What it looks like
You get an email, text or direct message that appears to come from a company you use: a security alert, a failed withdrawal, an account review. It links to a site that looks identical to the real one, or a "support agent" offers to help over chat. You're asked to log in, share a code, enter your seed phrase or approve a transaction. Once you do, funds leave your wallet.
Red flags
- Anyone asking for your seed phrase or private key. No legitimate company ever needs it.
- Links in messages, rather than going to the site yourself.
- Pressure to act within minutes "to protect your account".
- Support staff who contact you first, or who move the conversation to a private chat app.
- A request to approve a transaction or connect your wallet to "verify" it.
What to do next
- If you shared a seed phrase, move any remaining funds to a new wallet created on a device you trust.
- Revoke token approvals you didn't intend to give.
- Report the message to the company being impersonated.
- Save the transaction hashes and start a free assessment if you've lost crypto.