What Is a Crypto Phishing Attack?

A crypto phishing attack is a fraud in which an attacker impersonates a trusted exchange, wallet, support channel or airdrop in order to trick the holder into revealing a seed phrase or private key, or into signing a blockchain transaction that hands over their assets. No cryptography is broken: the victim authorises the theft themselves, which is why the resulting transfer is valid on-chain and, in practice, irreversible.

That single property — the victim signs, so there is no chargeback and no issuer to appeal to — is what keeps phishing the most persistent threat to crypto holders, and why it works on experienced users as well as beginners.

Key Facts

• Phishing and spoofing were the most-reported crime type to the FBI in 2025, with 191,561 complaints and $215,843,126 in reported losses — up from $70,013,036 in 2024 and $18,728,550 in 2023. Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
• 181,565 complaints filed with the FBI in 2025 had a cryptocurrency nexus, accounting for $11.366 billion in losses, an average loss of $62,604, and 18,589 complainants who each lost more than $100,000. Source: FBI IC3, 2025 Internet Crime Report.
• Phishing kits make a crypto scam dramatically more profitable. Chainalysis found that "scams leveraging these phishing kits are 688 times more effective in dollar terms and four times more effective in average transaction size than regular scams." Source: Chainalysis, 2026 Crypto Crime Report: Scams.
• The average crypto scam payment rose from $782 in 2024 to $2,764 in 2025, a 253% year-on-year increase, while crypto scams overall received at least $14 billion on-chain in 2025. Source: Chainalysis, 2026 Crypto Crime Report: Scams.

What Are the Main Types of Crypto Phishing Attack?

How Do Fake Website Clones Work?

Scammers create pixel-perfect copies of popular exchanges, wallets, and DeFi platforms. URLs may differ by a single character (e.g., uniswap.org vs un1swap.org). These sites capture login credentials or prompt wallet connections that drain funds.

What Is a Malicious Token Approval?

Some phishing attacks trick users into approving unlimited token spending for a malicious contract. Once approved, the scammer can drain your wallet at any time. Always review approval amounts and revoke unnecessary approvals regularly.

How Do Scammers Harvest Seed Phrases?

No legitimate service will ever ask for your seed phrase. Scammers create fake support channels, wallet update notifications, and airdrop claims designed solely to harvest seed phrases.

What Is Ice Phishing?

Ice phishing is an attack in which the victim signs a seemingly harmless message or approval that in fact authorises a third-party contract to move their tokens. Nothing leaves the wallet at the moment of signing, so the attack looks harmless — the attacker simply exercises the approval later, at a time of their choosing. These attacks exploit the fact that many users don't carefully read what they're signing.

How Do You Protect Your Wallet From Phishing?

• Hardware wallets: Keep significant holdings on hardware wallets that require physical confirmation
• Bookmark official sites: Never access crypto platforms through links — type URLs directly or use bookmarks
• Verify contracts: Use block explorers to verify contract addresses before interacting
• Revoke approvals: Regularly audit and revoke unnecessary token approvals using tools like revoke.cash
• Separate wallets: Use different wallets for trading, DeFi, and long-term storage
• Never share seed phrases: No legitimate entity will ever ask for your recovery phrase

What Should You Do If You Have Already Been Phished?

Act in this order. Revoke any outstanding token approvals from the affected wallet, then move whatever balance remains to a new wallet whose seed phrase has never been typed into a website or shared with anyone. If a seed phrase was disclosed, treat every asset controlled by it as compromised, including assets on other chains. Record the transaction hashes, receiving addresses, the exact URL or handle used to reach you, and screenshots of the messages — those are the artefacts investigators work from.

In the United States, report to the FBI's Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov; elsewhere, report to your national financial regulator and police cybercrime unit. Treat anyone who contacts you afterwards offering to recover the funds for an up-front fee as a second scam.

Frequently Asked Questions

What is a crypto phishing attack?

A crypto phishing attack is a fraud in which an attacker impersonates a trusted exchange, wallet or support channel to trick the holder into revealing a seed phrase or private key, or into signing a blockchain transaction that hands over their assets. No cryptography is broken — the victim authorises the theft, which is why the transfer is valid on-chain and in practice irreversible.

How common are crypto phishing attacks?

Phishing and spoofing were the most-reported crime type to the FBI's Internet Crime Complaint Center in 2025, with 191,561 complaints and $215,843,126 in reported losses, up from $70,013,036 in 2024. Separately, 181,565 complaints filed with IC3 in 2025 had a cryptocurrency nexus and accounted for $11.366 billion in losses.

What is ice phishing in crypto?

Ice phishing is an attack in which the victim is persuaded to sign a token approval or message that authorises a third-party contract to move their tokens, rather than to transfer funds directly. Because nothing leaves the wallet when the signature is given, the attack appears harmless — the attacker exercises the approval later.

How do I stop a phishing attack that I have already approved?

Revoke the approval from the wallet that granted it, using a block explorer's approval tool or a revocation service such as revoke.cash. Until it is revoked, the attacker retains the right to move the approved tokens. Then move any remaining balance to a new wallet whose seed phrase has never been entered anywhere.

Where do I report a crypto phishing attack?

In the United States, report to the FBI's Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov. Keep the transaction hashes, receiving wallet addresses, the exact URL used and any messages, because those are what investigators use to trace funds. Any firm offering to recover your funds for an up-front fee should be treated as a second scam.