# Crypto Wallet Phishing: How Seed Phrases Get Stolen, What to Do

> How crypto wallet phishing works: fake wallets and exchanges, "sync" and "payout" pages, seed phrase theft. Red flags, what to do and how sites get taken down.

- Language: en
- Published: 2026-10-25 · Updated: 2026-10-25
- HTML: https://rikidomains.at/en/guides/crypto-wallet-phishing/
- Markdown: https://rikidomains.at/en/guides/crypto-wallet-phishing/index.md
- RU version: https://rikidomains.at/ru/guides/fishing-kriptokoshelkov/

The most common scheme in our practice. From May to October 2026 our [takedown service](https://rikidomains.at/en/guides/phishing-site-takedown-service/) handled 827 domains phishing for crypto services, and there are [statistics](https://rikidomains.at/en/guides/how-long-scam-domains-survive/) on them. This is not theory: below are the pages we were closing, the signs that give them away and what to do if a seed phrase has already been entered.

## What the scheme looks like

The goal is always the same: obtain a seed phrase, a private key or a transaction signature. The packaging varies.

- **A fake wallet or exchange.** A copy of a popular wallet's or exchange's site with a login or "import wallet" form. The difference is the address: the brand name plus a word (wallet, app, login, support, sync), a hyphen, another domain zone.
- **"Sync", "validation", "unlock" and "migration" pages.** The story: the wallet has an error, a transaction is stuck, an update is needed, so "confirm your wallet", that is, enter the 12 or 24 words. No wallet has any such procedure.
- **"Payout", "airdrop" and "compensation" pages.** "Tokens have been credited to you, connect your wallet to claim them." After connecting you are asked to sign a transaction, and that transaction drains the assets.
- **Fake support.** A chat, a bot or a "specialist" who shows up after a complaint on social media or a comment under a post and asks for the phrase, remote access or a transfer to a "safe address".

Traffic comes from everywhere: ads above search results for the wallet's name, emails about "suspicious activity", direct messages in messengers, comments under posts, fake browser extensions and apps. One group runs dozens of domains for one brand, and after a suspension the storefront moves to the next one.

## How the money is taken

1. **Seed phrase or private key.** The words entered give full control of the wallet. The page's script passes them on at once, the funds leave within minutes, and sometimes a bot waits for new deposits.
2. **Signing a "safe" transaction.** The "connect wallet" button opens your real wallet with a request for a signature or a token approval. Nothing needs to be typed: one confirmation, and a drainer contract withdraws everything it was approved for.
3. **Logging in to an "exchange".** The login, password and app code pass through a proxy page and are used on the real exchange the same minute.
4. **"Support".** Remote access to the computer, or "move the funds to a temporary address while we fix it".
5. **The second wave.** Victims are contacted by "recovery services" that promise to return the stolen funds for an upfront fee.

## Red flags you can see before typing anything

- You are asked for a seed phrase or a private key. A genuine wallet needs them only inside the app during recovery, never on a website, in a chat or in an email.
- The address has an extra word, a hyphen or another zone. The domain was registered recently: the date is visible in an [RDAP lookup](https://rikidomains.at/en/glossary/whois-rdap/), a brand with years of history is never two weeks old.
- You arrived through an ad above the search results or a link from a direct message, not from a bookmark.
- The words "sync", "validate", "unlock", "migration", "confirm your wallet".
- Urgency and threats: "the wallet will be frozen in 24 hours", "the transaction will be cancelled".
- A signature request whose meaning is unclear, or a token approval with an unlimited amount.
- Payouts, airdrops and compensations that require you to "connect your wallet" or pay a "withdrawal fee".

## What to do if the seed phrase has already been entered

1. Consider the wallet lost. Create a new one with a new phrase and move everything there immediately, starting with the most valuable assets. Never use the old phrase again.
2. If you signed a transaction or an approval: revoke token approvals through a blockchain explorer or a revocation service, then transfer. Otherwise the drainer will also take whatever arrives later.
3. If you entered exchange credentials: change the password and the two-factor code, end all sessions, write to the exchange's support asking to freeze withdrawals.
4. Keep everything: the site address, screenshots of the pages, recipient addresses, transaction hashes, the correspondence with "support".
5. A police report and, in the US, a report to IC3. Transaction hashes and addresses help exchanges flag and freeze the funds if they get there.
6. Report the domain to the registrar and the hosting provider, and submit it to browser and wallet blocklists. It will not return the money, but it closes the trap for the next people. How such complaints are filed and what speeds up a suspension is described on the [service page](https://rikidomains.at/en/guides/phishing-site-takedown-service/).
7. Do not answer "recovery services". Blockchain funds do not come back on request, and the upfront fee goes to the same people.

## How these sites get closed

Our data for May to October 2026 on 827 domains of this scheme: 49% reached suspension, a median of 9 days from the first complaint to suspension, and one domain in ten held out for more than 43 days. A closed domain took 44 submissions on average, and more than half needed over 40. The zone decides the speed: cheap .pro, .ink, .sbs and .gr.com close in 1.5–4 days, .com in 7.4 days with a 52% share, .io and .co hold for about a month. Some domains collected 300–600 complaints and lived for months, so volume alone guarantees nothing.

What speeds things up: a screenshot of the form asking for the seed phrase is a direct breach of any registrar's and host's rules; a match between the design and name and the real brand; transaction hashes to addresses already flagged as fraudulent. Because the storefronts are cloned, we separately watch for similar domains through [Certificate Transparency](https://rikidomains.at/en/glossary/certificate-transparency/) and file complaints about new addresses before they collect victims.

Another scheme from the same practice, with a different way of extracting money: [fake online car dealers](https://rikidomains.at/en/guides/fake-online-car-dealers/).

> [Open the bot](https://t.me/riki_domains_bot?start=g24)

## In short

Crypto wallet phishing sells not a service but a form for your seed phrase or a "sign" button. A request to enter the phrase, an address with an extra word, arriving through an ad or a direct message, and the words "sync" and "validation" are four signs after which the tab gets closed. If the phrase has already been entered, the clock runs in minutes: a new wallet and a transfer, revoking approvals, a report, a complaint about the domain.

## FAQ

**Can a genuine wallet ask for my seed phrase on a website?**

No. A seed phrase is needed only inside the wallet app itself when you restore access. Any website, chat, bot or "support agent" that asks you to type it in or send it is theft, whatever the reason given.

**I entered my seed phrase but the funds are still there. What should I do?**

Treat the wallet as compromised and move everything to a new wallet with a new phrase immediately, starting with the most valuable assets. The script on a phishing page usually drains funds within minutes, but sometimes it waits for new deposits, so "still there" means nothing.

**Can stolen cryptocurrency be recovered?**

Not directly: transactions are irreversible. There is a chance if the funds reach an exchange: transaction hashes and a police report help freeze the receiving addresses. "Recovery services" that ask for an upfront fee are the second wave of the same scam.

**How fast are wallet phishing sites taken down?**

In our 2026 statistics, 49% of 827 domains used in this scheme reached suspension, with a median of 9 days from the first complaint and an average of 44 submissions per domain. In cheap zones it takes 2–4 days, in .com 7.4 days, in .io about a month.