Crypto Phishing in 2026: The Signature Is the Exploit

The heist that needs no bug

The most expensive line of code in crypto is rarely written by the attacker. It is signed by the victim. A phishing drain does not break a smart contract, jump a firewall, or crack a private key. It borrows the owner’s own key for one valid, on-chain, perfectly legal action: an approval, a permit, a delegation, a plain transfer. Nothing is exploited. Everything is authorized. That single fact is why phishing has become the security problem the industry cannot audit its way out of. You can pay three firms to review a contract, the kind of code-level failure we catalogued in the Trail of Bits bug list, but you cannot review the half second in which a distracted user clicks Confirm.

In 2026 the picture splits cleanly in two. The kind of phishing that empties a wallet in a single signature, the drainer kind, had a genuinely bad year for the criminals: reported losses fell by more than four fifths. The kind of phishing that convinces a human to send the funds themselves, the pig-butchering and impersonation kind, grew into a category measured in tens of billions of dollars. Same weapon, opposite direction. Both turn a user’s consent into the exploit, and neither leaves a bug for anyone to patch. This is a guide to how the signature became the attack surface, why one lane collapsed while the other boomed, and what actually stops a drain.

Two phishing economies, moving in opposite directions

Start with the lane that shrank. Scam Sniffer, which tracks on-chain wallet-drainer phishing across EVM chains, reported that losses fell to $83.85 million across 106,106 victims in 2025, down 83% in dollars and 68% in victims from about $494 million and 332,000 victims in 2024. The single largest theft dropped from $55.4 million to $6.5 million. Even the peak did not spare the pattern: the worst quarter was the third, at $31.04 million, coinciding with the year’s strongest Ethereum rally, because drainer volume rises and falls with on-chain activity.

Phishing, in other words, is a pro-cyclical business. When prices climb and wallets get busy, more people sign more transactions and more of them get caught; when the market cools, as it did through the stretch where shifting Fed expectations dragged on crypto risk appetite, drainer revenue falls with it. That correlation is the first reason to be cautious about calling the 83% drop a clean victory: some of it is simply a quieter market, not a safer one.

Now the lane that exploded. Scam Sniffer measures only the drain-your-wallet variety. The broader fraud category, the one that talks victims into sending crypto themselves, went the other way. Chainalysis estimated about $17 billion in crypto scam revenue for 2025, built from more than $14 billion in confirmed on-chain activity, and found impersonation scams up 1,400% year on year, with the average payment rising from $782 to $2,764. The FBI’s Internet Crime Complaint Center counted $9.3 billion in crypto-related losses across roughly 150,000 complaints in its 2024 report, a 66% jump, including $5.8 billion in crypto investment fraud alone. The signature-drain problem got smaller. The confidence-trick problem got much bigger. Both are phishing, and confusing the two is how people conclude, wrongly, that the threat is receding.

How a signature becomes a heist: approve, Permit and Permit2

To see why a single click can be terminal, look at what a wallet is actually asking when it pops up. The oldest mechanism is the ERC-20 approve function. Legitimate applications use it constantly: before a decentralized exchange can swap your USDC, you approve the exchange’s contract to move some of it. The catch is the amount. To save users a second approval later, most dapps request an unlimited allowance, the maximum a 256-bit number can hold. A phishing site copies that exact pattern. You believe you are enabling a trade or claiming an airdrop; you are handing a stranger’s contract permission to move that token out of your wallet whenever it likes, for as long as the approval stands and regardless of how much you deposit afterward.

The modern version is worse because it is quieter. EIP-2612 introduced Permit, a gasless approval: instead of sending an on-chain transaction, you sign an off-chain message, and the spender submits it later. It costs the victim no gas and leaves no trace in the wallet’s transaction history until the moment it is used to sweep funds. Uniswap’s Permit2 generalized this into a single contract that can authorize many tokens at once. This is the mechanism phishers prize most, because it can be dressed up as something harmless. A real Sign-In-with-Ethereum login is a plain message that cannot move a cent; a Permit signature can be made to look almost identical in a rushed wallet popup, except that it drains you. Among 2025 cases above $1 million, Scam Sniffer found Permit and Permit2 were the single biggest bucket, $8.72 million, or 38% of large-case losses. MetaMask’s own explainer on token approvals spells out the same uncomfortable point: the popup you wave through is a spending permission, not a password.

