# PhishDestroy — crypto-security ================================================================ Title: Crypto Security: Wallets, Approvals, Drainers | PhishDestroy Canonical: https://phishdestroy.io/crypto-security Published: 2025-07-15 Updated: 2026-10-19 Author: PhishDestroy Research Schema: Organization, ImageObject, ContactPoint, WebSite, SearchAction, EntryPoint, WebPage, SpeakableSpecification, TechArticle, DefinedTerm, CreativeWork, BreadcrumbList, ListItem OG image: https://phishdestroy.io/assets/images/covers-v4/crypto-security.webp ## SUMMARY ---------------------------------------------------------------- Seed phrases, hardware wallets, token approvals, drainer and address-poisoning scams, and what to do if a wallet is drained. With a 14-point self-check. ## KEY FACTS ---------------------------------------------------------------- In short: Keep your seed phrase only on paper or metal, hold savings on a hardware wallet bought from the maker, and use separate vault, daily and burner wallets. Review token approvals monthly, reject signatures you cannot read, open sites from bookmarks and ignore unsolicited support. If drained, contact SEAL 911 first, revoke approvals, move what is left and report. - Self-check items: 14-point check (source: self-check ('Fourteen things to have in place'), https://phishdestroy.io/crypto-security; as of 2026-10-19) - Scam types covered: Twelve (source: https://phishdestroy.io/crypto-security ('Twelve scams to recognize on sight'); as of 2026-10-19) - Fund recovery: PhishDestroy does not offer fund recovery (source: 'Wallet drained?' section (it never contacts victims to sell it), https://phishdestroy.io/crypto-security; as of 2026-10-19) - First contact if drained: SEAL 911 (source: emergency steps (free, 24/7 incident triage from the Security Alliance), https://phishdestroy.io/crypto-security; as of 2026-10-19) - Police reporting directory: 97 countries (source: reporting directory (each route checked against a government source), https://phishdestroy.io/crypto-security; as of 2026-10-19) ## STRUCTURE ---------------------------------------------------------------- - Protect your crypto from phishing and drainers - In short - Fourteen things to have in place - Split your funds by risk - Vault - Daily - Burner - Seed phrase rules - Get the wallet from the maker - One seed, one vendor, one point of failure - Trust is never binary - When a trusted name failed - Build something that survives any single failure - A safe deposit box protects the object, not the secret - Reputation is not proof: xmrwallet.com - Read what you are actually promised - One signature can empty a wallet - Before you sign, check four things - Let the wallet warn you - Clean up old approvals once a month - Other networks, other mechanics - Twelve scams to recognize on sight - Lookalike sites and search ads - Fake airdrops and claim pages - Address poisoning - Fake support - Impersonators and giveaways - Malware dressed up as work - Fake extensions and apps - Recovery scams - Fake meeting apps and deepfake calls - A real site turned malicious - Clipboard hijackers - Telegram bots and mini apps - Where they reach you - Small habits that block most attacks - Bookmarks, not search - A separate browser profile - 2FA that holds up - Lock exchange withdrawals ## CONTENT ---------------------------------------------------------------- Crypto security guide · updated 19 Oct 2026 Protect your crypto from phishing and drainers Published 2025-07-15 · Updated 2026-10-19 Phishing doesn’t break encryption. It gets you to type a seed phrase, sign a permission or install a fake app. This guide shows how each trick works, what to set up so it fails, and what to do in the first hour if it already happened. Take the 14-point check Wallet drained? Act now 32 min readPhishDestroy ResearchLinks checked 19 Oct 2026 Signature requestEthereum 0pensea-rewards.com1 This site wants permission to: MethodsetApprovalForAll2 Operator0x7a3f…c91e3 Approvedtrue RejectConfirm Would you sign this? Three red flags: 1Lookalike domain. A zero instead of the letter “o”. 2Every NFT in the collection, now and later. 3Unknown operator, not a marketplace you use. No guarantees. No tool on this page is a guarantee. A hardware wallet can ship with weak randomness, an honest site can be swapped through a dependency, a genuine device can come back from a reseller with an extra board inside, and an audit covers only what was looked at, on that date. We are not offering a perfect product, because none exists. We are offering a setup that survives the failure of any single part, including the one you trust most. Including us. In short Keep your seed phrase only on paper or metal, hold savings on a hardware wallet bought from the maker, and use separate vault, daily and burner wallets. Review token approvals monthly, reject signatures you cannot read, open sites from bookmarks and ignore unsolicited support. If drained, contact SEAL 911 first, revoke approvals, move what is left and report. 01Self-check Fourteen things to have in place Tick what is already true. Each item links to the part of the guide that explains it. Your answers are saved only in this browser. 0of 14 Start with the first item you are unsure about. Re-check approvals and this list once a month. My seed phrase exists only on paper or metalNever typed into a website, photographed, or saved in cloud storage, notes or a password manager.Read more in Wallets Savings sit on a hardware wallet I bought from the makerNot from a reseller or marketplace, and set up by me from a blank device. This protects against tampering, not against a bug in the maker's own code.Read more in Wallets I read my wallet maker's security advisories in the last six monthsColdcard owners lived with a weak-seed bug until an advisory told them. Vendors publish fixes and migration steps, but you have to look.Read more in Trust I use a separate wallet for mints, airdrops and new sitesThe wallet with my savings never connects to a site I have not used before.Read more in Wallets I reviewed my token approvals this monthOld approvals stay valid until revoked, even for apps I stopped using.Read more in Signing My wallet shows what a transaction will do before I signBalance changes and risk warnings appear on the confirmation screen.Read more in Signing I reject any signature I cannot readRaw hex, a bare hash on