What Is Phishing in Crypto and How Do You Spot It?

What does crypto phishing look like?

The classic move: something creates urgency — an email about a login from abroad, a DM about an airdrop you qualified for, a search-ad “Binance” that’s actually binnance-secure.com — and then a pixel-perfect copy of the real site. You enter your password and 2FA code into the fake; the attacker’s automation relays them to the real site within seconds and logs in as you. Modern phishing kits defeat every “check the design” instinct, because the design is real. The URL is the only fingerprint that can’t be faked, which is why navigation discipline beats vigilance: don’t evaluate links, refuse to click them.

The more advanced variant skips passwords entirely: a DeFi site asks your wallet to sign an “approval” that grants a contract unlimited rights to a token, and the drain happens later while you sleep — sometimes weeks later, when you’ve forgotten you ever signed. Both run on the same engine: a moment of diverted attention.

The pattern library, condensed

Every phishing play in crypto is one of a handful of shapes:

Notice the common thread: every row requires you to act on their timeline. Slowness — typing the URL yourself, waiting a day before claiming anything, asking “why does support need this?” — dissolves nearly all of it.

Which defenses actually work?

Three, layered. Navigation discipline: never click into a financial site from email, DM, or search ads — type the address or use your own bookmark, every time. Phrase hygiene: the moment anyone, in any channel, asks for your seed phrase, the conversation is over; the answer is always no. Signature awareness: when a wallet pops a confirmation, read the actual permission being requested, not just the branding around it — unlimited token approvals are a red flag most wallets now warn about, and periodic approval revocation is cheap insurance.

You clicked. Now what?

Speed matters because attackers automate the cash-out. For an exchange account: change the password immediately, revoke active sessions and API keys, and contact the exchange’s real support — freezes sometimes work if you’re fast. For a wallet signature: move remaining funds to a fresh wallet (new keys, new phrase), then revoke old approvals using a token-allowance tool. And accept the loss honestly if funds are gone — “recovery services” that DM you afterward are the second scorpion of the phishing scam, and they will ask for a fee and your seed phrase.

Approval hygiene: auditing what you’ve already signed

Phishing defense usually focuses on the next click, but the dangerous clicks you already made can linger for months. Token approvals — permissions granted to contracts to move your tokens — don’t expire, and unlimited approvals are common enough that many users carry a dozen standing invitations without knowing it.

The quarterly routine:

1. Open an allowance checker (revoke.cash, or your wallet’s built-in approvals view) and connect the wallet — read-only, signing nothing.
2. Read the list. Every row is a contract allowed to spend a token. Recognition test: anything you don’t remember approving gets revoked.
3. Revoke by default. Revoking costs a small fee and nothing else; you can always re-approve when you actually need the protocol again.
4. Prioritize unlimited approvals on tokens with real value — those are the standing balances attackers monetize when any spender contract turns out to be malicious later.

This habit closes the “weeks later” drain: the exploit that gets published for a protocol you used in March can’t hurt the November you if November-you revoked the March approval. It’s ten minutes a quarter, and it’s the only defense that operates on past mistakes instead of future ones.