Crypto phishing has evolved far beyond crude emails. Today's wallet drainers are polished websites, fake apps, and social media accounts that mimic real projects, and their goal is a single moment: getting you to connect your wallet and sign a transaction that hands over your assets. Once signed, the theft is usually instant and irreversible. The defence is not technical expertise; it is recognising the patterns before that signature happens.

The most common attack starts with a link: a message claiming your wallet needs verification, an airdrop is waiting, or a project you follow has launched a mint. The link leads to a near-perfect copy of a real site, where connecting your wallet prompts a transaction approval. That approval may look harmless, asking to connect or to approve a token, but it can grant the attacker permission to move all of a token, or in the worst case, drain multiple assets at once. Always treat an unexpected link as hostile until proven otherwise.

Several warning signs appear again and again. Urgency is the first: countdown timers, claims that an offer expires in minutes, or threats that your wallet will be frozen. The second is the channel: legitimate projects do not announce urgent wallet actions by direct message, and support teams never ask for your seed phrase or private key. The third is the domain: look closely for misspellings, extra words, or unusual endings, and never trust a link from a message when you can navigate to the official site yourself.

Approval hygiene is the technical habit that limits damage. Regularly review which apps and contracts your wallet has approved, using tools such as revoke interfaces or your wallet's own approval manager, and revoke permissions you no longer use, especially unlimited approvals. An unlimited approval lets a contract move all of a token without asking again, which is convenient for frequent trading but catastrophic if the contract is malicious or compromised. Prefer limited approvals for new or unfamiliar apps.

Separate your funds by purpose, because no single habit protects everything. Keep a hot wallet with a small balance for everyday interactions and new apps, and keep long-term holdings in a cold wallet that never connects to unfamiliar sites. If a hot wallet is drained, the loss is limited and painful but survivable; if everything sits in one wallet that signs a malicious approval, the loss is total. This division is the cheapest insurance in crypto.

If you suspect you have signed something malicious, act fast. Revoke the approval immediately through your wallet or a revocation tool, move remaining funds to a fresh wallet with a new seed phrase, and never reuse the compromised wallet for valuable assets. Report the phishing site to the platform and to the project being impersonated. Speed matters, because drainers often sweep assets within minutes, but a fast revocation can still save what has not yet been moved.

Recovery scams are the cruel second act: after a theft, fake recovery services contact victims promising to retrieve funds for an upfront fee. They cannot, because confirmed crypto transactions are irreversible, and paying them simply loses more money. Real help comes from the wallet provider, the exchange involved, and law enforcement reports, not from anyone messaging you with a guaranteed recovery. Anyone promising to recover stolen crypto for a fee is running a second scam.

The core habits are simple and they work: navigate to sites yourself instead of clicking links, verify domains character by character, never share a seed phrase, revoke unused approvals regularly, and keep most funds in a cold wallet. Phishing succeeds by rushing you past those habits. Slow down at the signature screen, read what you are approving, and remember that no legitimate opportunity in crypto requires you to act in the next sixty seconds.