Crypto Phishing Sites: How to Recognize a Fake Exchange or Wallet Page

Crypto phishing sites are fake web pages that imitate a real exchange, wallet or DeFi app to steal your login, two-factor codes, seed phrase or a wallet signature. You can usually recognize them by an address that differs slightly from the real domain, by the way you arrived (an ad, email or direct message), and by requests no legitimate service makes, such as typing your seed phrase into a web form.

Phishing is one of the most common ways people lose crypto, and it works on experienced users too. Unlike a bank, a blockchain cannot reverse a transfer once it is confirmed, so prevention is the only reliable defense.

How Crypto Phishing Sites Work

Phishing sites target two kinds of secrets:

1. 1Account credentials for centralized exchanges: email, password and two-factor codes. The attacker relays them to the real exchange in real time, logs in and withdraws funds.
2. 2Self-custody wallet access: either your seed phrase directly, or a signature that gives the attacker permission to move your tokens. These sites often pose as a DEX, NFT mint, airdrop claim or "wallet validation" page and run a wallet drainer script.

The page itself is usually a copy of the real site's code, so the design, logos and text look identical. See also: Mobile Wallet Security Best Practices.

How Victims Reach Fake Sites

• Search ads. Scammers buy ads on popular search terms. The ad appears above the real result and links to a look-alike domain.
• Email. Fake security alerts ("Unusual login detected", "Verify your account") with a link to a fake login page.
• Social media replies. Bots reply to official posts with links to fake airdrops or support pages.
• Direct messages. Fake support agents or "admins" in Discord, Telegram or X send links.
• Compromised accounts. A real project's social account or Discord gets hacked and posts a phishing link.
• SEO and typosquatting. Domains that differ by one character, use a different extension or add words like "app", "claim" or "support".

Warning Signs of a Fake Exchange or Wallet Page

A padlock icon or "https" does not mean a site is safe. Phishing sites routinely use valid certificates. We cover this in more detail in Clipboard Malware.

How to Check a Site Before You Log In or Connect

1. 1Type the domain or use a bookmark. Set bookmarks for every exchange, wallet and DeFi app you use, and use only those.
2. 2Read the full domain in the address bar. Look at the part just before the extension; that is the real site name. exchange.com.secure-login.io belongs to secure-login.io, not to exchange.com.
3. 3Cross-check the official URL. Compare against the project's verified profile on a reputable data site. Our guide on how to verify a website is the official project site walks through this.
4. 4Read every wallet prompt. Before you sign, check which contract you are interacting with and what permission you are granting.
5. 5Never type your seed phrase on a computer or phone website. If any site asks for it, close the tab.

Habits That Prevent Phishing

• Use a password manager. It fills credentials only on the exact domain it saved, so it will not autofill on a look-alike site, which is a useful alarm.
• Use hardware security keys or an authenticator app for two-factor authentication instead of SMS. See two-factor authentication for crypto accounts.
• Enable withdrawal address allowlists on exchanges where available.
• Keep a separate wallet for experiments and keep long-term funds in a wallet that never connects to new sites.
• Treat every unsolicited message about your account as suspicious, even if it looks official.
• Review and revoke token approvals regularly.

If You Think You Were Phished

Speed matters:

1. 1Exchange credentials entered: change your password and two-factor settings from the real site, check for new withdrawal addresses or API keys, and contact support through the official website.
2. 2Seed phrase entered: assume the wallet is lost. Move any remaining funds to a new wallet created on a clean device, with a new seed phrase.
3. 3Malicious signature or approval: revoke approvals immediately and move remaining assets.
4. 4Report it: report the domain to the impersonated company, your browser's phishing report service and our scam report form.

Beware of "recovery services" that contact you afterward. They are almost always a second scam. Our article Wallet Firmware Updates expands on this point.

Bottom line

Phishing sites succeed because they look real and arrive at moments when you are rushed. Make bookmarks your only entry point, read domains carefully, never type a seed phrase into a website and treat every unexpected signature request as a threat. These habits block the large majority of phishing attempts before they start. For more protection tips, see our security articles.