According to ScamSniffer, signature phishing alone took $83.85M from 106,106 people in 2025. And two people lost $50M (December 2025) and $12.25M (January 2026) the exact same way: they copied an address from their own wallet history — and it was a planted look-alike. None of these cases required "hacking" a blockchain.
The good news: a few habits protect you from almost all of these schemes. SlowMist researchers boil them down to two rules in their open security handbook: zero trust by default and verify every time. Below is exactly what to verify.
01Your seed phrase gets talked out of you — it doesn't "leak" by itself
A seed phrase (12 or 24 words) is the wallet. Whoever knows it owns the money, from any device. So nobody "hacks" it — they ask for it: "support" in your DMs, a "wallet sync" site, an "account recovery" form, a bot promising to lift a freeze.
- Look-alike domain. "metarnask" instead of "metamask": "r" and "n" side by side read as "m".
- A timer and urgency. The goal is to stop you from thinking.
- Fields for 12 words. No real wallet, exchange or "support" will ever ask you to enter your seed phrase on a website. If you see these fields — close the tab.
02Fake apps and browser extensions
The second most common scheme is a wallet that looks real but was built by scammers. It can work for months: it shows your balance and sends transfers — but the seed phrase went to the attacker the moment the wallet was created. Such apps even get into official stores: in September 2026 SlowMist analysed FomoPeek, a fake iOS app from the App Store that stole keys.
- Developer. A real app is published by the company that makes the wallet. "Crypto Tools LLC" or "Wallet Dev" is a reason to stop.
- Few ratings for a big name. Popular wallets have hundreds of thousands or millions.
- A brand-new app. Fakes don't live long and keep reappearing.
- No link from the official site. The main rule: download only via the link on the wallet's own website.
03One signature — and the wallet is empty
The biggest thefts of the past two years didn't need a seed phrase. You're lured to an "airdrop" or "claim rewards" site and asked to "confirm". The wallet window isn't a login — it's permission to spend your tokens (approve, Permit, Permit2) or, since Ethereum's 2025 upgrade, a batch of actions via EIP-7702. According to ScamSniffer, a single Permit signature cost one person $6.5M in September 2025.
- The site where you're "just claiming a reward".
- Permit / Approve / setApprovalForAll — a power of attorney over your tokens, not a login.
- An unknown spender address receiving the rights.
- Unlimited — permission over the entire token balance, forever.
Mechanics in detail, including how to revoke permissions you've already given, are in our article on token approvals (in Russian). The minimum you need to know:
- Read the signature window before you click. Permit, Approve or Unlimited on an "airdrop" site — close the window.
- Turn on transaction simulation. Wallets like Rabby and MetaMask (with Blockaid protection) show what will happen: "−5,000 USDT" is visible before you confirm.
- Revoke old approvals every couple of months — on revoke.cash or with our approvals check.
04Address poisoning: you copy "your" address — and it's someone else's
The $50M scheme. You send money to your own or a partner's address. A minute later the scammers' bot creates a look-alike address: the first and last characters match, the middle is different. It sends you "dust" — 0 or 0.001 USDT — and the look-alike appears in your history. Next time you copy the address from history, check the start and the end — and send the money to the scammer.
- Timing. The "dust" arrives minutes after your real transaction — a bot is watching the address.
- Start and end match (TQ7m…Fk2Z), the middle doesn't. That's the whole trick: people usually check the edges.
- 0 USDT or pennies. The amount doesn't matter — getting into your history does.
05A fake site from a search ad
Scammers buy ads for searches like "Uniswap", "PancakeSwap", "MetaMask login". The ad sits above the real site and looks just like it. What follows is the scenario from section 01 or 03.
- The "Sponsored" label. For crypto services, don't click ad links at all.
- A domain with an extra word — "-exchange", "-app", "-claim", a different domain ending, or look-alike letters instead of the real address.
- A reward promise in the title — a common sign of bait.
06Social engineering: you're talked into doing it all yourself
The most expensive thefts are when people send the money or run the file themselves. The scripts repeat:
| Scenario | What it looks like | Red flag |
|---|---|---|
| "Exchange support" | A DM: "your account is blocked, move your funds to a safe wallet" | Support came to you; asks you to transfer funds or share a code |
| Fake job offer | A great job at a crypto project, a "test task": download and run a repository or a meeting app | You have to run someone else's code or a "special" Zoom client |
| "Investment manager" | A new acquaintance, long chats, "a platform paying 2% a day", the first payouts arrive | Guaranteed returns; withdrawal only after a "tax" or "insurance" fee |
| "Unfreezing" and "AML certificates" | After a freeze, someone promises to lift it for an upfront fee | Paying in advance to someone else's address to "remove the block" |
07Clipboard malware
Malware on your computer or phone swaps the copied address for its own at the moment you paste. You copy the right address — a different one gets pasted. The defence is the same as in section 04: after pasting, check the middle of the address against the original. And don't install cracked software, keygens or extensions from unknown sources on the device that holds your wallet.
08The "three wallets" setup: even if you slip, you lose little
The single best trick against every scheme at once is to split your money. Then any mistake only hits what was in the "working" wallet.
- a hardware wallet or a separate one that never connects to sites
- no approvals
- seed on paper/metal
- "one week's" worth
- connects to trusted services from bookmarks
- approvals reviewed every couple of months
- airdrops, mints, unfamiliar sites
- almost empty
- fine to lose
09A 15-minute checklist: do it today
10If you've been robbed anyway: the first 30 minutes
11How AMLConsensus helps
We don't protect your wallet for you — signatures and keys always stay with you. But we have free tools that cover some of the checks in this article:
- Address check before a deal — sanctions, issuer freezes, hacker and scammer labels.
- Approvals check — which approvals and Permits sit on your address, with unlimited ones highlighted.
- Trace funds — a map of where the money went, up to 6 transfers deep and across bridges.
Sources: ScamSniffer's 2025 phishing report; SlowMist's open "Blockchain dark forest selfguard handbook" (GitHub); SlowMist and ScamSniffer case write-ups. The screenshots are schematic interface mockups, not real screens; wallet and service names (MetaMask, Uniswap, Rabby, etc.) are trademarks of their owners, and AMLConsensus is not affiliated with them. This material is educational and is not financial or legal advice.