You copy a wallet address, paste it into the send field, and hit confirm. Everything looks right. But a silent piece of malware swapped that address the moment it hit your clipboard — and your funds are now gone, irreversibly, to a stranger. Most successful attacks on crypto holders do not break the blockchain. They exploit predictable human behaviours: copy-pasting addresses without checking, downloading apps from search results, and trusting a phone number as a recovery factor. Self-custody means you are the last line of defence. Understanding your attack surface is the first step to protecting it.
Phishing: When the Threat Wears a Trusted Face
Phishing in crypto takes three main forms. Email phishing mimics exchange alerts or wallet notifications to create urgency — a suspended account, a suspicious login, a withdrawal you did not make. Search-ad phishing places paid ads impersonating wallet or decentralised exchange sites above organic results; the ad domain differs subtly from the real one ("metamask-app.io" instead of "metamask.io"). Social phishing arrives via Discord DMs from fake support bots or Telegram groups promising airdrops.
The goal in every case is the same: capture your seed phrase or private key, or trick you into approving a malicious transaction. No legitimate service ever asks for a seed phrase. Not your wallet provider, not exchange support, not a site offering to verify your account.
Search-ad phishing is increasingly dangerous because the visual design of a fake site can be pixel-perfect. The attacker buys Google or Bing ads for high-intent queries like "MetaMask download" or "Uniswap app", and users who click the ad rather than navigating directly land on a drainer site. The red flags — mismatched URL, an import-your-wallet prompt on first load, urgency framing — are easy to miss when you are in a hurry.
How to protect yourself: Bookmark official wallet URLs and navigate directly. Never click wallet links from emails or search ads. If possible, use a hardware wallet for signing, so even a convincing fake site cannot extract your keys — the device requires a physical button press on its own tamper-resistant screen.
Clipboard Hijackers: The Silent Address Swap
A clipboard hijacker (a category of malware) monitors your system clipboard for patterns matching crypto wallet addresses. Bitcoin addresses begin with 1, 3, or bc1; Ethereum addresses begin with 0x. When a matching string is detected, the malware silently replaces it with an attacker-controlled address before you paste.
The attack is invisible by design. The send field shows the attacker's address, which can look superficially correct at a glance, especially if the first and last few characters are spoofed to resemble your intended destination.
Distribution channels for this malware are diverse: malicious browser extensions, trojanised desktop apps such as cracked trading tools or fake portfolio trackers, and counterfeit hardware-wallet companion software. The GitVenom campaign, documented by Kaspersky in late 2024, distributed clipboard hijackers through fake GitHub repositories. Approximately 5 BTC — worth around $485,000 at the time — was stolen from victims in Brazil, Turkey, and Russia. Clipboard hijacking is not confined to Windows. ClipXDaemon, identified by Cyble in February 2026, targets Linux systems by intercepting X11 clipboard sessions.
How to protect yourself: After pasting any wallet address, verify the full string character by character before confirming. A hardware wallet enforces this habit structurally: it displays the true destination address on its own screen, independent of what your computer's clipboard contains. Never install browser extensions from outside official stores, and avoid running software obtained outside the developer's verified distribution channel.
Address Poisoning: One Wrong Character Costs Everything
Address poisoning exploits a common shortcut in wallet user interfaces. Most wallets display only the first four to six characters and the last four to six characters of a wallet address. Attackers generate lookalike addresses — vanity addresses — that match those visible characters exactly. They then send tiny "dust" transactions (small, near-worthless amounts) from the fake address to the victim's wallet, inserting the lookalike into the victim's transaction history.
When the victim later wants to re-send funds to a known address, they scroll their transaction history, see the familiar-looking entry, copy it, and send — to the attacker's wallet.
The scale of this attack is significant. Chainalysis documented a single campaign in 2024 that generated 82,031 fake addresses, affected 2,774 victims, and caused approximately $69.7 million in total losses. In May 2024, an address poisoning attack nearly cost a single holder $68 million in Wrapped Bitcoin (WBTC); the funds were returned after negotiation, but the attacker retained approximately $3 million in appreciation gains during the negotiation period. In December 2025, a crypto trader lost $49,999,950 in USDT in a single transaction to a poisoned address.
Never copy addresses from your transaction history. Use a saved address book, or re-paste from the verified original source each time.
How to protect yourself: Save frequently used addresses in your wallet's address book rather than re-copying from history. When sending large amounts, confirm every character of the destination address — not just the first and last few. Hardware wallets display the full address on-screen for manual verification before signing.
