Delegates: Famous Fox Revoker (Phantom’s pick) or Solflare → Settings → Security and Privacy → Spending Approvals. Disconnecting a site is not revoking. A transferred owner cannot be revoked.
Tron
An AccountPermissionUpdate that moves your owner or active permission to the attacker. Multisig traps after a leaked seed. Bait wallets whose seed is “accidentally” posted online.
TronLink extension: More → Account Permissions. TronLink app: More → Security Detection. A “Multisig” label you did not add means trouble.
Once ownership moved, your key no longer controls the account. Anyone offering to “restore” it is the next scam.
TON
The transaction you confirm after a TON Connect request inside a Telegram bot or mini app. Fake tokens with famous names. Tiny transfers whose comment says your wallet is “suspended”.
Connecting only shares your address: read the amount and recipient of every confirmation. Keeper marks unverified tokens.
Keeper (formerly Tonkeeper): Browser → Connected → hold the icon → Remove. Walt (formerly Wallet in Telegram): DeFi Account → Settings → Connected Apps.
Bitcoin
A PSBT built by compromised software. Clipboard malware that swaps the address you copied. Fake wallet apps in official stores.
The hardware wallet screen is the truth: address, amount and change output. Sparrow shows full transaction details before you sign.
There are no approvals to revoke. If malware is possible, move funds from a clean device.
Sui
One programmable transaction block can bundle up to 1,024 operations.
Read the whole request, not the first line.
—
Aptos
A key rotation keeps your address but changes who controls it.
Only rotate keys from your own wallet’s settings, never because a site or “support” asks.
—
Cosmos (Keplr)
Authz grants: a “generic” grant is unrestricted and may never expire. Scam governance proposals with links.
Check what a grant allows and for how long.
Revoke a grant with MsgRevoke from your wallet. Report scam proposals to Keplr’s public phishing block list.
05Recognize the scam
Twelve scams to recognize on sight
Each one ends the same way: you open a link, type a seed phrase, install something or sign. Learn the tell and the trick stops working.
Lookalike sites and search ads
A copy of a wallet, exchange or dApp on a domain that is one word or one character off, often pushed through sponsored search results.
TellExtra words like "claim", "app" or "support" in the domain, hyphens, or an unusual ending.
The attacker sends you a zero-value or tiny transfer from an address that starts and ends like one you use, hoping you copy it from your history next time.
TellSmall transfers you did not expect, from addresses that only match at the edges.
A known contact’s hijacked Telegram books a call through Calendly. The meeting link is a lookalike of Zoom or Teams, the faces may be deepfakes or recordings, and then comes an “audio fix”, “SDK update” or extension to install. North Korea-linked groups have run this against founders, traders and community managers since 2024.
TellAny request to install something or paste a command to join or fix a call; a meeting domain that is not the real one; video, but no live check.
The genuine domain, or a library it loads, gets compromised. Ledger Connect Kit put a drainer on many real dApps in December 2023; hijacked domains at Squarespace pointed DeFi sites at drainers in July 2024.
TellA familiar site suddenly asks for an approval, a new kind of signature or a network switch you did not expect.
Malware watches what you copy and swaps a crypto address for the attacker’s. Found in fake Tor Browser installers and trojanized Telegram and WhatsApp apps.
TellThe pasted address differs from the source anywhere, not only at the ends.
Telegram bots and mini apps
Unofficial wallet bots, referral schemes and fake mini apps inside Telegram take your TON or hijack your Telegram login, which often holds a wallet.
TellA bot or mini app that is not linked from the project’s official site, or a confirmation you did not expect.
Bookmarks protect you from phishing, not from a compromised real site. Ledger Connect Kit, hijacked domains and poisoned npm packages all served drainers from addresses people trusted. Checking what you are about to sign stays the last line of defence, every time.
Where they reach you
The channel changes. The request stays the same.
Search adsA sponsored result for a wallet or exchange leads to a lookalike domain.
X repliesImpersonator accounts reply with a giveaway or a "support" link.
