Phishing: One Click and Your Wallet Is Gone

In September 2024 a man in Pennsylvania watched his phone fill up with security codes he had not asked for. Then it rang. The caller said he was Fred Wilson from Coinbase security, the largest US crypto exchange, and that someone was trying to move money out of the account. By the end of the call about $53,150 of the man's crypto was gone.

The caller was not from Coinbase. Brooklyn prosecutors say the scheme behind that call took $15.9 million from about 100 people between April 2023 and December 2024. Ronald Spektor, a 23-year-old from Brooklyn, pleaded guilty to all 31 counts and was sentenced on 23 September 2026 to four to 12 years in prison.

That is phishing: conning a person rather than breaking a computer. It is the same trick as the call from "the bank's fraud team" asking for a card number. In crypto it is worse, because there is no bank to call back. Crypto payments are final within minutes, and once the coins have moved, nobody can reverse them.

Four ways in

The fake website is the oldest. A scammer builds a pixel-perfect copy of a service people use every day, such as MetaMask (the most popular wallet app, where people keep their coins), Uniswap (a trading venue) or OpenSea (a marketplace for NFTs, tokens that work like certificates of ownership for digital items), on an address that differs by a letter: m3tamask instead of metamask. Victims arrive from an advert at the top of a search result, a reply on X or a message in Discord, and "connect" their wallet.

The site then asks for an approval. In crypto, an approval is permission for a program to move a person's tokens. A normal one is limited; the phishing one covers everything, forever, like signing a blank cheque. Most of these sites are not built by the people running them. Criminals rent ready-made "wallet drainer" kits from developers who take a cut of whatever is stolen, so a scammer with no technical skill can run a polished fake within an hour.

The fake support agent is the second door, and Spektor's. A person who believes they are talking to their exchange will read out codes, install software or move coins to a "safe" address. It gets easier when the scammer already knows the victim's name, balance and recent trades. In May 2025 Coinbase disclosed that criminals had bribed contractors in its overseas customer support to copy data on 69,461 customers, so impostors could ring them sounding like the real company. Coinbase refused a $20 million ransom demand, offered a $20 million reward instead, and estimated the cost to it at $180 million to $400 million.

The fake job offer is the third, and the one that has stolen the most. In March 2022 attackers took about $625 million from the Ronin bridge, the system that moved money in and out of the game Axie Infinity. Sky Mavis, the company behind the game, said one employee had been compromised by "advanced spear-phishing", a tailored attack on a single person. The Block reported, citing two people at the company, that a senior engineer had applied for a fake job offered on LinkedIn and opened a PDF "offer letter" that carried malicious software. The US Treasury blamed North Korea's Lazarus Group. In February 2025 the same kind of trick on a software supplier let attackers change what Bybit's staff saw on screen, and they approved a transfer that sent about $1.5 billion to North Korean hackers, according to the FBI.

The fourth is the bluntest: "enter your recovery phrase to verify your wallet". The recovery phrase is the list of 12 or 24 words that can rebuild a wallet on any device, the master key to everything in it. No real company ever asks for it. In December 2020 a hacker published the names, home addresses and phone numbers of about 272,000 customers of Ledger, a maker of wallet devices. Those customers were then bombarded with fake emails and texts asking for their phrases, and some later received tampered devices in the post.

How big it is

Scam Sniffer, a firm that tracks wallet drainers, counted $494 million stolen through them in 2024. In 2025 the figure fell 83% to $83.85 million, and the number of victims fell 68% to 106,106. Better warnings in wallets and browsers did much of that work; the firm also notes that when one drainer kit shuts down, another fills the gap.

That count covers only drainer kits that can be traced on Ethereum-style blockchains. It leaves out phone scams, fake support desks and stolen recovery phrases. Chainalysis, a blockchain analytics firm, estimated that crypto scams of all kinds took at least $14 billion in 2025 and possibly more than $17 billion once all the data came in, and said impersonation scams grew about 1,400% on the year, helped by cheap artificial intelligence that can fake a voice or a face.

What stops it

The defence is mostly slowness. Phishing works by rushing people: an account "under attack", a reward "expiring in ten minutes", a recruiter who needs a test done today. Real exchanges do not ring first and ask for codes. Real services are reached from a saved bookmark, not a link in a message or a search advert. Anything asking for a recovery phrase is fake, every time.

A hardware wallet, a small device that keeps the keys offline and needs a physical button press to approve anything, stops a stolen password or an infected computer from emptying an account. It cannot stop its owner from approving a bad transaction on purpose. Old approvals can be checked and cancelled with tools such as Revoke.cash, so a forgotten blank cheque cannot be cashed later.