October 09, 2026

Spot a crypto theft on screen: a beginner's guide with screenshots

Most crypto thefts aren't hacks — they're one screen where someone missed the catch. We collected those screens in one guide and marked with red numbers where to look.

WHAT'S ON THE SCREENSHOTS

• A "wallet sync" page. The domain is metarnask, not metamask, there's a timer and 12 fields for words. No real wallet asks for your seed phrase on a website — if you see these fields, close the tab.
• A fake wallet in the app store. Developer "Crypto Tools LLC", 312 ratings, three weeks in the store. Download only via the link on the wallet's own website.
• A signature window on a "rewards" site. Permit, an unknown spender, Unlimited — that's a power of attorney over your whole balance, not a login. One such signature cost a person $6.5M in 2025.
• Transaction history with a look-alike address. Start and end match, the middle doesn't, the amount is 0 USDT. That's how someone lost $50M in a single transfer.

THREE HABITS THAT CLOSE MOST OF THESE SCHEMES

• Open services only from bookmarks — not from search and not from ads.
• Check the middle of an address, not the edges. For a large amount, send a test transfer first.
• Your seed phrase goes into the wallet app only. Any site or "support" asking for it is a scammer.

In the full article: three more schemes (search ads, "support" in your DMs, clipboard malware), a 15-minute checklist and what to do in the first 30 minutes after a theft.

📖 Read the guide (~12 min): https://amlconsensus.com/longread/how-not-to-lose-crypto

🔎 Check an address before you send: https://amlconsensus.com/en