the device, or a gasless "permit" I did not expect.Read more in Signing I open crypto sites from my own bookmarksNever from search ads, DMs, replies or links inside token names.Read more in Habits Exchange accounts use an authenticator app or security keySMS codes are off, and the email behind the account has its own 2FA.Read more in Habits Exchange withdrawals only go to allowlisted addressesFunds can only leave to addresses you added in advance.Read more in Habits I compare the whole address on the device screen before sendingNot just the first and last characters, and never copied from transaction history.Read more in Scams I ignore anyone who messages me first about support or recoveryReal support teams do not DM first and never need a seed phrase.Read more in Scams Strangers cannot DM me on Discord and TelegramFake support starts in DMs. Closing them costs nothing and stops most of it at the door.Read more in Habits I know who to contact if a wallet gets drainedSEAL 911 first, then revoke, move what is left and report.Read more in If drained 02Wallet setup Split your funds by risk A drainer can only take what sits in the wallet that signed. Keep savings in a wallet that almost never signs anything. Vault Hardware wallet Long-term holdings. It rarely connects to anything and only sends to addresses you already know. SavingsRarely signs Daily Hot wallet, small balance For the few apps you use every week. Keep only what you would be willing to lose this month. Trusted appsTop up as needed Burner Fresh address For mints, airdrops and any site you have not used before. Assume whatever sits here can be taken. New sitesNear-empty Seed phrase rules The seed phrase is the wallet. Whoever has the words has the funds, on any device. Write it on paper or stamp it into metal, and store it offline. Two copies in different places protect against fire and loss. Generate it on the hardware wallet itself. A list of valid words does not prove it was generated with enough randomness: three real wallet failures. If you add a passphrase (sometimes called the 25th word), store it apart from the seed. It opens a separate wallet, and if you forget it, the funds in that wallet are gone. Never: type it into a website, a form, a chat or a "wallet validation" page. No real service ever asks for it. Never: photograph it or keep it in cloud storage, email, notes or a password manager. Never: use a seed that came printed in the box or that someone else gave you. Get the wallet from the maker Order a hardware wallet from the maker’s own site, check the packaging, and set it up yourself from a blank device. Resold devices with hidden implants were used to steal seeds in 2026. What this does not cover: a bug in the maker’s own code. Buying direct did not help Coldcard owners whose seeds were generated weakly: the weak-seed case file. Hardware wallets, official sites Ledgerledger.com [https://www.ledger.com/]Trezortrezor.io [https://trezor.io/]Keystonekeyst.one [https://keyst.one/]BitBoxbitbox.swiss [https://bitbox.swiss/]Coldcardcoldcard.com · Bitcoin only; read the 2026 seed advisory [https://coldcard.com/]OneKeyonekey.so [https://onekey.so/]GridPlusgridplus.io · Lattice1 [https://gridplus.io/]Tangemtangem.com · card, no screen [https://tangem.com/] Browser wallets, official downloads MetaMaskmetamask.io/download [https://metamask.io/download]Rabbyrabby.io [https://rabby.io/] Install extensions only through the link on the official site. Fake wallet extensions get into stores: 150+ fake Mozilla extensions. One seed, one vendor, one point of failure For larger amounts, split the backup or the signing itself: Shamir shares, or a multisig across devices from different makers, with a recovery path for your heirs. Shamir backup (SLIP-39)Split the backup into shares; any 2 of 3 (for example) restore the wallet. [https://trezor.io/learn/advanced/standards-proposals/what-is-shamir-backup]NunchukBitcoin multisig and inheritance with on-chain timelocks. Free DIY plan; assisted plans are paid. [https://nunchuk.io/]LianaFree, open-source Bitcoin wallet with time-locked recovery paths for backup or inheritance. [https://lianawallet.com/]CasaManaged multi-key vaults with inheritance. Paid, from $250 a year. [https://casa.io/] 03No guarantees Trust is never binary The useful question is not “is this a good product?” but “what happens when it fails?”. Sooner or later every part fails: a bug, a breach at a supplier, an acquisition, a policy change, or bad luck. When a trusted name failed Engineering facts, not accusations. Each row links to the primary source. Who | What happened | The lesson | Source Coldcard Jul 2026 | A firmware bug weakened seed generation on Mk2/Mk3 (firmware 4.0.1–4.1.9) and on Mk4, Mk5 and Q before the fix. Coinkite puts Mk4/Mk5/Q seeds at about 72 bits instead of 128; BlockSec estimates Mk2/Mk3 at roughly 40 bits as an upper bound. Attackers rebuilt weak seeds offline. | A hardware wallet does not guarantee good randomness. | Coinkite advisory [https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/] Trust Wallet extension 2023 | Versions 0.0.172–0.0.182 made recovery phrases from 32 bits of randomness, so all possible wallets could be precomputed (CVE-2023-31290). | The whole keyspace can fit in one file. | Ledger Donjon [https://www.ledger.com/blog/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen] Libbitcoin Explorer 2023 | “Milk Sad”: bx seed seeded its generator from the system clock, limiting any seed length to 32 bits (CVE-2023-39910). | 24 words do not mean 256 bits. | Milk Sad disclosure [https://milksad.info/disclosure.html] Ledger 2020 | A marketing database leak exposed about a million emails, and a later dump held names, postal addresses and phones of about 272,000 customers. Phishing followed, and some customers were mailed tampered “replacement” devices. | A vendor can leak you, even when it never touches your keys. | Ledger [https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach] Ledger Connect Kit Dec 2023 | An attacker phished a former employee’s npm access and published a drainer inside a library that dApps load at runtime. The bad version stayed reachable for about five hours through CDN caching. | A genuine site can turn malicious overnight. | Ledger incident report [https://www.ledger.com/blog/security-incident-report] Ledger Recover May 2023 | An optional service that exports encrypted