How to spot crypto phishing sites before you connect a wallet

Crypto phishing rarely looks like phishing. The page is a pixel-perfect copy of a real dApp, the link came from a Discord announcement you trust, and the wallet pop-up looks like every other one you've clicked through. The difference is one signature that hands your tokens to someone else.

This guide covers how these attacks reach you, how to check a site in under a minute, and what to do if you've already signed something.

How phishing links reach you

• Compromised Discord servers. Attackers take over a moderator account or a webhook and post a "surprise mint" or "airdrop claim" in the official announcements channel. The message is real, but the link isn't.
• Fake support DMs. You ask a question in public and get a DM from "Support" or "Admin" with a link to "sync" or "validate" your wallet.
• Lookalike domains. uniswap.org becomes unlswap.org, uniswap-app.org or a domain with lookalike characters from another alphabet (it shows as xn-- in punycode).
• Search ads. Paid results that impersonate popular wallets and dApps, placed above the real site.
• Social replies. Fake accounts that copy a project's name and avatar and reply to the real account's posts with a "claim" link.

What a wallet drainer actually asks you to sign

Phishing kits rarely ask for your seed phrase anymore. They ask for a signature that gives them permission to move your assets:

• Token approvals (approve or increaseAllowance) for an unlimited amount to an unknown contract.
• setApprovalForAll, which lets the spender move every NFT in a collection.
• Off-chain permit signatures (EIP-2612 permits, Permit2, marketplace orders). They look like harmless "sign a message" requests, cost no gas, and can still authorise a transfer.
• On Solana, a transaction that quietly transfers tokens or changes the owner of a token account, bundled with something that looks normal.

A good rule: if you can't explain what a signature does, don't sign it. Modern wallets (Rabby, Phantom, MetaMask with security alerts) simulate transactions and warn about known drainers. Read those warnings.

A one-minute check before you connect

1. Type or bookmark the URL of dApps you use, instead of clicking links from chats.
2. Read the domain from right to left. In claim.app-uniswap.io, the real domain is app-uniswap.io, not Uniswap.
3. Check it against phishing lists. The MetaMask eth-phishing-detect list and the ScamSniffer database cover tens of thousands of known drainer domains.
4. Be wary of brand-new domains. A WHOIS lookup showing the domain was registered last week is a strong warning sign for anything claiming to be an established project.
5. Cross-check the announcement. Is the same link on the project's website, X account and docs? Attackers usually only control one channel.
6. Use a burner wallet for mints and new dApps, and keep long-term funds in a separate wallet, ideally a hardware wallet.

Tools that help

• GuardSmith Shield is our free browser extension. It checks the site you're on against the MetaMask and ScamSniffer lists locally in your browser (the sites you visit aren't sent anywhere), and lets you right-click a link, wallet address or token contract to check it against GoPlus risk data.
• Your wallet's built-in protection. Keep transaction simulation and security alerts switched on.
• In Discord, GuardSmith AutoMod can block invite links, or all links except an allowlist of domains you trust. Combined with Discord's own Require 2FA for moderator actions setting, that makes the "compromised moderator posts a drainer" attack much harder.

If you already signed something

Act quickly. Drainers often sweep wallets within minutes, but some approvals are used later.

1. Revoke approvals for the spender you signed for (revoke.cash or your block explorer's token approval checker). This only works for on-chain approvals, which is why speed matters.
2. If you typed your seed phrase anywhere, the wallet is gone. Create a new wallet with a new seed phrase and move whatever is left, starting with the most valuable assets.
3. Report the site to the phishing lists (MetaMask's and ScamSniffer's repositories accept reports) and to chainabuse.com, and warn the community whose name was used.
4. Be careful of "recovery" offers. People who DM you promising to recover stolen crypto are almost always running a second scam.

Checklist

• Never share a seed phrase, and treat any request for it as a scam
• Bookmark the dApps you use instead of clicking chat links
• Read the domain carefully, including punycode (xn--)
• Don't sign approvals or permits you can't explain
• Use a burner wallet for new sites
• Review and revoke old approvals regularly