Phishing awareness in web3

The web3 phishing landscape

Phishing attacks are the single most costly threat in the web3 ecosystem. Unlike traditional finance where banks can reverse fraudulent transactions, blockchain transactions are irreversible. Once your assets are gone, they are gone forever.

Why web3 users are targeted

Crypto users are uniquely attractive targets for phishers compared to traditional banking customers:

• Irreversible transactions -- There is no chargeback, no customer support, and no "undo" button. Once a transaction is signed and confirmed on-chain, it is permanent.
• Pseudonymous wallets -- Attackers can drain a wallet and move funds through mixers or bridges within minutes, making recovery near-impossible.
• Complex interfaces -- Most users cannot fully read the transaction data they sign, creating a blind trust surface that attackers exploit.
• High-value targets -- A single wallet may hold millions in tokens, NFTs, or DeFi positions, making a single successful phish extremely lucrative.
• FOMO culture -- The urgency around airdrops, mints, and token launches creates psychological pressure that bypasses careful thinking.

How web3 phishing differs from traditional phishing

Common attack vectors

Web3 phishing has evolved far beyond simple email scams. Attackers use a sophisticated combination of technical exploits and social engineering. Here are the most common attack vectors you need to recognize.

1. Fake dApp frontends

Attackers create pixel-perfect clones of popular DeFi protocols like Uniswap, Aave, OpenSea, and others. These cloned sites look identical to the real thing, but the smart contract interactions route your funds or approvals to the attacker.

Common typosquatting techniques attackers use include:

• Character substitution: uniswvp.com instead of uniswap.org
• Homoglyph attacks: Using characters from other alphabets that look identical (e.g., Cyrillic "a" vs Latin "a")
• Subdomain tricks: uniswap.com.evil-site.xyz
• TLD swaps: uniswap.io instead of uniswap.org

2. Discord & Telegram scams

Discord and Telegram have become primary hunting grounds for crypto phishers. Attackers exploit the trust within project communities using several tactics:

3. Malicious token approvals

This is one of the most dangerous and least understood attack vectors. When you interact with a DeFi protocol, you often need to approve() the contract to spend your tokens. Attackers exploit this mechanism by tricking you into approving their malicious contract to spend unlimited amounts of your tokens.

The attack typically works like this:

1. Victim visits a phishing site (fake DEX, fake airdrop claim page, etc.)
2. The site prompts the victim to sign an approve() transaction
3. The approval grants the attacker's contract permission to spend the victim's tokens
4. The attacker later calls transferFrom() to drain the tokens at their convenience

4. Fake airdrops & NFT drops

Airdrop phishing is extremely common because it exploits the natural excitement around free tokens. Attackers create convincing airdrop claim pages for tokens that either do not exist or have no real value.

• Airdrop claim sites ask you to "connect wallet and claim" -- but the signature actually approves a wallet drainer contract
• Fake NFT mints promise free or discounted NFTs from popular collections -- the mint transaction drains your ETH or approves token spending
• Dusting attacks send worthless tokens directly to your wallet. When you try to swap or interact with them, the token contract itself steals your assets
• Phishing NFTs are airdropped to your wallet with descriptions containing malicious links (e.g., "You won 5 ETH! Claim at fake-site.xyz")

5. Social media impersonation

Twitter/X, YouTube, and other platforms are rife with impersonation attacks. Common patterns include:

• Cloned profiles of project founders or influencers, often with a single character changed in the handle
• Fake verification badges on platforms where anyone can purchase a checkmark
• Reply scams that respond to legitimate project tweets with "click here to claim" phishing links
• Fake livestreams on YouTube featuring deepfake videos of Vitalik Buterin, CZ, or other figures promoting "double your ETH" schemes

6. Compromised project websites

Sometimes attackers do not need to create fake sites -- they compromise the real ones:

• DNS hijacking -- Attackers gain control of the project's domain registration and redirect traffic to a malicious frontend
• Frontend supply chain attacks -- Malicious code is injected into JavaScript libraries used by the dApp
• BGP hijacking -- Network-level attacks that reroute traffic to attacker-controlled servers
• Compromised deployment pipelines -- Attackers inject malicious code during the build or deploy process

Real-world examples

The best way to develop a sharp eye for phishing is to study real examples. Below are reconstructed scenarios based on actual attacks that have drained millions from web3 users.

Example 1: cloned DEX interface

Example 2: MetaMask phishing email

Example 3: Discord DM airdrop scam

Example 4: malicious approval transaction

Here is what a malicious approve() call looks like compared to a legitimate one. Pay close attention to the spender address and the amount:

Interactive phishing test

Think you can spot a phish? Test your skills with these scenarios based on real attacks. For each one, decide whether it is legitimate or a phishing attempt.

How to protect yourself

Prevention is the only real defense against phishing in web3. Once funds are stolen, recovery is almost impossible. Follow these practices to dramatically reduce your risk.

1. Bookmark legitimate sites

The simplest and most effective defense is to always access dApps through bookmarks you have personally verified, never through search results, social media links, or Discord messages. Create bookmarks for every DeFi protocol and marketplace you use regularly.

