Phishing scams in Web3 have moved far beyond obvious fake giveaways or Telegram DMs promising “free 10,000 $XYZ tokens.” Today’s scams are subtle, exploiting familiar wallet habits, interface design, and off-chain permissions to trick users into signing approvals they don’t fully understand.
Whether you’re swapping on a DEX, minting, or managing funds in MetaMask, here are five critical phishing techniques I think everyone in Web3 needs to know about right now:
1. Address Poisoning
Scammers spam your transaction history with tiny transfers ($0 or negligible dust) using a vanity address that mimics yours or one you have recently interacted with—matching the first and last few characters.
The trap? They hope you’ll blindly copy and paste their address from your recent history the next time you transfer funds.
2. Malicious Signature Requests
Scammers frequently use off-chain signatures masked as a routine “Sign in” prompt. Once signed, the attacker can drain your tokens without triggering any immediate on-chain transaction or pending warning until they execute it later.
3. Impersonation & Fake Recovery Scams
Scammers actively monitor public forums and social media, posing as “Official Support” or “Crypto Recovery Experts.” They exploit panic to guide victims to malicious phishing sites or convince them to input their Secret Recovery Phrase.
4. Clone Sites & Poisoned Frontends
From fake airdrop checkers to cloned DEX frontends, malicious sites can look identical to official dApps down to the code. Some even hijack legitimate DNS records or rely on lookalike domains to trick you into connecting your wallet and granting unlimited allowances.
5. AI-Assisted Social Engineering
Scammers now use AI tools to create realistic, error-free content. They can easily pretend to be project founders, automated Discord bots, or official security alerts. Because these messages sound completely natural and personal, they are much harder to spot as spam.
The Biggest Takeaway:
A polished UI, a familiar logo, or a zero-gas “login request” does not mean a website is safe. Always inspect the raw parameters of what you are signing, limit token allowances, and use built-in wallet simulation protections before approving.
I’m curious about your experiences:
What’s the most creative or dangerous phishing tactic you’ve ever encountered?