Discord DMsFake moderators write after you post in a support channel.
TelegramLookalike admins and bots offer private help or wallet recovery.
CommentsUnder YouTube videos, Medium posts and Reddit threads: recovery "experts" and signal groups.
EmailFake exchange or wallet alerts that link to a login page.
Job offersRecruiters on LinkedIn and elsewhere send a repository or an app to run.
Extension and app storesClones that copy a trusted name, icon and screenshots.
One rule covers every channel: nobody legitimate needs your seed phrase, and real support does not message you first.
06Daily habits
Small habits that block most attacks
None of these cost money. Set them up once and they keep working.
Bookmarks, not search
Open wallets, exchanges and dApps from your own bookmarks. Fake sites live in sponsored results, DMs and replies.
A separate browser profile
Use one profile, or one device, for crypto with only the wallet extension installed. Extensions with access to all sites can read and change the pages you open.
2FA that holds up
Use passkeys or a hardware security key where the exchange offers them, otherwise an authenticator app, never SMS. They protect the login, not what your wallet signs.
Lock exchange withdrawals
Turn on the withdrawal address allowlist. Where the exchange offers an anti-phishing code, set it so genuine emails show it.
Update from the source
Keep the OS, browser, wallet app and device firmware current. Update from inside the app or the maker's site, never from a link in a message.
Send with a check
Compare the whole address on the hardware wallet screen. For a large transfer, send a small test amount first.
Close your DMs
Discord: turn off “Allow direct messages from server members” (User Settings → Data & Privacy). Telegram: limit who can add you to groups. Fake support dies at the door.
Telegram two-step verification
Settings → Privacy and Security → Two-Step Verification. Without it, an SMS code is enough to take your account and any wallet inside it.
Disconnect and revoke
Disconnecting a site does not cancel its approvals, so do both. Clear old WalletConnect sessions and connected sites in your wallet.
Check names, not just addresses
ENS names can still look alike: the standard itself says not all valid names are visually unambiguous. Send to addresses you saved and verified.
Read advisories twice a year
Follow your wallet maker’s security page. Coldcard’s weak-seed advisory required moving to a new seed; a firmware update alone did not fix it.
Test new hardware small
Before a new device or firmware holds savings, receive and send a small amount, and verify the receive address on the device screen.
07Already compromised
Wallet drained? Do this now
Speed matters more than a perfect process. Work from a clean device, and verify every link yourself instead of following one sent to you.
Start with the truth: you will most likely not get the money back. Not because nobody cares. A confirmed transaction cannot be reversed, funds move faster than any procedure, and the few parties who can freeze assets need a police case, a jurisdiction and time. Anyone who opens with a different promise is selling something. What still makes sense: report, keep the evidence, close the remaining doors, and warn the next person.
If the seed phrase or private key leaked, that wallet is burned for good. Create a new one on a clean device and move the remaining assets. If a bot takes every bit of gas you send in, the address is being swept (often through an EIP-7702 delegation on a leaked key): stop and ask SEAL 911. On Solana and Tron, a signature can transfer ownership of the account itself; nobody can undo that.
4
Revoke approvals
If you only signed an approval and the seed is safe, revoking it closes that door. Check every chain you have used.
USDT and USDC can be frozen by their issuers, but only through legal process: individuals cannot ask directly. Tether acts on law-enforcement requests, and its T3 Financial Crime Unit with TRON and TRM Labs has frozen more than $450 million since September 2024. Circle acts on court or government orders. A freeze is not a refund: getting funds back still needs an official case and proof of ownership.
Tracing does not return funds, but it shows police and exchanges where the money is. Free tiers map the first hops. If funds reached an exchange, report to that exchange at once: speed decides whether it can act.
Report the drainer address and the phishing link, and file with the police: IC3 in the US, or your national police elsewhere. Keep transaction hashes, addresses, URLs, screenshots and UTC times.
Nobody can reverse a confirmed transaction. People who DM you after a public post are usually the next scam.
