Phishing and address poisoning - how the attacks work and how to protect yourself

Most crypto hacks are not "hacker magic" but the deception of a person. The scammer does not break the blockchain's mathematics: they persuade you to sign the action they need yourself. Knowing the main schemes protects better than any software. The general list of rules is in the security checklist, and here we examine the attacks themselves.

Why crypto attracts scammers

• Transfers are irreversible (why): they cannot be cancelled.
• There is no single body to complain to and get a refund from.
• One user error is enough.
• Everything is anonymous: the scammer is hard to find.

Scheme 1. A fake site

You search for a service in a search engine and follow an ad link to a site that looks identical to the real one. It asks you to "connect your wallet" and sign something. In fact the signature may give the right to pull your tokens (how it works).

Signs: the address differs by one letter (coin-trust.net and coin-trvst.net), it appears in a search ad, it urgently asks you to sign.

Defence: go in via a bookmark; check the address in the browser bar; do not follow links from chats and emails.

Scheme 2. A malicious approval

A site asks you to approve the "unlimited" spending of a token. You sign, and the fraudulent contract gains the right to withdraw all your USDT or USDC at any moment - even a month later.

Defence: look in the wallet window at whom the permission is given to and for what amount (approve in detail); give exact amounts; regularly revoke old approvals.

Scheme 3. Blind signing

A site asks you to sign a message whose text is unreadable - a string of characters. It may hide a permission. Modern wallets show a readable structure for signatures of the EIP-712 standard, but if you see a hexadecimal string instead of understandable text, be extra careful.

Scheme 4. "Support" and "help"

You describe a problem in a public chat and a "support employee" answers you "in private". They send a link "for verification" or ask for the seed phrase.

Defence: real support does not write first and never asks for the seed phrase. Ignore and block.

Scheme 5. Address poisoning

A cunning attack on inattention. You often send money to the address 0x4A7d…b0c1. A scammer creates an address whose first and last characters match and sends you a tiny (sometimes zero) transfer from it. Now two similar addresses sit side by side in your transaction history. Next time you copy the "familiar" address from the history - and it is the scammer's address.

Example.

Real:  0x4A7d3F9bE1c2085a6D94b0E7f31C5a8d29E6b0c1
Fake:  0x4A7d58C20e9B1f7364aD0c85E2b9F1d70359b0c1

The start (0x4A7d) and the end (b0c1) match. If you only compare the edges, the difference goes unnoticed.

Defence:

• compare the address in full, not only the first and last characters;
• do not copy addresses from the history - take them from a trusted source or an address book;
• for frequent recipients use ENS names or saved contacts;
• send a test amount first.

Scheme 6. Clipboard address swapping

Malware on a computer replaces the copied address with the scammer's. You paste - and do not notice the swap.

Defence: after pasting, always compare the address with the original; use a hardware wallet that shows the recipient address on its own screen; do not install programs from dubious sources.

Scheme 7. Fake tokens and "airdrop" gifts

An unknown token lands on your address. To "sell" it you are invited to visit a site - and sign a malicious action. The token itself may be harmless: the bait is the site.

Defence: do not interact with tokens you did not buy. More about fakes in the tokens overview.

Scheme 8. Fraud in the deals themselves

This is a separate topic - see the red flags of P2P deals. Here escrow helps: the money lies in a contract, not with a stranger. But make sure you are working with the real contract (how to verify).

Universal rules

1. If you are being rushed, that is a reason to stop.
2. If something sounds too good, it is a scam.
3. Check addresses, networks and amounts in the wallet window.
4. Do not trust private messages, especially with links.
5. Separate your wallets: do not connect the "vault" to unfamiliar sites.

What to read next

Reinforce what you learned: the wallet security checklist. For the technical side of signatures - ECDSA and EIP-712.