How Scammers Steal Cryptocurrency Without Your Password: Fake Websites, Dangerous Signatures, and Address Poisoning

You don't have to reveal your recovery phrase or install malware to lose cryptocurrency. Sometimes, copying the wrong address or approving a request that looks routine is enough.

Published and checked on 12 November 2026

$68 million sent to the wrong address

On May 3, 2024, an unusual transaction took place on the Ethereum network.

The owner of a large cryptocurrency wallet sent approximately $68 million worth of Wrapped Bitcoin (WBTC), a token designed to track Bitcoin's value. The funds went to an address controlled by a scammer.

There was no confirmed evidence that anyone had stolen the owner's private key or compromised the blockchain itself.

The problem was the recipient's address.

Shortly before the large transfer, the wallet owner had sent a small test transaction to an address beginning with 0xd9A1b. The subsequent large transfer went to a different address beginning with 0xd9A1c.

The difference looked minor. On a blockchain, however, even one changed character means a completely different address.

Analysts at Chainalysis later reconstructed how the attack worked. The scammer used a technique known as address poisoning: placing a deceptive address in someone's transaction history.

According to the investigation, the campaign involved tens of thousands of similar-looking addresses. Most attempts did not result in major losses, but one was enough.

Over the following days, the parties exchanged messages through blockchain transactions. Most of the stolen funds were eventually returned. That outcome is far from guaranteed in similar attacks.

The case illustrates a key point about cryptocurrency security: a transfer can be processed exactly as confirmed, while the funds still end up with someone other than the intended recipient.

Address poisoning: when transaction history becomes a trap

A cryptocurrency address is a long string of characters identifying where funds should be sent.

For example, an Ethereum address contains 42 characters, including the 0x prefix.

Comparing these addresses in full is inconvenient. That is why many wallets display only the first and last few characters, hiding the middle.

Scammers take advantage of this design.

How address poisoning works

First, the scammer creates an address that looks similar to one the wallet owner has used before.

Next, they arrange for the deceptive address to appear in the wallet's transaction history. This can be done using small transfers or specially crafted token transfer records.

The result is a transaction history entry containing an address that looks familiar.

If the wallet owner later copies that address without checking it in full and confirms the transfer, the cryptocurrency goes to the scammer. The network cannot tell that the sender intended to use a different address.

Why even a test transfer may not protect you

Before sending a large amount of cryptocurrency, some people send a small amount first to check the recipient's address. If the test payment arrives as expected, they send the rest.

But scammers can place a deceptive address in the transaction history. If the sender copies it for the next transfer, the main amount may go to the scammer even though the first transfer was successful.

What to check: Before every transfer, compare the recipient's full address against independently verified payment details. Do not automatically copy an address from your transaction history, even if an earlier transfer was successful.

Fake websites: why a familiar interface proves nothing

Another common scam involves impersonating a cryptocurrency website.

Scammers create pages that look almost identical to legitimate exchanges, wallets, and cryptocurrency applications.

They may use authentic logos, familiar buttons, similar menus, and even links to genuine documentation.

These copies are sometimes called website mirrors. However, a mirror and a phishing copy are not necessarily the same thing.

An official mirror can be an alternative version of a website provided by its owner.

A phishing copy imitates a legitimate website without authorization to deceive visitors.

How to spot a misleading domain name

Consider these two fictional addresses:

https://wallet.example.com

https://wallet-example.com

In the first, wallet is a subdomain of example.com.

In the second, wallet-example.com is a separate domain.

They look similar, but they can belong to entirely different owners.

Also, https:// and a secure-connection icon do not prove that a website is legitimate.

HTTPS means that the connection between your browser and the website is encrypted. A scam website can use HTTPS too.

How phishing pages reach users

Fake websites can appear in messages, emails, social media posts, and sponsored search results.

A paid search advertisement is not proof that a website is authentic.

If a link appears to lead to an official service but opens a different domain, stop and verify where it came from.

What to check: The exact website address, the source of the link, and the actions the page asks you to take.

Never enter your wallet's secret recovery phrase (also known as a seed phrase) or private key on a page that unexpectedly asks you to “verify,” “check,” or “sync” your wallet.

Connecting your wallet does not mean giving someone control of your funds

When you open a decentralized application, it may ask you to connect your cryptocurrency wallet.

This is a standard feature of Web3 services, which interact with blockchain networks.

But several different actions need to be distinguished.

• Connect. Allows an application to interact with your wallet, for example by viewing its public address.
• Sign. Uses a digital signature to approve specific data.
• Approve. Grants an address or smart contract permission to use certain tokens.
• Transfer. Sends cryptocurrency or tokens to another address.

These are four different actions.

Simply connecting a wallet does not automatically give a website permission to transfer your tokens.

After connecting, however, an application may ask you to approve additional actions that do affect your funds.

Scammers often exploit the confusion between them.

Token approvals: permissions that may outlast a transaction

Some applications need permission to use tokens held in your wallet.

For example, when swapping one cryptocurrency for another, an application may request permission to use a specified amount of a token.

This is known as a token approval. For ERC-20 tokens, the mechanism includes the approve function.

An approval determines which address or smart contract may use your tokens and up to what amount.

Where the risk begins

Instead of asking for a small amount, an application may request access to an extremely large amount. This is commonly called an unlimited approval.

If you grant that permission to a malicious smart contract, or to one that is later compromised, your tokens may be at risk.

That does not mean the contract has access to every asset in your wallet.

An approval is limited to the relevant token, the approved spender, and the allowance you set.

Why an old approval can remain risky

Some permissions remain active after the original transaction is complete.