RECOVERY SCAMS
If they stole from you once, do not buy the second lie
Reading this calmly, you are sure you would never fall for it. That certainty is the weak spot. You will not meet a recovery scammer as the person reading this page. You will meet them as the person who just lost everything, has not slept for two days and is ashamed to tell the family. They sell exactly what that person wants to believe: that it is not too late, that the thief has been found, and that only a fee stands in the way.
The fix is not to be smarter. It is to decide now, while you are still the person reading this:
Never pay anyone who contacted you first.
No fee, tax, gas or “unlock” payment. The chain of payments never ends.
Nobody needs your seed phrase: not police, an exchange, us, or an AI.
Show the whole conversation to someone close to you, not a summary.
“We found your scammer”, “lawyers” and “recovery agencies” with websites, reviews and licences are a script.
Posting publicly about a loss puts you on lists that recovery scammers buy and work through.
“Hacking back” is a scam, and it can also make you a criminal.
This happens to careful, experienced people, and silence only helps the attacker. PhishDestroy does not recover funds, does not recommend recovery agents, and never contacts victims first. The zero-trust rule
08Report it
Report it, even if nobody calls back
PhishDestroy strongly recommends reporting every theft somewhere. At the very least in public: on X or Chainabuse, “this domain and this wallet took my funds”. Shame will not bring the money back. Investigators sometimes have the other side of a case and lack only a victim on record.
The minimum: say it in public
Post the domain, the receiving address and the transaction hash where people check before they connect a wallet. It takes five minutes and warns the next person. Our domain report form works even if all you have is the link.
Police seize scam wallets, sometimes years later and in another country. If you never reported, nothing ties that money to you, and you cannot claim it back.
There will be other victims
5 or 10 thousand can feel too small for anyone to care, and you may be right that nobody will investigate. But a drainer does not stop at one wallet. Your report helps get the site blocked and adds to the pattern.
Your own wallet can get flagged
Known drainers are watched. Addresses that touched them can be flagged, and an exchange may ask you questions later. A report filed at the time is your side of the story.
It costs nothing
In most of the world a police report is free and can be filed online. A few countries give crypto no legal status; there, check the local rules before you file.
A report promises nothing. If nobody knows except you, the chance of seeing that money again is exactly zero. With a report on file it is a little above zero, and the next victim has one more piece of evidence. The amount does not matter: report 50 dollars the same way as 50,000.
Report, do not demand
You need nothing from the police except a record that your funds were stolen.
Start with your local police or national cybercrime unit, through its official online form or email.
State the facts and ask for one thing: that the theft is recorded. Keep the reference number if you get one.
Send it and move on. You do not have to wait for an answer. If anyone ever investigates, the report on file is how you hear about it.
Never: argue with the officer or demand that they find the thief. Local police will most likely not investigate, and you do not need them to.
Never: write to Europol or the FBI at a general address instead of their reporting form. You may well get a reply, but start local and use the dedicated forms.
What to put in the report
No legal language and no perfect English needed. Facts, times and addresses.
The domain or link, and how you got there: an ad, a DM, a search result
What happened, in two or three plain sentences
Dates and times, with the time zone. UTC is best
Your wallet address and every address that received the funds
Official police and cybercrime routes for 97 countries, each checked against a government source. The same directory powers the report on every domain page.
Pick a country to see where to file and how to reach them.
Not on the list? Type your national police website address yourself and look for an online crime report. In the EU, Europol links to every national reporting page. In the US, file with IC3.
Write the report in two minutes
Fill in what you know; the text updates as you type. Paste it into the police form, an email or a public post. Nothing you type here leaves your browser.
This list is what we have used and checked, not the whole market. If a free tool for crypto security, phishing defence or privacy is missing, or a card here is wrong, tell us. Listing is free; we do not take paid placements or add fund-recovery services.
Links checked 19 Oct 2026. PhishDestroy is not affiliated with the third-party services listed here and is not paid to list them. Found a dead or wrong link? Tell us.
