Phishing is now the dominant way individual holders lose crypto. Reported crypto scam losses reached roughly 17 billion dollars in 2025, with impersonation scams growing more than 1,400 percent year over year, and the most expensive single case on record happened in January 2026, when a holder handed a 12-word recovery phrase to someone posing as Trezor support and lost roughly 282 million dollars. The scams target your judgment rather than your software, and they work because they look exactly like the real thing. Learning to spot them is the highest-value security skill in crypto.

Red Flag 1: Urgent Messages About Your Wallet

Assume any unsolicited message about your wallet is fake until proven otherwise. The classic phishing message claims your wallet will be suspended, your funds are at risk, or you must verify your account immediately, and it includes a link to a site that looks identical to the real one. Real wallet companies never message you first about a problem with your account, and they never ask you to verify anything through a link. If you receive such a message, do not click it. Open the official app or website yourself and check there.

Red Flag 2: Anyone Asking for Your Seed Phrase

No legitimate person or company will ever ask for your private key or seed phrase. Not your exchange, not your wallet provider, not support staff, not a developer, not anyone. If a message, a website, a support agent or a form asks you to enter your seed phrase to verify, restore or unlock your wallet, it is a theft attempt, full stop, no matter how official it looks. This single rule, if followed without exception, would prevent most individual crypto thefts in existence.

Red Flag 3: Fake Websites and Lookalike Domains

Phishing sites copy the design of real exchanges and wallet sites pixel for pixel, with one tiny difference in the domain name: a zero instead of an o, an extra letter, or a different ending such as .net instead of .com. Always check the domain name in your browser's address bar before you type a password or connect a wallet, and bookmark the real sites you use so you never reach them through a search result or a link. Browser extensions that warn about known phishing domains add another layer, but your own attention is the main defence.

Red Flag 4: Fake Support Accounts and Giveaways

Scammers create fake support accounts on X, Telegram and Discord that reply to real users who post about a problem, offering to help and then directing them to a phishing site or asking for their seed phrase. They also run fake giveaways promising to double any crypto you send, often using hacked celebrity accounts or deepfake videos. No legitimate project doubles your crypto, and no real support agent contacts you through a direct message first. Reach support only through the official app or website, never through a link someone sent you.

Red Flag 5: Malicious Approvals and Fake Airdrops

Many phishing attacks do not ask for your seed phrase at all. They ask you to connect your wallet to a malicious site and approve a transaction that gives the attacker unlimited permission to move your tokens. Always read what you are signing: check the site domain, the network, the recipient, the token and the amount before you approve anything, and limit token approvals to the amount you need rather than granting unlimited access. Review your old approvals regularly on a tool like Revoke.cash and cancel any you no longer use. A hardware wallet does not save you from a signature you authorised yourself.

Red Flag 6 to 9: The Rest of the Checklist

Watch for pressure to act immediately, which is the scammer's favourite tool. Watch for offers that are too good to be true, because they are. Watch for messages with poor grammar, odd formatting or mismatched branding, although modern scams are increasingly polished. And watch for unexpected airdrops or tokens appearing in your wallet, which are often bait: interacting with them, or visiting the site they advertise, can drain your funds. The rule for all of these is the same: slow down, verify through an official channel, and never sign or send anything while you feel rushed.

The Bottom Line

Phishing works because it exploits urgency and trust, not technology. The defence is a short checklist: never share your seed phrase, never click wallet links from messages, always verify the domain, reach support only through official channels, and read every transaction before you sign it. Slow down when a message makes you feel rushed, because that feeling is the scam working. The holders who never lose crypto to phishing are not the most technical. They are the most patient.