What is phishing?

Would you hand over your house keys to someone just because they’re wearing a repair technician’s uniform? In phishing, the “uniform” can be an email with your exchange’s logo, a fake support profile or a website that looks identical to the real one.

The scenario usually pressures you to hurry: “your account is being locked,” “suspicious login detected” or “you are eligible for an airdrop.” The link leads to a fake page that asks you to log in or enter your seed phrase, i.e. the words that let you recover your wallet. Whatever you type ends up with the scammer.

Why it matters

In crypto, the attacker doesn’t always need to break into a system. They can persuade you to open the door for them. If they get your seed phrase or private key, they can control the corresponding wallet. Confirmed transfers usually can’t be reversed like a card charge.

There is also phishing that doesn’t ask for any secret code. A fake app can show you a signature or approval request that allows specific tokens to be transferred. Simply connecting a wallet is not the same as permission to transfer, but whatever you sign afterward needs to be checked separately.

What to watch out for

We focus on the website’s address and the content of the request, not on how convincing the message looks. An HTTPS padlock means an encrypted connection, not that the page is genuine. Even a real social media account can be hacked.

• Open the service from your own saved link rather than from unexpected messages.
• Don’t give your seed phrase or private key to support staff, verification forms or pages promising giveaways.
• Read what each signature allows. A hardware wallet doesn’t protect you from a malicious approval that you accept yourself.

If you gave away an exchange password, change it through the official service and contact its support. If you signed a malicious approval, disconnecting the site isn’t enough: you need to revoke the permission in question. If you revealed your seed phrase, the wallet is considered compromised, and changing the app’s password doesn’t secure it; you need a new wallet with a new recovery phrase for whatever assets are left.