The lesson is simple and hard to internalize: a signature request is not a login. It can be an instruction to give your money away. The table below maps the everyday prompts to what they can actually authorize.

Ice phishing and the setApprovalForAll trap

For NFTs the equivalent trap has a name. In February 2022, after roughly $120 million was drained from Badger DAO, Microsoft’s 365 Defender research team coined the term ice phishing to describe an attack that steals nothing directly and instead tricks the user into signing an approval that delegates control of their assets. The relevant function is setApprovalForAll, which authorizes an operator to move every token you hold in an NFT collection. It appears in legitimate flows constantly, when you list on a marketplace or stake a collection, so it is easy to wave through when it is disguised as a mint or a reward claim.

What makes ice phishing dangerous is patience. An attacker can accumulate approvals from many wallets over weeks, then drain them all in a coordinated sweep once enough value has built up. The Badger DAO case was also an early warning about a second front: the malicious approval prompts were injected into Badger’s own website through a compromised interface, so users on the real domain were served the trap. Chris Seifert, the Microsoft research manager who introduced the term, framed the incident as proof that security has to be built into the way Web3 asks for consent, not bolted on afterward. Four years later, that consent layer is still where the money leaks.

Blind signing: the payload you cannot read

All of these attacks share a root weakness: the human cannot read what the machine is asking. Beyond approvals sits eth_sign, a low-level request to sign an arbitrary hash. A wallet that surfaces it shows a wall of hexadecimal, and behind that opaque payload can be almost any action. This is blind signing, and it is the flaw hardware makers have warned about for years. Charles Guillemet, chief technology officer at Ledger, put it plainly when he warned that such a message “is not intelligible by default. It’s a digital payload,” reducing the user’s only protection to the slogan he repeats often, “don’t trust, verify.”

Blind signing is not a retail-only problem. The $1.5 billion Bybit theft in February 2025, the largest in crypto history, worked because professional signers approving a routine multisig transaction were shown a correct-looking interface while the payload they actually signed quietly altered the cold wallet’s logic. If the people guarding a billion-dollar treasury can be fooled by an unreadable payload, an individual approving a “claim” has no chance at all. The structural answer, clear signing, comes later in this piece; the immediate point is that legibility, not vigilance, is the missing ingredient. Telling users to be more careful about a payload they cannot decode is advice that was designed to fail.

EIP-7702 and the one-signature takeover

The newest twist arrived with Ethereum’s Pectra upgrade in May 2025. EIP-7702 lets an ordinary externally owned account temporarily behave like a smart contract by delegating execution to code. It is a genuine usability improvement, enabling batched transactions and sponsored gas. It also handed phishers a clean primitive: convince a victim to delegate their account to attacker-controlled code, and one signature can sweep everything in a single batch. Campaigns dress the request up as a “wallet upgrade,” a “security enhancement,” or an “AI assistant authorization,” all of which sound like routine maintenance rather than a handover of the account itself.

The pattern industrialized almost immediately. Wintermute’s researchers found that more than 97% of EIP-7702 delegations pointed to copies of the same sweeper contract, nicknamed CrimeEnjoyor, a short reusable script that auto-drains any ETH sent to a compromised address. A MetaMask user was drained by an Inferno-linked 7702 delegation within weeks of the upgrade; by late August a single victim lost $1.54 million after signing a 7702 batch that bundled token transfers and NFT approvals. Scam Sniffer logged EIP-7702 batches as a brand-new seven-figure category, $2.54 million across its large 2025 cases. Taylor Monahan, a security lead at MetaMask, has argued that these drains are fundamentally a private-key and phishing problem, not a flaw in Pectra: the upgrade did not weaken anything, it just gave a single signature more reach.

Address poisoning: the copy-paste trap

Not every phishing loss involves an approval. Address poisoning attacks the most mechanical habit in crypto: copy and paste. The attacker generates a vanity address whose first and last characters match one you transact with often, then seeds it into your history with a tiny or zero-value transfer so it appears in your recent-activity list. Later, when you copy an address from that history to repeat a payment, you grab the lookalike and send funds to the attacker instead of your intended recipient. There is no malicious contract and no approval to revoke; the exploit is your own trust in the truncated address your wallet shows you.

