Crypto wallet scams: how they work and how to avoid them
Most crypto wallet losses come from tricks, not broken wallets: phishing for your seed phrase, malicious signatures that drain tokens, fake apps, look-alike addresses and fake support. Slow down, verify every source yourself and never share your seed phrase.
How big is the problem?
Wallet-drainer phishing on EVM chains took about $494M from roughly 332,000 addresses in 2024 (ScamSniffer, Jan 2025). In 2025 ScamSniffer counted $83.85M stolen from 106,106 victims, down 83%, though the largest single theft was still $6.5M from one Permit signature in September 2025 (ScamSniffer, Jan 2026). These figures cover only signature phishing; fake apps, investment scams and seed-phrase theft come on top.
The 10 most common wallet scams
| Scam | How it works | Defence |
|---|---|---|
| Wallet drainers | Fake airdrop or mint sites ask you to sign approvals or permits that hand over your tokens | Read every signature; reject Permit/approve requests you didn't expect. Guide |
| Fake wallet apps | Copycat apps or extensions steal your phrase when you "restore" | Install only via the official domain. Guide |
| Address poisoning | Look-alike addresses planted in your history | Never copy addresses from history. Guide |
| Fake support | "Agents" reply to your complaint and ask for your phrase or a screen share | Real support never DMs first and never asks for your phrase |
| Phishing letters and emails | "Mandatory verification" messages with QR codes | Ignore; check announcements in the official app |
| Malicious approvals left open | Old unlimited approvals get abused later | Review and revoke. Guide |
| Airdropped scam tokens and NFTs | Unsolicited tokens link to drainer sites | Hide them; don't visit their links or try to sell them |
| Investment and "pig butchering" | A new online friend coaches you to deposit into a fake platform | Never send funds to platforms introduced by strangers |
| Fake or tampered hardware | Cheap devices from resellers, or pre-filled recovery cards | Buy direct; always generate a new phrase |
| Clipboard and browser malware | Swaps the address you paste or injects code into wallet pages | Check the address on the device screen; keep software updated |
Real cases, with dates
- 20 Dec 2025: a trader sent 49,999,950 USDT (about $50M) to a poisoned look-alike address after a small test transfer (The Block, Dec 2025).
- 24 Dec 2025: a malicious Trust Wallet Chrome extension version 2.68 drained about $7M; Trust Wallet released 2.69 and opened a claims process (BleepingComputer, Dec 2025).
- Feb 2026: scam letters on fake Ledger and Trezor letterhead pushed an "Authentication Check" via QR code (BleepingComputer, Feb 2026).
- 7–13 Apr 2026: a fake Ledger app on the Mac App Store; about $9.5M stolen (iThinkDiff, Apr 2026).
- Jul 2026: three users sued Apple over fake "Sparrow Wallet" iOS apps, alleging about $1.8M in bitcoin was stolen in 2025; the real Sparrow has no iOS app (BleepingComputer, Jul 2026).
- Sep 2026: phishing emails sent from Trezor's real support address after its email provider Brevo was breached (BleepingComputer, Sep 2026).
- Oct 2026: Ledger confirmed hidden seed-stealing implants in devices sold by a grey-market reseller (Crypto Briefing, Oct 2026).
The full list is in our security incident tracker.
Warning signs
- Urgency: "your wallet will be suspended", "claim within 24 hours".
- Anyone asking for your seed phrase, private key or a screen share.
- Links sent by DM, in replies, or in ads above search results.
- A signature request that doesn't match what you were trying to do.
- Returns that are guaranteed, or a platform that charges "taxes" before you can withdraw.
If you've been scammed
- Stop the bleeding. If your seed phrase was exposed, create a new wallet on a clean device and move remaining funds. If you signed an approval, revoke it (see token approvals).
- Record everything: transaction hashes, addresses, websites, messages and dates.
- Report it to your national police or cybercrime unit and to any exchange that received the funds; exchanges can sometimes freeze deposits.
- Beware recovery scams. People promising to "recover" stolen crypto for an upfront fee are almost always scammers too.
Frequently asked questions
What is the most common crypto wallet scam?
Phishing in its many forms: fake sites that request malicious signatures, fake apps and fake support agents who ask for your seed phrase.
Can stolen crypto be recovered?
Rarely. Blockchain transactions cannot be reversed. Sometimes exchanges freeze stolen funds, or attackers return them, as in the 2024 $68M WBTC address poisoning case, but don't count on it.
Will my wallet company refund me if I'm scammed?
Usually not when you approved the transaction yourself. Some companies have compensated users when their own software was at fault, such as Ledger after the 2023 Connect Kit attack.
Are crypto recovery services legitimate?
Treat them with extreme suspicion. Many are follow-up scams aimed at victims. Report the theft to police and the receiving exchange instead.
How do I check if a wallet website is real?
Type the domain yourself or use a bookmark rather than clicking links or ads. Our reviews name each official domain as plain text.