seed shares to three custodians. Critics said it showed a firmware update can open a path for seed-derived data to leave the device; Ledger says it needs explicit consent and exports only encrypted shares. | Trusting a device includes trusting its future firmware. | Ledger [https://www.ledger.com/blog/ledger-recover-a-message-from-pascal-gauthier-chairman-ceo-at-ledger] Ledger devices via resellers Oct 2026 | Criminals fitted genuine devices with hidden LTE implants that capture the 24 words during setup, then resold them in Southeast Asia. Ledger calls it a localized distribution attack; researchers documented Nano X units. Genuine Check cannot detect such add-ons. | A genuine-device check is not a tamper check. Buy direct. | Ledger [https://www.ledger.com/blog-response-hardware-implant-attack] Trezor One / Model T Jan 2020 | Kraken Security Labs extracted the seed with about 15 minutes of physical access and voltage-glitching equipment. | Open source does not mean physically unbreakable. | Kraken Security Labs [https://blog.kraken.com/post/3662/kraken-identifies-critical-flaw-in-trezor-hardware-wallets/] Trezor suppliers 2022–2026 | Phishing sent through its Mailchimp newsletter list (2022), a support-portal exposure of about 66,000 contacts (2024), and shipping and email-provider breaches (2026). | Your contact details live with the vendor’s suppliers. | Trezor [https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident] Safe{Wallet} → Bybit Feb 2025 | A tampered Safe web app showed Bybit’s signers a routine transfer; they blind-signed a hash that handed the cold wallet to the attacker. About $1.4–1.5 billion, attributed by the FBI to North Korea. | Multisig did not help: every signer trusted the same screen. | Sygnia investigation [https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/] FTX and Celsius 2022 | Both halted withdrawals and filed for bankruptcy; regulators later charged their founders with fraud. | Not your keys, not your coins. | FTX case [https://restructuring.ra.kroll.com/FTX/] UST and USDC 2022–2023 | TerraUSD lost its peg and collapsed in May 2022. In March 2023 USDC briefly traded below $1 while Circle had more than $3 billion of reserves stuck at the failed Silicon Valley Bank. | A “stable” coin is still a counterparty. | SEC (Terra) [https://www.sec.gov/newsroom/press-releases/2023-32] Apart from the custodial collapses, none of these were scams. Most are leaders in their category, with open code and audits. That is why the list matters: if the best fail, “pick the right product” cannot work as a strategy. Only “survive the failure of any one of them” does. Build something that survives any single failure Mix vendors in a multisig. A 2-of-3 on three identical devices shares one bug. Use different makers, chips and codebases so one flaw cannot take the quorum. Use independent seeds, not branches of one root. Vault, daily and burner wallets from one seed are one point of failure. Give each its own seed. Keep a passphrase apart from the seed. Stored and entered separately, it protects funds even if the seed or a device is compromised. Split storage methods and assets. Hardware, multisig, a little on an exchange behind an allowlist, an offline backup: they fail in different ways. One stablecoin means one issuer and one bank. Burn in new hardware with a small amount. Use a new device or firmware with a test balance before trusting it with savings. Write an access and inheritance plan. Who can reach the funds if you cannot, and how, without handing anyone the seed today. Re-check your assumptions every six months. Read your wallet maker’s security advisories. Coldcard owners lived with a weak-seed bug without knowing it until the advisory. A safe deposit box protects the object, not the secret A vault, a bank box or a trusted custodian sounds like full protection. It covers theft of the item, which is a different threat from a leaked seed. The seed may have been compromised before the device went into the box: weak generation, an implant, a photo. The seed works without the device. A thief needs the words, not the hardware. Trusted custody adds people, processes and their mistakes. Paper and metal burn, flood, get lost and get seized. Reputation is not proof: xmrwallet.com For ten years xmrwallet.com presented itself as a free, open-source Monero wallet run by volunteers. Our forensic work showed it sent users’ private view keys to its server on every login and swapped outgoing transactions server-side. Three registrars suspended its domains; NameSilo publicly defended the operator. Ten years without a scandal is not proof of honesty. Reputation measures only what has become known. Why it lasted ten years. None of these layers is technical sophistication: Reputation: a decade presented as a free volunteer project. Narrative: challenged, the operator replied that he had been running for years; the registrar then called the domain “compromised”. The coin: on Monero, a victim struggles to prove the theft did not start on some other phishing site. Infrastructure: bulletproof hosting behind DDoS-Guard, a registrar-run privacy service as the only public registrant, and a registrar that sided with the operator. Abuse reports had no one accountable to reach. The case file, IPFS archive [https://phishdestroy.eth.limo/]How the registrar defended it Read what you are actually promised The people who make your tools have written down what they are not responsible for. Short quotes, linked to the full text. Who | What the terms say | Source Open-source wallets (MIT licence) | “The software is provided ‘as is’, without warranty of any kind.” | MIT License [https://opensource.org/license/mit] Trezor hardware | “The maximum liability from the use of the Device shall be limited to the amount paid by you as a Device purchase price.” | Trezor Product Terms §9.2 [https://trezor.io/documents/product_terms_of_use.pdf] Ledger app | Not liable for damages resulting from “the unauthorized access to or alteration of your transmissions or data”. | Ledger Wallet Terms of Use [https://shop.ledger.com/pages/ledger-live-terms-of-use] Coinbase | “Coinbase is not liable for any loss that you may sustain due to the compromise of your account login credentials.” | Coinbase User Agreement §6.7 [https://www.coinbase.com/legal/user_agreement/united_states] Security audits | Assessments are “time-boxed”, and