You may stop using an application, but the approval you granted earlier can remain in place.

Disconnecting a website from your wallet does not necessarily revoke its token approvals.

Revoking an approval may require a separate blockchain transaction, commonly called revoke approval.

What to check

Before granting permission, ask:

• Which token will the application be able to use?
• Which address or smart contract is receiving the permission?
• What amount does the approval cover?
• Is this approval actually necessary for the transaction?

If your wallet lets you set a limit, avoid approving more tokens than the operation requires.

MetaMask recommends reviewing active approvals regularly and revoking permissions you no longer need.

Remember: revoking an approval can prevent future use of tokens under that permission, but it cannot recover funds that have already been transferred.

Signature phishing: when signing a message becomes dangerous

Not every cryptocurrency-related action looks like a transfer.

Sometimes an application asks you to sign a message.

A signature can be used to log in, prove that you control a wallet, or authorize certain actions.

But not all signatures have the same consequences.

Signing in versus authorizing token use

A standard login signature generally does not give an application access to your funds.

However, some mechanisms allow a digital signature to authorize operations involving tokens.

These include certain forms of permit and Permit2.

In such cases, a user can grant financial permissions without seeing the usual transfer confirmation or paying a network fee at the time of signing.

A fraudulent website may disguise the request as a routine wallet verification.

This type of deception is known as signature phishing.

Why no network fee does not mean no risk

Many users associate cryptocurrency transactions with network fees.

But a digital signature can be created without immediately sending a transaction to the blockchain.

That does not automatically make it safe.

The risk depends on what you sign and how the signed data can be used.

What to check

If your wallet asks you to sign a message, find out what the signature authorizes.

Pay particular attention to requests that mention tokens, amounts, addresses, or expiration dates.

If you do not understand the request, do not approve it.

MetaMask's documentation discusses signature phishing and the risks associated with Permit2.

Why a fake token can have a genuine-looking name

A cryptocurrency's name and ticker symbol, such as BTC or ETH, are not always enough to identify the asset.

On some blockchain networks, different tokens can have identical names and symbols.

A token carrying the name of a well-known project is therefore not necessarily that project's official asset.

To identify a token, check its smart contract address and the blockchain network on which it exists.

Then compare both details with information published by the project's official channels.

Even the correct contract address does not guarantee that a token is safe or will increase in value.

It helps establish that you are dealing with the asset you intended to use, rather than another token with a similar name.

What to do if you have already taken a suspicious action

First, identify exactly what happened.

Different situations call for different responses.

• You only opened a suspicious website. Opening a website does not automatically mean your funds have been stolen. However, if you downloaded files, entered passwords, or approved requests, assess what those actions may have exposed.
• You connected your wallet. Review the requests you approved after connecting. Connecting alone generally does not allow a website to transfer tokens, but subsequent approvals or signatures may create additional risks.
• You granted a smart contract permission to use tokens. Review your active token approvals using your wallet's features or a trusted approval-checking service. If a permission is unnecessary or suspicious, consider revoking it. Revocation may require a network fee and cannot reverse transfers that have already taken place.
• You signed a suspicious message. Try to establish what the signature may have authorized. In particular, review any permissions to use your tokens. Not every signature carries the same risk, so the appropriate response depends on the message you signed.
• You disclosed your recovery phrase. If someone else has learned your secret recovery phrase, treat the wallet associated with it as compromised. To protect any remaining assets, you will need a new, independent wallet with a new recovery phrase, created in a secure environment.
• You sent funds to the wrong address. Save the transaction ID, sender and recipient addresses, network name, and time of the transfer. Confirmed blockchain transfers generally cannot be reversed through your wallet. If a centralized exchange or another service was involved, contact its official security support as soon as possible. If you suspect fraud, preserve the evidence and report it to the relevant law enforcement authorities. Be wary of unsolicited offers promising guaranteed recovery in exchange for an upfront payment.

Can EU regulation prevent these attacks?

The European Union has adopted Regulation (EU) 2023/1114, known as MiCA.

It establishes rules for certain crypto-assets and businesses providing crypto-asset services.

However, MiCA does not technically prevent fake websites or transfers to incorrect addresses.

The European supervisory authorities EBA, ESMA, and EIOPA warn that the level of legal protection depends on the asset, the service, and the provider's regulatory status.

You can check whether a provider is authorized to offer crypto-asset services in the EU through ESMA's official register.

Even when using a regulated service, you still need to verify addresses, signatures, and approvals yourself.

Legal safeguards and technical security complement each other; neither replaces the other.

What to check before confirming an action

You do not need to memorize dozens of scams. It is more useful to know what to check before taking each action.

1. Opening a website? Verify the domain and where the link came from.
2. Connecting a wallet? Make sure you are using the intended application.
3. Signing a message? Check what the signature authorizes.
4. Granting token access? Check who receives the permission and the amount covered.
5. Sending cryptocurrency? Verify the network and the recipient's full address against an independent source.
6. Using a token? Compare its contract address with the project's official information.

None of these checks guarantees complete safety. Each can, however, help prevent a specific type of scam.

Conclusion

The May 2024 transfer involving $68 million stands out for more than its size.

It shows that losing cryptocurrency does not always require someone to hack your wallet.

Sometimes a scammer plants a deceptive address. Sometimes a fake website looks legitimate. And sometimes a user grants a permission without understanding its consequences.

In each case, the crucial moment is when an action is confirmed.

A blockchain transfer can be processed as authorized even when the outcome is nothing like what the sender intended.

Keeping your secret keys safe is therefore only one part of cryptocurrency security.

It is just as important to understand exactly what you are confirming and what permissions you are giving to others.