The scale can be staggering. On 3 May 2024 a victim sent 1,155.28 WBTC, worth roughly $68 million, to a spoofed address after the attacker had primed the history with a 0.05 ETH transfer. That case had a rare happy ending: after forensic tracing by Match Systems and the exchange Cryptex closed off a clean exit, the attacker negotiated and returned about 22,960 ETH a week later. Most victims are not so lucky. The defense is unglamorous and total: never copy a destination address from transaction history, verify the full string rather than the first and last few characters, send a small test amount before a large transfer, and keep known-good addresses in a saved allowlist.

The delivery layer: ads, airdrops and hijacked front-ends

A malicious signature is useless until a victim reaches it, so the delivery layer is where most of the criminal creativity lives. The staples are paid search and social ads impersonating wallets and exchanges, fake airdrop and claim sites timed to real token launches, hijacked X and Discord accounts pushing mint links to trusting followers, and lookalike domains promoted through search-engine poisoning. Each funnels users to a page that looks legitimate and asks for exactly one signature. The most effective campaigns do not even try to be greedy on the first click; they mirror a real product so faithfully that the victim completes a normal-seeming action and only notices the drain hours later.

Most of it is less exotic and more effective for it. A user searches for a wallet or an exchange, clicks the top paid result, and lands on a pixel-perfect clone that asks them to import or verify their wallet. Or a support question in a project’s Discord is answered within seconds by an impersonator who sends a validation link. The tell is almost always the same: a legitimate service never needs your seed phrase and never resolves a support ticket by asking you to sign a transaction. Attackers rely on the reflex that a stressed user looking for help will follow the first confident voice that offers it.

The most alarming vector removes the user’s judgment entirely by compromising the real front-end. On 14 December 2023, an attacker phished a former Ledger employee’s npm account and pushed malicious code into the widely used Ledger Connect Kit, which meant drainer prompts appeared inside genuine DeFi interfaces including SushiSwap, Zapper and, with grim irony, the approval-revocation tool Revoke.cash. More than $600,000 was taken in under two hours before a fix shipped about 40 minutes after detection. DNS hijacks of protocol domains work the same way, serving a poisoned page from the correct web address. The takeaway is that only using official sites is necessary but not sufficient, which is why wallet-level defenses that inspect the transaction itself matter so much. Modern wallets increasingly screen destinations against drainer blocklists and simulate transactions before you sign, a shift we compared across MetaMask, Phantom and Rabby.

When phishing goes human: fake support, fake jobs and pig butchering

The fastest-growing phishing does not touch a signature at all; it talks a person into pressing send. The template combines stolen personal data with a convincing impersonation. In May 2025 Coinbase disclosed that criminals had bribed overseas support contractors to exfiltrate data on roughly 70,000 customers, including names, masked bank details, the last four digits of Social Security numbers and identity-verification images. The data itself unlocked nothing directly, but it made the follow-on phone calls devastating: attackers posing as Coinbase security could recite real details and walk victims through moving funds to a “safe” wallet. Coinbase refused a $20 million ransom, told the SEC in an 8-K filing it expected $180 million to $400 million in remediation and reimbursement costs, and pledged to repay customers tricked by the scheme. The value of a data breach is often the phishing it enables, a link back to the identity data exchanges are required to collect.

Social engineering also targets the people with the keys. The Ronin bridge theft in 2022, one of the largest in crypto history at hundreds of millions of dollars, began with a fake job offer: a senior engineer was sent a booby-trapped document during a sham interview, and the resulting malware harvested access to five of the nine validator keys. At the retail end, the romance-and-investment scam known as pig butchering has merged with the drainer world. Chainalysis describes approval phishing as the technical endgame of these long cons: once a scammer has spent weeks building trust, the final move is often a single approval signature rather than a wire transfer. That convergence is why, on 16 March 2026, the US Secret Service, the UK’s National Crime Agency, the Ontario Provincial Police and the Ontario Securities Commission ran Operation Atlantic, a coordinated week focused specifically on finding approval-phishing victims before their funds were swept.

The scale of the confidence-trick lane dwarfs the drainer one. The FBI attributed $5.8 billion of 2024 losses to crypto investment fraud alone, the category that includes pig butchering, where a scammer cultivates a relationship over weeks or months, points the victim to a fake trading platform showing fabricated gains, and extracts larger and larger deposits until the mark runs dry. The final step increasingly borrows from the drainer playbook: rather than asking for one more transfer, the scammer walks the victim through connecting a wallet and signing an approval, which is why investigators now treat the two problems as a single pipeline.