findings “should not be considered a comprehensive list”. | Trail of Bits report disclaimer [https://github.com/trailofbits/publications/blob/master/reviews/2025-04-reserve-folio-solidity-securityreview.pdf] Nobody signed up to be responsible for your savings, and they said so in writing. The only person responsible for your crypto is you: not because it sounds braver, but because legally and technically there is nobody else. Plan from that, not from the logo. 04Approvals and signing One signature can empty a wallet A drainer does not need your seed phrase. A single approval gives it the right to move your tokens or NFTs, and it can use that right days later. Details in Crypto drainer anatomy. Not sure what a request grants? Decode the wallet request before you sign it. RequestWhat it grantsWhat to do approve increaseAllowanceGrantsLets a contract spend one of your tokens, often with no limit on the amount.DoCheck who the spender is. Set an exact amount when the wallet lets you. setApprovalForAllGrantsGives an operator every NFT you hold in that collection, including ones you get later.DoOnly for a marketplace you chose to use. Never for a "claim" or a "free mint". permit and Permit2GrantsA signature with no gas and no transaction. It still grants an allowance that the other side can use later.DoTreat an unexpected gasless signature that names a token or an amount as an approval. Marketplace ordersGrantsA listing signature (Seaport, Blur and others) can sell your NFTs to the attacker for zero.DoRead the price and the recipient. Reject any listing you did not create. Unreadable dataGrantsRaw hex in the wallet or a bare hash on the hardware screen hides what you agree to.DoIf you cannot read it, reject it. If your device has a blind-signing setting, leave it off. EIP-7702 authorizationGrantsPoints your ordinary address at a contract. From then on that code runs your account with full access, until you clear it. Anyone can submit your signed authorization for you.DoReject it unless you started the upgrade in your own wallet. Etherscan shows whether your address is delegated; clear it in the wallet, because Revoke.cash only lists it. Before you sign, check four things 1Site. Is this the real domain, opened from your own bookmark? 2Action. Is it a login message, a transfer, an approval or a listing? 3Spender. Is the address a known contract or a random wallet? 4Amount and network. Is the amount exact, and is the wallet on the chain you expect? A phishing site may switch your wallet to another network. If the chain changes without you asking, stop. Let the wallet warn you Rabby [https://rabby.io/] scans each transaction for risks and shows the balance change before you sign. MetaMask [https://metamask.io/download] shows security alerts and estimated balance changes by default. Both depend on Basic Functionality in Settings, Privacy, so leave it on. Scam Sniffer [https://www.scamsniffer.io/]’s free extension warns when a site or an address is on its blocklists. A simulation is a preview, not a guarantee. A malicious contract can behave differently on-chain than it did in the test run, so the four checks still apply. Clean up old approvals once a month Approvals do not expire. Revoke anything you no longer use, especially unlimited ones. Revoking is a transaction, so it costs a little gas. Revoke.cash [https://revoke.cash/] Etherscan approvals [https://etherscan.io/tokenapprovalchecker] Other networks, other mechanics Everything above is about Ethereum-style chains. Elsewhere drainers ask you to sign different things, and Revoke.cash does not help. Know what your network’s dangerous signature looks like. Network | What you might be asked to sign | How to check | How to clean up Solana | Batch requests (signAllTransactions) the site can broadcast later; durable-nonce transactions that never expire (Drift lost about $270M to pre-signed ones in April 2026); token delegates; Assign/SetAuthority that hands over account ownership with no balance change. | Read every transaction in a batch. Turn off Phantom auto-confirm. Treat an authority change with “no balance change” as a red flag, not a reassurance. | Delegates: Famous Fox Revoker [https://famousfoxes.com/revoker] (Phantom’s pick) or Solflare → Settings → Security and Privacy → Spending Approvals. Disconnecting a site is not revoking. A transferred owner cannot be revoked. Tron | An AccountPermissionUpdate that moves your owner or active permission to the attacker. Multisig traps after a leaked seed. Bait wallets whose seed is “accidentally” posted online. | TronLink extension: More → Account Permissions. TronLink app: More → Security Detection. A “Multisig” label you did not add means trouble. | Once ownership moved, your key no longer controls the account. Anyone offering to “restore” it is the next scam. TON | The transaction you confirm after a TON Connect request inside a Telegram bot or mini app. Fake tokens with famous names. Tiny transfers whose comment says your wallet is “suspended”. | Connecting only shares your address: read the amount and recipient of every confirmation. Keeper marks unverified tokens. | Keeper (formerly Tonkeeper): Browser → Connected → hold the icon → Remove. Walt (formerly Wallet in Telegram): DeFi Account → Settings → Connected Apps. Bitcoin | A PSBT built by compromised software. Clipboard malware that swaps the address you copied. Fake wallet apps in official stores. | The hardware wallet screen is the truth: address, amount and change output. Sparrow [https://sparrowwallet.com/] shows full transaction details before you sign. | There are no approvals to revoke. If malware is possible, move funds from a clean device. Sui | One programmable transaction block can bundle up to 1,024 operations. | Read the whole request, not the first line. | — Aptos | A key rotation keeps your address but changes who controls it. | Only rotate keys from your own wallet’s settings, never because a site or “support” asks. | — Cosmos (Keplr) | Authz grants: a “generic” grant is unrestricted and may never expire. Scam governance proposals with links. | Check what a grant allows and for how long. | Revoke a grant with MsgRevoke from your wallet. Report scam proposals to Keplr’s public phishing block list. 05Recognize the scam Twelve scams to recognize on sight Each one ends the same way: you open a link, type a seed phrase, install something or sign. Learn