1. Address poisoning and clipboard hijacking
Crypto addresses are long strings that people rarely read in full. Many wallets shorten them to the first and last few characters. Attackers exploit this by generating "vanity" addresses that share the same beginning and end as an address you use, then sending you a zero-value or tiny transaction from it. The fake address now sits in your transaction history, waiting for the day you copy the "usual" address from there.
A related threat is clipboard-hijacking malware, which silently replaces any address you copy with an attacker's address.
Protective habits:
- Keep a verified address book (whitelist) and send only to saved entries.
- Never copy a destination from your transaction history.
- Compare characters in the middle of the address, ideally on your hardware wallet's own screen.
- Ignore unexpected incoming "dust" transactions — do not interact with them.
Try our "spot the poisoned address" exercise →
2. Token approvals: the permissions you forgot
On smart-contract networks, using a decentralized application usually requires an approval that lets the app's contract move a specific token from your wallet. For convenience, many apps request an unlimited amount. That approval remains valid until you revoke it — even years after you last used the app.
If the contract is later exploited, or if you approved a malicious contract by mistake, tokens can be moved without any new action from you.
Protective habits:
- Where your wallet allows it, approve only the exact amount you need.
- Review approvals monthly using your network's block-explorer approval checker, and revoke the ones you no longer use.
- Keep long-term holdings in a "vault" wallet that never connects to apps at all.
3. Signature phishing and blind signing
Not every dangerous request looks like a transaction. Some are off-chain "signatures" — for example, permit-style messages or a request to approve all items in an NFT collection. Signing one can authorize a transfer later, without you ever paying a network fee or seeing a "send" screen.
"Blind signing" means approving data your wallet cannot display in readable form. Attackers rely on people clicking "confirm" out of habit.
Protective habits:
- Read every request. If you cannot understand what you are signing, do not sign it.
- Be especially cautious with requests mentioning permit, approve, setApprovalForAll or unlimited amounts.
- Use wallets that show transaction previews or simulations where available.
- Keep blind signing disabled on your hardware wallet unless you have a specific need.
4. SIM swapping and account takeover
In a SIM swap, a criminal persuades or bribes a mobile carrier to move your phone number to a SIM card they control. From then on they receive your calls and SMS codes, which can be used to reset passwords on your email and exchange accounts.
Protective habits:
- Ask your carrier to add a port-out PIN or number-lock to your account.
- Use an authenticator app or, better, a hardware security key for two-factor authentication.
- Remove your phone number as a recovery option on email and exchange accounts where possible.
- Use a separate email address used only for financial and crypto accounts.
5. Recovery phrase backups that survive real life
Your recovery phrase (often 12 or 24 words) is your wallet. Anyone who has it controls the funds; if you lose every copy, nobody can restore them. Backups have to survive fire, water, moving house and time — while staying out of reach of others.
Protective habits:
- Never photograph, screenshot, type or upload your recovery phrase.
- Consider a fire- and water-resistant metal backup, stored in a secure location.
- Test your backup by restoring it on a reset device before you fund the wallet with significant amounts.
- If you use an optional passphrase, store it separately from the recovery phrase — and remember that forgetting it means losing access permanently.
6. Hardware wallets and the "clean room" setup
A hardware wallet keeps private keys on a dedicated device, so a compromised computer cannot simply copy them. It only helps, though, if the device itself is genuine and you confirm details on its screen.
Protective habits:
- Buy directly from the manufacturer or an authorized reseller; avoid second-hand devices.
- Reject any device that arrives with a recovery phrase already printed or filled in — always generate your own.
- Install firmware and companion apps only from the manufacturer's official site, reached through a bookmark.
- Use a separate browser profile for crypto with no extensions other than your wallet.
7. Social engineering and fake support
Many losses involve no technical attack at all. A friendly "support agent" in a direct message, a phone call claiming your account is compromised, a romance that slowly turns into an "investment opportunity", or a request to install remote-desktop software "to help you".
Protective habits:
- Real support teams never contact you first by direct message and never ask for your recovery phrase.
- Never allow screen sharing or remote access while your wallet is open.
- Be skeptical of guaranteed returns, urgency and secrecy — these are classic warning signs.
- Treat "fund recovery" services asking for upfront fees as a likely scam.
8. Inheritance and incident planning
Two scenarios are almost never planned for: what your family should do if something happens to you, and what you should do in the first hour after noticing suspicious activity. Panic leads to mistakes — including falling for follow-up scams.
Protective habits:
- Write a letter that describes which assets exist and how to reach them, without including keys or phrases directly.
- For larger holdings, consider professional estate-planning advice or a multi-signature setup.
- Prepare a clean "incident wallet" in advance, so you can move remaining funds quickly from a safe device.
- Know where to report: local police and, in the United States, ic3.gov and reportfraud.ftc.gov.