Fake Wallet Apps: Malware Hiding in the App Store
Fake wallet apps copy the icon, name, and interface of legitimate wallets. Once installed, they either display a fake seed-phrase import screen — harvesting phrases from users who restore an existing wallet — or silently execute drainer transactions against connected accounts.
These apps circulate through official stores, making them particularly credible. Check Point Research documented a fake "WalletConnect — Crypto Wallet" app on Google Play in 2024 that accumulated over 10,000 downloads over five months, evaded detection entirely (zero VirusTotal detections), and drained more than $70,000 from over 150 victims using the MS Drainer toolkit. In 2025, Google removed more than 22 fake crypto wallet apps impersonating PancakeSwap, SushiSwap, and Raydium — many used fake import screens to harvest seed phrases.
Search ads and SEO manipulation push fake apps above the legitimate versions in both app store and web search results, compounding the problem.
How to protect yourself: Before installing any wallet app, navigate to the wallet's official website first and follow the download link from there. Check the exact developer name — a single character difference can be the only visible distinction. Read recent reviews for reports of fund loss. And critically: never enter a seed phrase into a freshly installed application unless you arrived at it via the official distribution channel.
SIM Swaps: When Your Phone Number Becomes a Liability
A SIM swap (also called SIM hijacking) is a social engineering attack in which an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. This is typically achieved through a combination of personal data gathered from data breaches, social media, and in some cases carrier employee bribery.
Once the attacker controls your number, they intercept SMS one-time passwords (SMS OTP). This lets them reset your email account, then your exchange login, then drain your crypto. The irreversibility of on-chain transactions makes crypto the ideal target: unlike a bank transfer, there is no chargeback and no dispute process.
The scale of the problem is documented and growing. The FBI's 2024 Internet Crime Complaint Center (IC3) annual report recorded 982 SIM-swap complaints in the United States with approximately $26 million in reported losses. UK fraud service Cifas reported a 1,055% surge in SIM swap cases in 2024, rising to nearly 3,000 incidents from 289 the prior year. In March 2025, T-Mobile was ordered to pay $33 million in arbitration after a single SIM swap enabled the theft of a customer's cryptocurrency holdings.
Crypto holders are disproportionately targeted: on-chain wealth is publicly visible, social media frequently signals holdings, and the irreversibility eliminates chargebacks.
How to protect yourself: Remove your phone number as a two-factor authentication (2FA) factor on every exchange, email, and cloud service. Replace SMS OTP with a TOTP authenticator app (such as Aegis or Raivo) or a FIDO2 hardware security key. Set a carrier-level account PIN or passcode with your mobile provider. Use a dedicated email address — not linked to social media accounts — for exchange logins. Avoid publicly announcing crypto holdings.
The One Habit That Defeats Most Attacks: Verify Before You Confirm
Every attack covered here exploits the same gap: the gap between what you see on screen and what is actually being signed, sent, or approved. The attacker's goal is always to get you to confirm something before you have verified it.
The unifying defence is a pause at every confirmation step:
- Verify the full destination address, character by character — not just the first and last few.
- Confirm the correct amount and asset before signing.
- Check that the site or app URL matches your bookmark exactly.
Hardware wallets enforce this habit by design. Transaction details appear on a tamper-resistant screen that the host computer cannot modify, and a physical button press is required to sign. This does not make hardware wallets invulnerable — but it eliminates the entire class of attacks that rely on manipulating what you see on a compromised screen.
For account security, replace SMS 2FA with TOTP or FIDO2 on every platform that supports it. For seed phrase hygiene: the phrase should never appear in a browser tab, a chat window, a screenshot, or a cloud backup — regardless of what any "support agent" requests.
Key Takeaways
- Phishing, clipboard hijackers, fake apps, and SIM swaps are the dominant attack vectors against self-custody holders — none of them require breaking cryptography.
- Address poisoning inserts lookalike addresses into your transaction history; never copy a destination from transaction history.
- Clipboard hijacker malware silently replaces copied addresses; always verify the full pasted address before confirming a send.
- Fake wallet apps circulate in official stores with zero antivirus detections; always arrive at a download link via the wallet's official website.
- SMS 2FA is a liability — replace it with TOTP or a FIDO2 hardware security key on every account that protects crypto access.
- A hardware wallet enforces verification at the point of signing and eliminates the largest category of screen-based deception attacks.