Why the drain lane shrank while the supply chain kept humming

So why did the drain-your-wallet lane collapse while everything around it grew? Part of the answer is that the defenders finally moved to where the attack happens. Wallets now ship blocklists that flag known drainer domains, and transaction simulation that translates a signature into a preview such as this will transfer all of your USDC, turning an invisible drain into a visible warning. Security firms feed shared threat intelligence into MetaMask, Phantom and Coinbase Wallet, and clear signing is spreading across the ecosystem. Domain takedowns and the arrest or exit of major drainer crews thinned the supply. For once, the tooling caught up with a specific attack pattern.

The quiet workhorse behind the decline was transaction simulation. Instead of trusting a signature request at face value, a simulating wallet runs the transaction against a fork of the chain and reports the actual outcome before you sign: which tokens leave, which approvals are granted, and whether the counterparty appears on a known drainer blocklist. Security vendors such as Blockaid and Scam Sniffer specialize in this kind of screening and now sit inside major wallets, so a request that would move every token in an account increasingly triggers a red banner rather than a routine confirm. It is not foolproof, but it shifted the hardest part of the problem, reading an opaque payload, from the user to the machine.

But the machine did not stop; it adapted. Inferno Drainer, which publicly announced a shutdown in late 2023, never actually left. Check Point Research documented its reloaded operation stealing at least $9 million from more than 30,000 wallets in a single six-month stretch, using single-use short-lived contracts and on-chain encrypted configurations specifically to slip past the new blocklists. When one drainer-as-a-service crew retires, its affiliates migrate to the next, and the kits still take a cut, typically 20% to 30%, of whatever they help steal. The 83% drop is real, but it is best read as a market that got harder to work in during a cooler year, not one that closed. Displacement, not defeat, is the honest verdict.

The defense stack: how not to sign your funds away

Because phishing exploits consent, the defense is a discipline more than a product. The single most useful mental switch is to stop reading wallet prompts as logins and start reading them as spending instructions. From there, a short checklist covers most of the risk for an individual holder.

• Prefer a wallet that clear-signs. If a prompt cannot tell you in plain language what you are authorizing, treat that as a red flag, not a formality.
• Never grant unlimited approvals when a specific amount will do, and audit standing approvals regularly with a tool like Revoke.cash, revoking anything you do not recognize.
• Keep a small hot wallet for minting and experiments, entirely separate from a hardware-secured vault that holds the bulk of your funds, so a bad signature can only reach a limited balance.
• Verify full destination addresses, never copy them from transaction history, and send a small test transfer before any large one.
• Distrust urgency. Claim now, verify to unlock and upgrade your wallet are pressure tactics; a real opportunity survives a five-minute pause and a second device.

For teams and treasuries the same logic scales up: hardware signing behind a multisig, clear signing on every device, transaction simulation wired into the approval flow, an allowlist of trusted contracts, and strict out-of-band verification for any support, withdrawal or security-team request. The Coinbase and Ronin cases show that the human channel is now a primary attack surface, which ties directly to the difference between holding an asset and controlling it that we unpacked in our guide to crypto custody. A treasury that cannot see what its signers are approving is a treasury waiting to be phished.

Clear signing and the structural fix (ERC-7730)

The structural fix for the signature problem is to make the payload readable, and it now has a standard. ERC-7730, known as clear signing, pairs machine calldata with human-readable descriptors so a wallet can render a message like you are approving Contract X to spend all of your USDC instead of a hash. Ledger, which originated the work, handed stewardship to the Ethereum Foundation on 12 May 2026 as part of a broader push toward what the industry calls WYSIWYS, or what you see is what you sign. It is the first serious attempt to close the legibility gap at the protocol level rather than asking every user to become a bytecode analyst.

The adoption list is meaningful: Ledger, Trezor, MetaMask, Fireblocks and WalletConnect are among those backing the format, and the Ethereum Foundation has explicitly tied blind signing to billions in losses, the Bybit theft included. Clear signing is not a cure. Descriptors have to exist for each contract, sophisticated fakes can still mislead, and it does nothing for the send-it-yourself social scams. But it closes the specific gap, I could not tell what I was signing, that made approval and blind-signing phishing so lucrative in the first place. The measure of its success will be whether a fake Permit prompt starts to look obviously wrong instead of indistinguishable from a real one.

