TL;DR
Phishing stole $410M across 132 H1 2025 incidents — and that is only the attributed slice. One E-ZPass smishing kit sent 330,000 texts in a single day for under $500 of infra, and reached 1M+ victims across 121 countries. Approval phishing — tricking you into “approving” a drain — is now a tracked, automated typology. The site will look perfect. The domain is the lie.
| PLAY | HOW IT LOOKS | KILL SWITCH |
|---|---|---|
| Fake site / lookalike domain | Clone of Uniswap / wallet / exchange. 1-letter swap. | Type the domain. Never click from ads/DMs. |
| Fake support | “Support” DMs you first. Asks for seed or “sync wallet.” | Support never DMs first. Never sync a seed. |
| Fake airdrop / claim | “Claim $X” drains on sign. Urgency + countdown. | Claim only via official app link. Simulate first. |
| Clipboard hijacker | Malware swaps copied address to attacker. | Paste-check first/last 6 chars. Every time. |
| ENS / Unicode squat | Looks right, renders wrong. Homoglyph attack. | Verify raw hex address, not display name. |
| Approval phishing | “Approve” popup hides unlimited spend. | Limited approvals. Revoke after use. |
| Smishing (E-ZPass etc.) | “Toll due” text → kit harvests cards/wallet. | Ignore. Open official app yourself. |
Phishing-as-a-service industrialized the crime. Kits are tiered like software products: “full development” for ~$50 in crypto, proxies for ~$30, updates for ~$20. Lighthouse took 7,000+ deposits. That is why Chainalysis notes phishing-kit scams are 688x more effective in dollar terms than regular scams — the kit, not the person, is the product.
Approval phishing deserves its own mental model. The victim sees an innocuous “approve to trade” prompt. Hidden inside is an unlimited token approval to a drainer contract. The drain is instant and, unlike a bad swap, often complete. Operation Spincaster and its successors froze $162M+ by catching the pattern early — but only because someone reported and traced the reused wallet. Treat every “approve” as a spending permission, not a formality.
The clipboard attack is the quietest and cruelest: malware waits for you to copy a wallet address, then swaps it so the first and last characters still look plausible. Skilled traders paste-check by habit. New users do not. Make it muscle memory: copy → paste → verify first 6 + last 6 → send. No exceptions, even for “trusted” counterparties — the swap is on your device, not on them.
Criminals reuse the same wallets, approvals, and cash-out routes across victims — which means each report exposes a wider network.
CHAINALYSIS · APPROVAL PHISHING
THE 3 RULES THAT BLOCK 90% OF PHISHING
1. Navigate yourself — type domains, open apps directly. 2. Verify the raw address — names lie. 3. Limit approvals — set caps, revoke after. If a site pushes “sync seed to validate,” you are already being scammed.
DEFENSE CHECKLIST — MODULE 03
[01] Bookmark the 5 sites you use weekly. Never navigate via search ads, DMs, or Telegram “support.”
[02] Before sending: paste-check first 6 + last 6 chars. Verify on explorer, not in chat.
[03] Default to limited approvals. Revoke unlimited ones monthly (Module 09 tools).
[04] Simulate any “claim” or “mint” before signing. If simulation shows drain, stop.
[05] Report drainer addresses to the terminal/tools — reuse means your report protects others.
SCHOOL INDEX
← PREVIOUS · MODULE 02
Keys Are Everything
Private keys, seed phrases, hot vs cold, hardware wallets, multisig, and session keys — the one concept that explains 80% of crypto losses.
NEXT · MODULE 04 →
AI × Crypto: New Attack Surface
Prompt injection, agent wallets, x402 payments, vibe-coded malware, and deepfakes — the layer that just made scams 4.5x more profitable.
PNTHR SCHOOL · FREE + OPEN · SOURCES: FBI IC3 2025 · CHAINALYSIS 2026 · TRM LABS · CERTIK · IMMUNEFI · TUTELA · EDUCATION ONLY · NOT FINANCIAL ADVICE · NOT LEGAL ADVICE