🎣 What is Phishing in Crypto?
Phishing is a type of cyberattack where scammers impersonate legitimate companies (like crypto exchanges) to trick you into revealing sensitive information such as passwords, 2FA codes, or private keys. These attacks often occur via fake emails, websites, or social media messages that look almost identical to the real thing.
Phishing is one of the most common and effective ways hackers steal crypto. According to industry data, over 90% of account compromises involve some form of phishing. The best defense is awareness and vigilance.
Phishing works because it exploits human psychology — urgency, fear, and trust. Scammers create a sense of urgency ("Your account will be suspended!") or impersonate trusted entities to get you to act without thinking.
📋 Types of Phishing Attacks
Phishing attacks come in many forms. Here are the most common types targeting crypto users.
Fake emails that appear to be from your exchange, asking you to click a link or enter credentials. Often use urgency or threats to pressure you.
Websites that look identical to the real exchange but are designed to steal your login credentials. Often use domain names that are slightly misspelled.
Scammers impersonate exchange support or influencers on Twitter, Telegram, or Discord to steal information.
Phone calls where scammers pretend to be from exchange support to get your 2FA codes or other sensitive information.
Fake text messages claiming to be from your exchange with links to phishing sites.
Hackers redirect legitimate exchange URLs to fake websites, making it difficult to detect the scam.
Email phishing is the most common and dangerous type. Always check for your anti-phishing code — if it's missing, the email is fake.
🔍 How to Identify Phishing Attempts
Learning to spot phishing attempts is your best defense. Here are the key signs to look for.
| Red Flag | What to Look For | Why It's Suspicious |
|---|---|---|
| Missing Anti-Phishing Code | Your unique security phrase is not in the email | Legitimate exchange emails always include your anti-phishing code |
| Suspicious Sender Address | Email address looks similar but has slight misspellings | Scammers use domains like "binance-support.com" vs "binance.com" |
| Urgent or Threatening Language | "Your account will be suspended!" or "Immediate action required!" | Scammers use urgency to make you act without thinking |
| Grammatical Errors | Poor spelling, awkward phrasing | Legitimate exchanges have professional communications |
| Suspicious Links | Hover over links — the URL doesn't match the expected exchange domain | Scammers hide malicious links behind legitimate-looking text |
| Requests for Sensitive Information | Password, 2FA code, or private keys | No legitimate exchange will ask for this via email |
If it doesn't have your anti-phishing code, it's not from your exchange. This simple rule will protect you from almost all email-based phishing attacks. Set up your anti-phishing code today.
🛡️ How to Protect Yourself from Phishing
Here are the most effective ways to protect yourself from phishing attacks.
-
1
Set up an anti-phishing code
Go to your exchange's security settings and create a unique security phrase. This will appear in all legitimate emails.
-
2
Enable 2FA (Google Authenticator or hardware key)
Even if you fall for a phishing attempt, 2FA can prevent unauthorized access. Never use SMS 2FA.
-
3
Never click links in unsolicited emails
Always navigate to the exchange directly by typing the URL into your browser.
-
4
Verify the sender's email address
Look for slight misspellings or unusual domains (e.g., "binance-support.net").
-
5
Use a password manager
Password managers won't auto-fill on fake websites, providing an additional layer of protection.
-
6
Enable login alerts
Get notified whenever someone logs in to your account.
-
7
Check URLs carefully
Before entering credentials, verify you're on the correct exchange website.
-
8
Use a dedicated email for crypto
Use a separate email address for your exchange accounts to reduce phishing risk.
If you didn't initiate it, don't trust it. Whether it's an email, text, or social media message, always verify the source before taking any action.
🚨 What to Do If You Fall for a Phishing Attempt
If you think you've been phished, act immediately. Here's what to do.
-
1
Change your password immediately
Log in to your exchange account (using a secure connection) and change your password.
-
2
Revoke all API keys
Delete all existing API keys and create new ones if needed.
-
3
Check for unauthorized activity
Review your account history, balances, and order history for unauthorized transactions.
-
4
Contact exchange support
Report the incident to your exchange's support team immediately.
-
5
Enable additional security
If you haven't already, enable 2FA and set up an anti-phishing code.
-
6
Monitor your accounts
Keep a close eye on your exchange account and linked email for any further suspicious activity.
If you've entered your credentials on a phishing site, the attacker may already be in your account. Act immediately — every minute counts. Change your password and revoke API keys first, then investigate.
🏦 Exchange Security Features to Use
Most exchanges offer security features specifically designed to prevent phishing. Make sure you're using them.
| Feature | How It Helps | How to Enable |
|---|---|---|
| Anti-Phishing Code | Identifies legitimate exchange emails | Set in security settings |
| Two-Factor Authentication (2FA) | Prevents unauthorized access even with stolen credentials | Enable in security settings |
| Withdrawal Whitelist | Restricts withdrawals to approved addresses | Enable in withdrawal settings |
| IP Whitelisting | Restricts account access to specific IPs | Enable in security settings |
| Login Alerts | Notifies you of new logins | Enable in notification settings |
| Withdrawal Alerts | Notifies you of withdrawal requests | Enable in notification settings |
Enable all available security features on your exchange. Each feature adds a layer of protection, and together they provide a robust defense against phishing and other attacks.
⚠️ Common Phishing Scams to Watch Out For
Here are some of the most common phishing scams targeting crypto users.
Scammers impersonate exchange support on social media or via email, asking for your account details or 2FA codes.
Scammers promise free tokens in exchange for connecting your wallet or entering credentials on a fake site.
Scammers send fake withdrawal confirmation emails to trick you into thinking your account is compromised, then ask you to "verify" your identity on a fake site.
The most common type — fake emails that look like they're from your exchange with links to phishing sites.
Scammers create fake mobile apps that look like the real exchange app to steal your login credentials.
Scammers send small amounts of crypto from an address that looks similar to your exchange deposit address to trick you into copying the wrong address.