Phishing Pages and Fake Wallet Apps Are Still the Front Door

According to the report, the most common way hackers gank crypto wallets is not a sophisticated blockchain exploit but a convincing lie. Attackers clone the websites of popular wallets, exchanges, and DeFi platforms, then drive traffic to them through search ads, social media posts, Discord messages, and emails that look like security alerts. A victim may believe they are downloading an official update or restoring a wallet after a “security check.” The fake site asks for a seed phrase, private key, or wallet password. Once that information is entered, the attacker can import the wallet on their own device and drain every asset.

Fake mobile apps are another major vector. Malicious apps slip into app stores or are sideloaded through links, mimicking trusted wallet brands with near-identical logos and interfaces. Some even work as functional wallets for a while, allowing users to deposit funds before the attacker triggers a sweep. The report notes that phishing kits are cheap and scalable, making them attractive to low-level criminals as well as organized groups. Wallet drainer services can be rented, complete with dashboards and customer support, which lowers the technical barrier to entry.

The report emphasizes that phishing is not limited to email. Attackers use compromised social media accounts, fake customer support accounts, and even paid search results that appear above the real site. A single click can lead to a drainer page that looks indistinguishable from a legitimate wallet interface. Because crypto transactions are irreversible, there is no chargeback or bank to call. That finality is exactly why attackers prefer wallets: once the funds move, the victim has almost no practical recourse. The best defenses are boring but effective: never enter a seed phrase online, bookmark official sites, verify URLs character by character, download wallets only from official sources, and treat every unsolicited message about a wallet “problem” as hostile until proven otherwise. Hardware wallets help because they keep keys offline, but they cannot protect a user who voluntarily types a recovery phrase into a phishing page.

Clipboard Hijackers, Infostealers, and Malicious Extensions Drain Wallets Quietly

The report highlights a quieter category of attacks: malware that lives on a victim’s computer and waits. Clipboard hijackers are simple but devastating. When a user copies a crypto address to send funds, the malware silently replaces it with an address controlled by the attacker. If the victim does not verify the full address on the destination device, the payment goes straight to the hacker. More advanced infostealers go much further. They scan browsers and wallet extensions for stored data, capture screenshots, log keystrokes, and exfiltrate seed phrases, private keys, session cookies, and password-manager vaults. Some steal wallet files directly from disk, including encrypted vaults that can be cracked if the password is weak.

Malicious browser extensions are especially dangerous because they ask for permissions that sound harmless—“read and change data on websites”—but can inject scripts into wallet interfaces, alter transaction details, or swap recipient addresses in real time. The report also points to cracked software, fake updates, and SEO-poisoned download pages as common infection routes. A user looking for a free video editor or a game cheat may end up installing a stealer that empties their wallet days later. Supply-chain attacks on npm packages and browser extension stores can push malicious code to thousands of users at once.

Defenses include keeping software patched, avoiding pirated tools, limiting browser extensions to essentials, using separate browsers or profiles for crypto, and verifying every transaction on a hardware wallet screen. The report recommends using a dedicated device or at least a dedicated browser profile for high-value wallets, and never storing seed phrases in cloud notes, screenshots, or password managers that sync to the browser. Even then, the report warns, a single moment of inattention can be enough: clipboard malware and stealers do not need to break encryption if the user hands over the keys.

Approval Phishing and Address Poisoning Exploit User Trust

Not every wallet drain starts with a stolen seed phrase. The report describes a growing class of attacks that trick users into signing malicious transactions or approvals. In approval phishing, a victim connects their wallet to a fake DeFi site, NFT marketplace, or “airdrop” claim page and signs a request that grants the attacker permission to spend specific tokens. Sometimes the approval is unlimited, meaning the attacker can drain that token balance whenever they want. In other cases, the malicious contract uses setApprovalForAll to gain control over every NFT in a collection or a broad set of assets. Because the transaction is technically valid and signed by the user, the blockchain cannot distinguish it from a legitimate approval.

Address poisoning is another sneaky tactic. The attacker sends a tiny transaction from an address that looks almost identical to one the victim frequently uses—matching the first and last few characters. That transaction appears in the victim’s history. Later, when the victim copies an address from their history to send funds, they may paste the poisoned lookalike address instead of the real one. The payment goes to the attacker. The report also warns about “permit” signatures, which are off-chain messages that can authorize token spending without a normal gas fee. Users may think they are only signing a login or a free mint, but the signature can be used later to move funds. Because off-chain signatures do not appear on-chain until exploited, they are harder to spot and revoke.

The report notes that these attacks exploit trust in interfaces and habits rather than cryptographic weaknesses. Users are trained to click “confirm” without reading details, and wallet UIs often hide the full implications of a signature. Defenses include reading every approval request, using tools that revoke old allowances, preferring limited approvals over unlimited ones, simulating transactions before signing, and double-checking addresses on a hardware wallet. For NFTs and DeFi positions, regular approval hygiene is now as important as keeping a seed phrase secret.

SIM Swaps, Social Engineering, and Supply Chain Attacks Target the Keys

The report also documents how attackers bypass technical defenses by targeting people and the companies they trust. SIM-swap attacks remain a powerful way to gank crypto wallets linked to phone numbers. An attacker convinces or bribes a mobile carrier employee to port the victim’s number to a SIM they control. With control of the phone number, they can intercept SMS two-factor authentication codes, reset passwords for email and exchange accounts, and approve wallet logins. If the victim uses SMS 2FA for a custodial exchange or cloud backup, the attacker may gain everything needed to drain funds.

Social engineering is often the first step. Hackers pose as wallet support agents, exchange security teams, Discord moderators, or even romantic partners and investment mentors. They build trust over days or weeks, then send a malicious link, request a “test transaction,” or ask for a screenshot of a recovery phrase. Job offers and freelance gigs are used to deliver malware or fake onboarding portals. Supply-chain attacks target the software and hardware wallets depend on. A compromised update server, a malicious dependency in a wallet app, or a tainted hardware shipment can expose keys at scale.

The report stresses that no single defense is enough. Users should switch from SMS 2FA to authenticator apps or hardware security keys, never share verification codes, verify the identity of anyone asking about crypto, use multisig or cold storage for large holdings, and keep offline backups of seed phrases in secure locations. The common thread is that hackers follow the weakest link—and in crypto, that link is often a human who is tired, rushed, or trusting. The report concludes that wallet security is a layered problem: hardware, software, phone numbers, email accounts, and social habits all matter. A wallet is only as strong as the recovery path around it.