# Ice phishing

Ice phishing is a crypto attack in which the victim is tricked into approving a malicious spender instead of sending funds, so the theft happens later through the approval.

## How it works

The term (coined by Microsoft) describes approval-based theft: the phishing page requests an approve() or similar permission that looks like part of a normal action.

The approval sits unused until the attacker calls transferFrom, which is why victims often notice the loss only days later.

## Example from the PhishDestroy database

- [rectification-fixuserauthentication.vercel.app](https://phishdestroy.io/domain/rectification-fixuserauthentication.vercel.app/): Domain classified as ice phishing, first detected 2026-01-02.
- [seaportal.fo](https://phishdestroy.io/domain/seaportal.fo/): Domain classified as ice phishing, first detected 2025-12-16.
- [rectifyissues-now.vercel.app](https://phishdestroy.io/domain/rectifyissues-now.vercel.app/): Domain classified as ice phishing, first detected 2025-12-01.

## How to protect yourself

- Check what an approval allows and for which amount; prefer exact amounts over unlimited ones.
- Review and revoke approvals you no longer need.

## Related tools

- [Signature Request Inspector](https://phishdestroy.io/developer-tools/sign-inspector)

## Related terms

- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [Permit phishing](https://phishdestroy.io/glossary/permit-phishing/)
- [setApprovalForAll](https://phishdestroy.io/glossary/setapprovalforall/)

## Further reading

- [Crypto Drainer Anatomy: $1.93B Stolen](https://phishdestroy.io/crypto-drainer-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/ice-phishing/