How the most common attacks on crypto holders work, the warning signs to look for, and the habits that defend against them – in plain language.
Attackers impersonate wallets, exchanges or their support teams through look-alike websites, emails, text messages and social-media DMs. The goal is usually to get you to type in your recovery phrase, log in on a fake page, or approve a malicious transaction.
Attackers generate wallet addresses whose first and last characters match an address you've used. They send a zero-value or tiny transfer from it so it appears in your transaction history. If you later copy the "familiar" address from your history, your funds go to the attacker.
Some malware monitors what you copy. When it detects a crypto address, it replaces it with one controlled by the attacker. When you paste, the address is different – but it can look similar enough to pass a quick glance.
On many blockchains, apps request permission ("approval") to move specific tokens on your behalf. Malicious sites can request broad or unlimited approvals, or ask you to sign off-chain messages (such as "permit" signatures) that grant similar access without an obvious on-chain transaction at the time.
A criminal uses stolen personal information or social engineering to convince a mobile carrier to transfer your phone number to their SIM card. They then receive your text-message codes and can reset passwords on email and exchange accounts.
Counterfeit wallet apps and browser extensions imitate real ones. Once you "import" your wallet by entering your recovery phrase, the attacker has it. Fake sites may also appear in search results or be promoted through links in messages.
Scammers build trust over days or weeks – sometimes through a friendship or romantic relationship – then introduce a "can't-lose" trading platform or opportunity. Early "profits" shown on a fake dashboard encourage larger deposits that can't be withdrawn. Giveaway scams promise to "double" any crypto you send.
After someone loses crypto, they may be contacted by people claiming to be investigators, lawyers, hackers or even government agencies who can "recover" the funds – for an upfront fee. These offers frequently target people who have already been victimized.
Crypto transactions on public blockchains are visible to anyone. If your identity is linked to a wallet – for example through social-media posts or screenshots – your balance can become public knowledge, making you a target for phishing, extortion or, in rare cases, physical threats.
Find out in about 60 seconds and get your personalized defense checklist.
This guide provides general educational information and is not a substitute for professional security, legal or financial advice. Threats evolve quickly; always verify information with official sources.