the tell and the trick stops working. Lookalike sites and search ads A copy of a wallet, exchange or dApp on a domain that is one word or one character off, often pushed through sponsored search results. TellExtra words like "claim", "app" or "support" in the domain, hyphens, or an unusual ending. Who registers these domains Fake airdrops and claim pages A token or NFT you never bought appears in your wallet, or a post announces an airdrop. The claim page asks you to connect and sign. TellCountdowns, "claim before it expires", and website addresses written inside token names. How drainer kits work Address poisoning The attacker sends you a zero-value or tiny transfer from an address that starts and ends like one you use, hoping you copy it from your history next time. TellSmall transfers you did not expect, from addresses that only match at the edges. Compare the address with your history before you copy it. Chainalysis on address poisoning [https://www.chainalysis.com/blog/address-poisoning-scam/] Fake support You post a question in Discord or Telegram. A "moderator" or "support agent" messages you with a ticket link or a "wallet sync" page. TellThey message first, and the page wants your seed phrase or a signature. Impersonators and giveaways Cloned accounts of founders, projects and exchanges reply under popular posts with giveaways, mints, or "send 1, get 2 back". TellA handle with one extra character, a fresh account, a link that does not match the official site. Malware dressed up as work A recruiter, client or "advertiser" asks you to run a coding test, install a meeting app or open a media-kit viewer. The program is a stealer. TellPressure to install one specific program from a link they send. Case: $100K returned Fake extensions and apps Clones of wallet and security extensions in browser and app stores steal seed phrases or change transaction details. TellAn unknown publisher, few or odd reviews, permissions the tool should not need. 150+ fake extensions, one backend Recovery scams After a loss, "recovery experts" promise to trace or reverse the theft for an upfront fee, then ask for more. TellGuaranteed results, fees paid in crypto, and contact that started after you posted publicly. Emergency guide Fake meeting apps and deepfake calls A known contact’s hijacked Telegram books a call through Calendly. The meeting link is a lookalike of Zoom or Teams, the faces may be deepfakes or recordings, and then comes an “audio fix”, “SDK update” or extension to install. North Korea-linked groups have run this against founders, traders and community managers since 2024. TellAny request to install something or paste a command to join or fix a call; a meeting domain that is not the real one; video, but no live check. FBI warning [https://www.ic3.gov/psa/2024/psa240903] A real site turned malicious The genuine domain, or a library it loads, gets compromised. Ledger Connect Kit put a drainer on many real dApps in December 2023; hijacked domains at Squarespace pointed DeFi sites at drainers in July 2024. TellA familiar site suddenly asks for an approval, a new kind of signature or a network switch you did not expect. Who lets domains get hijacked Clipboard hijackers Malware watches what you copy and swaps a crypto address for the attacker’s. Found in fake Tor Browser installers and trojanized Telegram and WhatsApp apps. TellThe pasted address differs from the source anywhere, not only at the ends. Telegram bots and mini apps Unofficial wallet bots, referral schemes and fake mini apps inside Telegram take your TON or hijack your Telegram login, which often holds a wallet. TellA bot or mini app that is not linked from the project’s official site, or a confirmation you did not expect. Bookmarks protect you from phishing, not from a compromised real site. Ledger Connect Kit, hijacked domains and poisoned npm packages all served drainers from addresses people trusted. Checking what you are about to sign stays the last line of defence, every time. Where they reach you The channel changes. The request stays the same. Search adsA sponsored result for a wallet or exchange leads to a lookalike domain. X repliesImpersonator accounts reply with a giveaway or a "support" link. Discord DMsFake moderators write after you post in a support channel. TelegramLookalike admins and bots offer private help or wallet recovery. CommentsUnder YouTube videos, Medium posts and Reddit threads: recovery "experts" and signal groups. EmailFake exchange or wallet alerts that link to a login page. Job offersRecruiters on LinkedIn and elsewhere send a repository or an app to run. Extension and app storesClones that copy a trusted name, icon and screenshots. One rule covers every channel: nobody legitimate needs your seed phrase, and real support does not message you first. 06Daily habits Small habits that block most attacks None of these cost money. Set them up once and they keep working. Bookmarks, not search Open wallets, exchanges and dApps from your own bookmarks. Fake sites live in sponsored results, DMs and replies. A separate browser profile Use one profile, or one device, for crypto with only the wallet extension installed. Extensions with access to all sites can read and change the pages you open. 2FA that holds up Use passkeys or a hardware security key where the exchange offers them, otherwise an authenticator app, never SMS. They protect the login, not what your wallet signs. Lock exchange withdrawals Turn on the withdrawal address allowlist. Where the exchange offers an anti-phishing code, set it so genuine emails show it. Update from the source Keep the OS, browser, wallet app and device firmware current. Update from inside the app or the maker's site, never from a link in a message. Send with a check Compare the whole address on the hardware wallet screen. For a large transfer, send a small test amount first. Close your DMs Discord: turn off “Allow direct messages from server members” (User Settings → Data & Privacy). Telegram: limit who can add you to groups. Fake support dies at the door. Telegram two-step verification Settings → Privacy and Security → Two-Step Verification. Without it, an SMS code is enough to take your account and any wallet inside it. Disconnect and revoke Disconnecting a site does not cancel its approvals, so do both. Clear old WalletConnect sessions and connected sites in your wallet. Check names, not