2. Verify URLs character by character

Before connecting your wallet to any site, carefully examine the full URL. Look for:

• Misspelled domain names (uniswvp vs uniswap)
• Wrong TLDs (.com vs .org)
• Subdomain tricks (uniswap.evil.com where "evil.com" is the real domain)
• Homoglyph characters that look identical but are different Unicode code points
• Extra characters or hyphens (uniswap-app.com)

3. Use a hardware wallet for signing

A hardware wallet like Ledger or Trezor adds a critical layer of protection. Every transaction must be physically confirmed on the device, giving you a moment to review what you are actually signing. Many hardware wallets now show human-readable transaction details on their screens.

4. Revoke unnecessary approvals

Regularly audit and revoke token approvals you no longer need. Use tools like:

• Revoke.cash -- Comprehensive approval management dashboard
• Etherscan Token Approval Checker -- View and revoke approvals directly
• Unrekt.net -- Multi-chain approval scanner

Make it a habit to revoke approvals after every DeFi session. Think of it like logging out of a website.

5. Use browser extensions for phishing detection

Several browser extensions can warn you before you interact with known phishing sites:

• Pocket Universe -- Simulates transactions before you sign them, showing you exactly what will happen
• Wallet Guard -- Blocks known phishing sites and warns about suspicious contracts
• Fire -- Transaction preview and simulation with human-readable explanations

6. Never click links from DMs

Token approval security

Token approvals are a fundamental part of how DeFi works, but they are also one of the most exploited mechanisms in web3. Understanding how they work is essential to protecting your assets.

How ERC-20 approvals work

The ERC-20 token standard includes an approve() function that allows a contract (the "spender") to transfer tokens on your behalf. This is necessary for DeFi -- when you swap tokens on Uniswap, you first approve the Uniswap Router to spend your tokens, and then it executes the swap.

The infinite approval problem

For convenience, many dApps request infinite approval (the maximum uint256 value: 2^256 - 1). This means you only have to approve once, rather than before every transaction. However, this creates a dangerous attack surface:

• If the approved contract is exploited or turns malicious, all of your approved tokens can be drained
• If you are phished into approving a malicious contract, there is no limit on how much can be stolen
• Approvals persist forever unless you explicitly revoke them

How to audit your approvals

Follow these steps to check and clean up your token approvals:

1. Visit a token approval checker such as revoke.cash or Etherscan's approval page
2. Connect your wallet and review all active approvals
3. Identify unnecessary approvals -- any contract you no longer use should have its approval revoked
4. Revoke unlimited approvals -- for contracts you still use, consider setting the approval to a specific amount instead of unlimited
5. Check all chains -- repeat for each network (Ethereum, Arbitrum, Polygon, BSC, etc.) where you are active

Incident response

If you suspect you have fallen for a phishing attack or notice unauthorized transactions from your wallet, time is critical. Follow these steps immediately.

Immediate actions (first 5 minutes)

Follow-up actions (first 24 hours)

• Document everything: Screenshot the phishing site, save transaction hashes, note the attacker's addresses. This evidence is important for reporting.
• Report the phishing site: Report it to Google Safe Browsing, PhishFort, the platform the link was shared on, and the project being impersonated.
• Warn the community: Post about the attack (without the phishing link) in relevant Discord servers and social media to help protect others.
• File a report: Submit reports to the FBI's IC3 (internet crime), your local law enforcement, and platforms like Chainalysis or ScamSniffer.
• Review your security posture: Determine how you were phished and update your habits. Consider whether you need better browser extensions, different DM settings, or additional verification steps.

Red flags checklist

Use this checklist as a quick reference before interacting with any website, message, or transaction. If you spot even one of these red flags, stop and verify through an independent channel.

URL & website red flags

• URL contains misspellings or unusual characters (check letter by letter)
• Domain TLD does not match the known official site (.com vs .org, etc.)
• No SSL certificate (no lock icon) or certificate warnings
• Site was accessed through a link in a DM, email, or social media post
• Browser address bar shows a different domain than expected
• Site immediately prompts wallet connection on load with no content
• Pop-ups or overlays urging immediate action

Message & social red flags

• Unsolicited DM from "project team" or "support staff"
• Anyone asking for your seed phrase or private key for any reason
• Urgent deadlines ("expires in 1 hour," "last chance," "act now")
• Promises of free money, airdrops, or rewards that seem too good to be true
• Claims that your wallet will be "suspended" or "frozen" (impossible with non-custodial wallets)
• Requests to "verify" or "validate" your wallet
• Messages telling you NOT to tell anyone about an exclusive offer

Transaction & approval red flags

• Approval request for an unverified or newly created contract
• Unlimited (MAX) token approval amount when a specific amount would suffice
• Transaction interacts with a contract you do not recognize
• MetaMask or wallet shows a "blind signing" warning
• The transaction does not match what the UI says it will do
• Multiple approval requests in sequence for different tokens
• Contract was deployed very recently (hours or days old)