Ice phishing
Ice phishing is a crypto attack in which the victim is tricked into approving a malicious spender instead of sending funds, so the theft happens later through the approval.
How it works
The term (coined by Microsoft) describes approval-based theft: the phishing page requests an approve() or similar permission that looks like part of a normal action.
The approval sits unused until the attacker calls transferFrom, which is why victims often notice the loss only days later.
Example from the PhishDestroy database
- rectification-fixuserauthentication.vercel.app: Domain classified as ice phishing, first detected 2026-01-02.
- seaportal.fo: Domain classified as ice phishing, first detected 2025-12-16.
- rectifyissues-now.vercel.app: Domain classified as ice phishing, first detected 2025-12-01.
How to protect yourself
- Check what an approval allows and for which amount; prefer exact amounts over unlimited ones.
- Review and revoke approvals you no longer need.