just addresses ENS names can still look alike: the standard itself says not all valid names are visually unambiguous. Send to addresses you saved and verified. Read advisories twice a year Follow your wallet maker’s security page. Coldcard’s weak-seed advisory required moving to a new seed; a firmware update alone did not fix it. Test new hardware small Before a new device or firmware holds savings, receive and send a small amount, and verify the receive address on the device screen. Running a project or a treasury? Teams get targeted with fake partners, fake hires and malware. Add these on top. In February 2025 Bybit’s signers used a Safe multisig with hardware wallets, and still approved the attack: the web app showed a routine transfer and the devices showed only a hash. Basic hygiene was in place. What was missing was a check that did not depend on the same screen. A multisig such as Safe [https://safe.global/], with signers on hardware wallets from different makers. Verify the transaction hash outside the web app. Recompute it on a second device with safe-tx-hashes-util [https://github.com/pcaversaccio/safe-tx-hashes-util] or OpenZeppelin Safe Utils [https://safeutils.openzeppelin.com/] (an unaudited proof of concept), and compare it with the hardware screen. Reject any delegatecall (operation 1) you cannot explain. That is what emptied Bybit’s wallet. Prefer clear signing over blind signing. ERC-7730 shows calls in plain language; it is still a draft, live on Ledger, Trezor Safe 3/5/7 and Model T, Ambire and Gemini. Simulate before signing: Tenderly [https://docs.tenderly.co/simulations/overview] is built into Safe; BlockSec Phalcon [https://blocksec.com/phalcon/security] and Hypernative [https://www.hypernative.io/] add monitoring and automated blocking. A dedicated signing machine with nothing else on it, withdrawal allowlists and time-locks on exchanges, and an incident plan written before you need it. 07Already compromised Wallet drained? Do this now Speed matters more than a perfect process. Work from a clean device, and verify every link yourself instead of following one sent to you. Start with the truth: you will most likely not get the money back. Not because nobody cares. A confirmed transaction cannot be reversed, funds move faster than any procedure, and the few parties who can freeze assets need a police case, a jurisdiction and time. Anyone who opens with a different promise is selling something. What still makes sense: report, keep the evidence, close the remaining doors, and warn the next person. Message SEAL 911 [https://t.me/seal_911_bot] Full emergency guide PhishDestroy does not offer fund recovery and never contacts victims to sell it. 1 Stop and switch devices Do not sign anything else and do not connect to "fix" sites. If you suspect malware, work from a clean device. 2 Message SEAL 911 Free, 24/7 incident triage from the Security Alliance. Send the chain, your address, the attacker's address and the transaction hash. t.me/seal_911_bot [https://t.me/seal_911_bot]Malware guide [https://securityalliance.org/go/malware] 3 Move what is left If the seed phrase or private key leaked, that wallet is burned for good. Create a new one on a clean device and move the remaining assets. If a bot takes every bit of gas you send in, the address is being swept (often through an EIP-7702 delegation on a leaked key): stop and ask SEAL 911. On Solana and Tron, a signature can transfer ownership of the account itself; nobody can undo that. 4 Revoke approvals If you only signed an approval and the seed is safe, revoking it closes that door. Check every chain you have used. revoke.cash [https://revoke.cash/] 5 Ask the police to request a freeze USDT and USDC can be frozen by their issuers, but only through legal process: individuals cannot ask directly. Tether acts on law-enforcement requests, and its T3 Financial Crime Unit with TRON and TRM Labs has frozen more than $450 million since September 2024. Circle acts on court or government orders. A freeze is not a refund: getting funds back still needs an official case and proof of ownership. Tether law-enforcement policy [https://tether.to/en/legal/?tab=law-enforcement-requests]Circle access-denial policy [https://www.circle.com/legal/usdc-terms] 6 Trace where it went Tracing does not return funds, but it shows police and exchanges where the money is. Free tiers map the first hops. If funds reached an exchange, report to that exchange at once: speed decides whether it can act. MistTrack [https://misttrack.io/]MetaSleuth [https://metasleuth.io/]Arkham [https://arkm.com/]Kraken report form [https://support.kraken.com/articles/phishing-scams] 7 Report and keep evidence Report the drainer address and the phishing link, and file with the police: IC3 in the US, or your national police elsewhere. Keep transaction hashes, addresses, URLs, screenshots and UTC times. Where to report in your country Chainabuse [https://chainabuse.com/report]PhishDestroy IC3 [https://www.ic3.gov/]MetaSleuth report [https://metasleuth.io/report-scam]ChainPatrol [https://chainpatrol.com/report] 8 Ignore recovery offers Nobody can reverse a confirmed transaction. People who DM you after a public post are usually the next scam. RECOVERY SCAMS If they stole from you once, do not buy the second lie Reading this calmly, you are sure you would never fall for it. That certainty is the weak spot. You will not meet a recovery scammer as the person reading this page. You will meet them as the person who just lost everything, has not slept for two days and is ashamed to tell the family. They sell exactly what that person wants to believe: that it is not too late, that the thief has been found, and that only a fee stands in the way. The fix is not to be smarter. It is to decide now, while you are still the person reading this: Never pay anyone who contacted you first. No fee, tax, gas or “unlock” payment. The chain of payments never ends. Nobody needs your seed phrase: not police, an exchange, us, or an AI. Show the whole conversation to someone close to you, not a summary. “We found your scammer”, “lawyers” and “recovery agencies” with websites, reviews and licences are a script. Posting publicly about a loss puts you on lists that recovery scammers buy and work through. “Hacking back” is a scam, and it can also make you a criminal. This happens to careful, experienced people, and silence