Phishing, fake apps, and malicious approvals

Thieves who cannot break the cryptography have two options. They can get your seed phrase, or they can get you to sign something that hands over your tokens. This lesson covers both routes.

Route one: your seed phrase

Phishing sites. A copy of a wallet or exchange site sits on a web address one letter off the real one. It is promoted through adverts, emails and direct messages. It tells you to "restore", "verify" or "sync" your wallet by entering your seed phrase.

Fake apps. Imitations of popular wallets reach official app stores. In 2026, Kaspersky found 26 in Apple's App Store. They captured the recovery phrase as users typed it and sent it to the attackers.

Fake support. Someone answers your public question with a private message and a link to a "support form".

All three end the same way: you type your words and the wallet is emptied. The rule from Lesson 23 defeats them all. The phrase is entered only when you choose to restore a wallet, in software you installed from the official source.

Route two: your signature

This route needs no seed phrase, and it works against hardware wallets too.

To use a token with an app on Ethereum, you first sign an approval. It gives the app's smart contract permission to move that token from your wallet. Apps often request an unlimited amount so you only have to approve once.

A malicious site abuses this. It poses as a new project, an airdrop or a claim page. You connect your wallet and sign what looks like a routine step. In fact you have approved the attacker's contract, which then takes every token of that type. The tools built for this are called drainers. Chainalysis describes them as sites that "masquerade as web3 projects".

One example comes from January 2024, after the SEC's own social media account was compromised. A drainer posing as the SEC invited people to connect their wallets and claim free tokens.

What an approval really means

• It lasts until you cancel it, even after you stop using the app.
• Disconnecting your wallet from a site does not cancel it.
• Unlimited means every token of that type, including ones you add later.
• If an approved contract is hacked or turns out to be malicious, it can use the permission.

Defences

Slow down at the signature. Read what your wallet shows. If it mentions "approve", "permit" or "set approval for all" and you did not expect it, reject it.

Approve only what you need. Many wallets let you edit an unlimited request down to the amount for this transaction.

Use a separate wallet for experiments. Keep a small-balance wallet for trying new apps and claiming things. Keep savings in a wallet that never connects to websites.

Revoke old approvals. Block explorers and dedicated tools list the approvals on your address and let you cancel them. Each cancellation is a transaction and costs a fee. Do it a few times a year, and immediately after signing something you regret.

Arrive safely. Use bookmarks. Do not click adverts or links in messages.

Ignore free money. Surprise tokens, airdrops you did not sign up for and urgent "claim" deadlines are bait.

The two rules

Never type your seed phrase to fix, verify or claim anything. Never sign a transaction you cannot explain.