Regulators, exchanges and the recovery mirage

Where do regulators fit? In the United States, the SEC’s remit is disclosure and securities law, not wallet design, so its main touchpoint is exactly what Coinbase did: treat a breach as a material event and file it. The practical reporting channel for victims is the FBI’s Internet Crime Complaint Center, and cross-border operations like Operation Atlantic show law enforcement trying to reach victims before the drain completes rather than only prosecuting afterward. Exchanges voluntarily reimbursing socially-engineered customers, as Coinbase pledged, is a newer and still contested norm, since it blurs the line between a platform’s failure and a signature the user produced with their own key.

The hardest truth is about recovery. On-chain transfers are irreversible, and the fund-recovery services that flood a victim’s mentions within hours of a public loss are, overwhelmingly, a second scam layered on the first. Genuine recoveries do happen, the $68 million WBTC return being the clearest example, but they depend on forensic tracing, exchange cooperation and sometimes a negotiated deal with the thief, not on paying an upfront fee to a stranger promising to claw funds back. The realistic posture is prevention, because the after-the-fact odds are poor and the recovery market is itself adversarial. Anyone who guarantees a refund for a fee is running the same playbook that emptied the wallet in the first place.

The next phase: AI-scaled phishing

The next phase is industrialization. Chainalysis found that AI-assisted scams are already about 4.5 times more profitable than traditional ones, extracting an average of $3.2 million per operation versus $719,000, with roughly nine times the transaction activity. Phishing-as-a-service platforms now spin up fake sites and SMS campaigns at scale; one operation impersonating toll-road agencies allegedly sent 330,000 texts in a single day and cleared about $1 billion over three years. Deepfaked support calls, translated lures and machine-written personalization make the confidence-trick lane cheaper to run and much harder to spot, which is precisely why the impersonation category grew while raw drainer losses fell.

Through all of it, the choke point does not move. Whether the lure is a fake airdrop, a hijacked front-end, a six-month romance or an AI-cloned voice, the theft still completes at the instant a human authorizes it, with a signature or a send. That is the bad news, because there is no patch for consent. It is also the good news, because it means the defense is knowable: make what you sign legible, keep the valuable keys off the machine that browses, and slow down before the click. In a year when one phishing economy shrank 83% and another exploded, the difference came down to whether the victim could see what they were agreeing to.

Frequently Asked Questions

What is approval phishing in crypto?

Approval phishing tricks a wallet owner into signing a transaction or message that grants an attacker permission to move their tokens. Instead of stealing a private key, the attacker relies on a valid approve, Permit, Permit2 or setApprovalForAll signature that the victim authorizes, usually disguised as a login, a claim or a wallet upgrade. Once signed, the attacker can drain the approved assets at will.

How is crypto phishing different from a smart-contract hack?

A smart-contract hack exploits a bug in code. Phishing exploits the user: the transaction it produces is valid and authorized, so there is nothing for auditors to patch. That is why phishing losses persist even as protocols get more secure, and why the defense has to sit in the wallet and the human rather than in the contract.

Did crypto phishing losses really fall in 2025?

Yes, for one category. Scam Sniffer reported that on-chain wallet-drainer phishing fell to $83.85 million in 2025, down 83% from about $494 million in 2024. But broader scam categories moved the other way: Chainalysis estimated about $17 billion in total crypto scam revenue in 2025, with impersonation scams up 1,400% year on year. The signature-drain problem shrank while the confidence-trick problem grew.

What is the best defense against wallet-drainer phishing?

Treat every signature request as if it can spend money, and use a wallet that shows what you are signing in plain language, known as clear signing. Avoid unlimited approvals, review and revoke standing approvals with a tool like Revoke.cash, keep high-value funds on a hardware wallet in a separate account, and never rush a claim, verify or upgrade prompt.

Can crypto stolen through phishing be recovered?

Usually not. Blockchain transfers are irreversible, and most fund-recovery services advertised after a theft are themselves scams. Recoveries do happen, such as the $68 million WBTC address-poisoning theft that was returned in 2024, but they depend on forensic tracing, exchange cooperation or a negotiated return, not on a guaranteed process or an upfront fee.

Anneke de Vries covers security and exploits for HOGE Wire.