only helps the attacker. PhishDestroy does not recover funds, does not recommend recovery agents, and never contacts victims first. The zero-trust rule 08Report it Report it, even if nobody calls back PhishDestroy strongly recommends reporting every theft somewhere. At the very least in public: on X or Chainabuse, “this domain and this wallet took my funds”. Shame will not bring the money back. Investigators sometimes have the other side of a case and lack only a victim on record. The minimum: say it in public Post the domain, the receiving address and the transaction hash where people check before they connect a wallet. It takes five minutes and warns the next person. Our domain report form works even if all you have is the link. Chainabuse [https://chainabuse.com/report] Report the domain Write the post If the wallet is ever seized Police seize scam wallets, sometimes years later and in another country. If you never reported, nothing ties that money to you, and you cannot claim it back. There will be other victims 5 or 10 thousand can feel too small for anyone to care, and you may be right that nobody will investigate. But a drainer does not stop at one wallet. Your report helps get the site blocked and adds to the pattern. Your own wallet can get flagged Known drainers are watched. Addresses that touched them can be flagged, and an exchange may ask you questions later. A report filed at the time is your side of the story. It costs nothing In most of the world a police report is free and can be filed online. A few countries give crypto no legal status; there, check the local rules before you file. A report promises nothing. If nobody knows except you, the chance of seeing that money again is exactly zero. With a report on file it is a little above zero, and the next victim has one more piece of evidence. The amount does not matter: report 50 dollars the same way as 50,000. Report, do not demand You need nothing from the police except a record that your funds were stolen. Start with your local police or national cybercrime unit, through its official online form or email. State the facts and ask for one thing: that the theft is recorded. Keep the reference number if you get one. Send it and move on. You do not have to wait for an answer. If anyone ever investigates, the report on file is how you hear about it. Never: argue with the officer or demand that they find the thief. Local police will most likely not investigate, and you do not need them to. Never: write to Europol or the FBI at a general address instead of their reporting form. You may well get a reply, but start local and use the dedicated forms. What to put in the report No legal language and no perfect English needed. Facts, times and addresses. The domain or link, and how you got there: an ad, a DM, a search result What happened, in two or three plain sentences Dates and times, with the time zone. UTC is best Your wallet address and every address that received the funds Transaction hashes and the network Amount and asset, and screenshots you have kept Let the form below write it Where to report in your country Official police and cybercrime routes for 97 countries, each checked against a government source. The same directory powers the report on every domain page. Your countryChoose a country…AlgeriaArgentinaArmeniaAustraliaAustriaAzerbaijanBahrainBangladeshBelgiumBrazilBulgariaCambodiaCameroonCanadaChileChinaColombiaCôte d’IvoireCroatiaCyprusCzechiaDenmarkDominican RepublicEcuadorEgyptEstoniaEthiopiaFinlandFranceGeorgiaGermanyGhanaGreeceHong KongHungaryIcelandIndiaIndonesiaIraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKuwaitLatviaLebanonLithuaniaLuxembourgMalaysiaMaltaMexicoMoroccoMyanmar (Burma)NepalNetherlandsNew ZealandNigeriaNorwayOmanPakistanPeruPhilippinesPolandPortugalQatarRomaniaRussiaSaudi ArabiaSenegalSerbiaSingaporeSlovakiaSloveniaSouth AfricaSouth KoreaSpainSri LankaSwedenSwitzerlandTaiwanTanzaniaThailandTrinidad & TobagoTunisiaTürkiyeUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesUzbekistanVenezuelaVietnam Pick a country to see where to file and how to reach them. Not on the list? Type your national police website address yourself and look for an online crime report. In the EU, Europol links to every national reporting page [https://www.europol.europa.eu/report-a-crime/report-cybercrime-online]. In the US, file with IC3 [https://www.ic3.gov/]. Write the report in two minutes Fill in what you know; the text updates as you type. Paste it into the police form, an email or a public post. Nothing you type here leaves your browser. Post on X [https://x.com/intent/post] Chainabuse [https://chainabuse.com/report] Check every address and hash against your wallet history before you send it. 09Tools Tools worth bookmarking Official addresses only, each one opened and checked on 19 Oct 2026. Bookmark them from here rather than searching for them later. Approvals and signing EVM networks Revoke.cash [https://revoke.cash/] revoke.cash See and revoke token and NFT approvals on more than 80 networks. It lists EIP-7702 delegations but cannot clear them. Approvals Etherscan Token Approvals [https://etherscan.io/tokenapprovalchecker] etherscan.io/tokenapprovalchecker The block explorer’s own approval checker for Ethereum, with revoke on the same page. Approvals Rabby Wallet [https://rabby.io/] rabby.io EVM wallet that scans each transaction and shows the balance change before you sign. Signing MetaMask [https://metamask.io/download] metamask.io/download Official download. Security alerts and previews are on by default and need Basic Functionality left on. Wallet Scam Sniffer [https://www.scamsniffer.io/] scamsniffer.io Free extension that warns when a site or address is on its crypto scam blocklists. Browsing Pocket Universe [https://www.kerberus.com/] kerberus.com Extension that warns about malicious sites and transactions before you sign. Owned by Kerberus since 2025; free tier. Signing Check a token before you touch it Simulations and scanners, not guarantees GoPlus Security [https://gopluslabs.io/] gopluslabs.io Free token security check, extension and API for addresses, approvals and dApps. Tokens Honeypot.is [https://honeypot.is/] honeypot.is Simulates a buy and a sell on Ethereum, BNB Chain and Base to see whether you could ever sell the token. Tokens De.Fi Scanner [https://de.fi/scanner] de.fi/scanner Risk scan for