Fake WalletConnect and Wallet Pop-Up Phishing: How It Works and How to Stay Safe

WalletConnect phishing is a scam in which a fake website shows a counterfeit "connect wallet" window or wallet pop-up to trick you into typing your seed phrase or signing a malicious transaction. The real WalletConnect protocol never asks for your seed phrase; it only passes connection requests and transactions to your wallet app, where you approve them.

These scams work because connecting a wallet has become routine. People click through the same flow dozens of times, so a convincing imitation slips past them. Knowing what the genuine flow looks like is the best defense.

How the Real Wallet Connection Flow Works

Understanding the legitimate process makes fakes easier to spot:

1. 1You visit a decentralized app and click "Connect wallet."
2. 2The app shows a list of options, such as a browser extension or WalletConnect.
3. 3If you choose WalletConnect, the app displays a QR code, or on mobile opens your wallet app through a deep link.
4. 4Your wallet app shows the site's name and domain and asks you to approve the connection.
5. 5Later, when you take an action, your wallet shows the transaction or signature request and you approve or reject it.

At no point does the app need your seed phrase or private key. Everything sensitive stays inside your wallet. Our guide to wallet permissions and connected sites explains what a connection does and does not allow. For a deeper look, see Tampered and Fake Hardware Wallets.

How the Scam Works, Step by Step

Variant 1: Seed phrase capture

1. 1The lure. A victim sees a message about a problem: "your wallet is out of sync," "claim failed, validate your wallet" or "migrate your tokens." Links arrive via social media replies, fake support accounts, ads or emails.
2. 2The fake site. The page looks like a neutral "wallet tools" or "dapp rectification" site, often with WalletConnect branding and a grid of wallet logos.
3. 3The fake failure. Clicking a wallet logo shows a fake loading spinner, then an error: "Automatic connection failed. Connect manually."
4. 4The capture. The "manual" option asks for your 12 or 24 recovery words, a private key or a keystore file. Whatever you enter is sent to the scammer, who sweeps the wallet within minutes.

Variant 2: Malicious signatures

Here the site connects to your real wallet properly, then asks you to sign something harmful: an unlimited token approval, a permit signature or a transaction that transfers assets. The pop-up is real; the request is malicious. Our explainer on ice phishing and permit signatures covers this in depth.

Variant 3: Fake in-page wallet windows

Some sites draw a picture-perfect imitation of a popular extension wallet inside the page, complete with logo and password box. It may ask for your password first and then your seed phrase "to restore access." Related reading: Phishing Through Search Ads.

A Hypothetical Example

The following is a composite, illustrative scenario, not a real case. Imagine Maya, who holds tokens from a project's past airdrop. She posts on social media that her claim failed. Within minutes, an account with the project's logo replies: "Sorry for the trouble! Use our wallet sync portal to fix pending claims," with a link.

The site shows a WalletConnect-style window. She picks her wallet, sees "Connection error, please connect manually," and a box asks for her recovery phrase. She types it in. Ten minutes later, her tokens and the network's native coin have been moved out. The "support" account deletes its reply.

Every step had a warning sign: unsolicited help, a non-official link and, above all, a request for her seed phrase. Our article Crypto Loan Scams expands on this point.

Warning Signs Checklist

• A site or window asks for your seed phrase, private key or keystore file. This alone means it is a scam.
• The "wallet window" cannot be dragged outside the browser, or it vanishes when you change tabs.
• You were sent the link by a reply, direct message, ad or "support agent."
• The domain is unfamiliar, misspelled or uses an odd extension, and it is not linked from the project's official site.
• The page claims a generic problem such as "sync," "validation," "rectification" or "whitelist" that needs fixing.
• Your wallet shows a request to approve unlimited spending or sign an unreadable message you did not expect.
• There is urgency: "your assets will be frozen in 30 minutes."

How to Protect Yourself

1. 1Never type your seed phrase into any website. Your seed phrase only belongs in your wallet app when restoring it, on your own device.
2. 2Reach apps from bookmarks. Save official links from the project's website and use them every time. See how to verify a website is the official project site.
3. 3Read the domain in your wallet. Before approving a connection, check that the site name shown in the wallet matches the official domain.
4. 4Read every signature request. If you cannot tell what a request does, reject it.
5. 5Use a separate wallet for experiments. Keep long-term holdings in a wallet, ideally a hardware wallet, that rarely connects to new sites.
6. 6Revoke old approvals regularly. Our guide on how to revoke token approvals shows how.

What to Do If It Happened

Then follow our step-by-step guide on what to do immediately if your wallet is compromised. Save the site URL, transaction hashes and screenshots, and report the site through our scam report form so others can be warned. Be wary of "recovery services" that contact you afterward; they are often a second scam.

Bottom line

WalletConnect and wallet pop-ups are safe tools when they come from your real wallet and a real app. The scam lives in imitation windows that ask for your seed phrase and in malicious requests disguised as routine steps. No legitimate service needs your recovery words. If a window asks for them, close it.