token, NFT and contract addresses on EVM chains, now also Solana tokens. Contracts Token Sniffer [https://tokensniffer.com/] tokensniffer.com Scans token contracts for scam patterns and copied code. Free for one token at a time. Tokens Trace and report After a theft SEAL 911 [https://t.me/seal_911_bot] t.me/seal_911_bot Security Alliance’s 24/7 incident bot on Telegram. Start here if a wallet is being drained now. Emergency MistTrack [https://misttrack.io/] misttrack.io SlowMist’s fund tracer and address-risk check. Free Light version; Premium is paid. Tracing MetaSleuth [https://metasleuth.io/] metasleuth.io BlockSec’s visual fund-flow tracer, with a free plan and a public scam-report form. Tracing Report a scam [https://metasleuth.io/report-scam] Arkham [https://arkm.com/] arkm.com Explorer that labels addresses with the exchanges and entities behind them. Tracing Chainabuse [https://chainabuse.com/] chainabuse.com Check an address or URL against community reports and file your own. Report ChainPatrol [https://chainpatrol.com/report] chainpatrol.com/report Report a scam site or account for takedown, free. The company is paid by projects for brand protection. Report FBI IC3 [https://www.ic3.gov/] ic3.gov US cybercrime complaints. Elsewhere, file with your national police or cybercrime unit. Report SEAL malware guide [https://securityalliance.org/go/malware] securityalliance.org/go/malware Steps for a device that may carry a stealer. Emergency Other networks Different chains, different cleanup Phantom [https://phantom.com/] phantom.com Multichain wallet. Settings → Connected Apps to disconnect apps and end auto-confirm. Solana Famous Fox Revoker [https://famousfoxes.com/revoker] famousfoxes.com/revoker Revokes Solana token delegates; the tool Phantom’s help centre points to. Solana Solflare [https://solflare.com/] solflare.com Solana wallet with Spending Approvals under Settings → Security and Privacy. Solana Solscan [https://solscan.io/] solscan.io Solana explorer for addresses, tokens and transactions. Solana TronScan [https://tronscan.org/] tronscan.org TRON explorer: look up an account’s permissions and transactions. Tron Keeper [https://keeperwallet.com/] keeperwallet.com Formerly Tonkeeper. Remove connected apps under Browser → Connected. TON Keplr [https://www.keplr.app/] keplr.app Cosmos wallet; manage accounts and report scam proposals to its block list. Cosmos Sparrow Wallet [https://sparrowwallet.com/] sparrowwallet.com Free desktop Bitcoin wallet for hardware devices, with full PSBT details before signing. Bitcoin Teams and treasuries Verify outside the web app Safe [https://safe.global/] safe.global Multisig smart accounts. Shows domain, message and Safe transaction hashes to compare with the device. Multisig safe-tx-hashes-util [https://github.com/pcaversaccio/safe-tx-hashes-util] github.com/pcaversaccio/safe-tx-hashes-util Recomputes a Safe transaction’s hashes on your own machine, independent of the web app. Verify OpenZeppelin Safe Utils [https://safeutils.openzeppelin.com/] safeutils.openzeppelin.com Browser tool for the same hash check. Its README calls it an unaudited proof of concept. Verify Tenderly [https://docs.tenderly.co/simulations/overview] docs.tenderly.co/simulations/overview Simulates a transaction before it is sent: decoded trace, balance and storage changes. Built into Safe. Simulate Accounts and links Before and after Have I Been Pwned [https://haveibeenpwned.com/] haveibeenpwned.com Check whether the email behind your exchange accounts was in a breach. Accounts urlscan.io [https://urlscan.io/] urlscan.io Open a suspicious link in its browser and see the redirects and every domain it contacts. Links Binance Verify [https://www.binance.com/en/official-verification] binance.com/en/official-verification Check whether a site, email, phone or Telegram account really belongs to Binance. Exchange OKX channel verification [https://www.okx.com/support-center/channel-verification] okx.com/support-center/channel-verification Check whether a phone number or other contact really belongs to OKX. Exchange From PhishDestroy Report a phishing site phishdestroy.io/report Paste a link or domain. We check it against eight sources and notify the providers responsible. PhishDestroy @PhishDestroy_bot [https://t.me/PhishDestroy_bot] JS Analyzer phishdestroy.io/js-analyzer See what a suspicious page's code does without running it, including drainer calls such as Permit2 and unlimited approvals. PhishDestroy Phishing wallets database phishdestroy.io/phishing-wallet A research dataset of addresses tied to phishing and wallet drainers, across 19 networks. PhishDestroy Destroylist [https://github.com/phishdestroy/destroylist] github.com/phishdestroy/destroylist Our free blocklist of phishing and scam domains, ready for DNS filters, firewalls and browsers. PhishDestroy GitLab mirror [https://gitlab.com/phishdestroy/destroylist] We have probably forgotten someone This list is what we have used and checked, not the whole market. If a free tool for crypto security, phishing defence or privacy is missing, or a card here is wrong, tell us. Listing is free; we do not take paid placements or add fund-recovery services. Suggest a tool Report a wrong card Keep going Wallet drained? Emergency guideFive steps in order, SEAL 911 first, and how recovery scammers find victims. Crypto drainer anatomyHow drainer kits work, from the fake page to the signature that empties a wallet. Personal security checklistPasswords, browser, phone and network hardening beyond your wallets. Tools for fighting phishingFree tools to check, report and take down phishing sites. Links checked 19 Oct 2026. PhishDestroy is not affiliated with the third-party services listed here and is not paid to list them. Found a dead or wrong link? Tell us. ## EXTERNAL REFERENCES ---------------------------------------------------------------- github.com (7 mentions) www.ledger.com (6 mentions) t.me (6 mentions) trezor.io (4 mentions) www.ic3.gov (4 mentions) metasleuth.io (4 mentions) chainabuse.com (4 mentions) gitlab.com (3 mentions) metamask.io (3 mentions) rabby.io (3 mentions) revoke.cash (3 mentions) phishdestroy.eth.limo (2 mentions) www.scamsniffer.io (2 mentions) etherscan.io (2 mentions) famousfoxes.com (2 mentions) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/crypto-security If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.