Web3 phishing is a category of crypto scam that targets wallet permissions and signatures rather than seed phrases directly, tricking users into approving malicious smart contract access that lets an attacker drain tokens without ever seeing the victim's private keys.
How modern phishing has changed
Older crypto scams tried to get victims to type their seed phrase into a fake website. Most experienced users now know to guard that phrase closely, so attackers have shifted tactics. A weaponized site that mimics a legitimate decentralized exchange or NFT marketplace will instead prompt a wallet to sign an off-chain message, commonly built on the ERC-2612 permit standard, that grants the attacker's contract permission to move tokens later. Because the transfer happens in a separate step, sometimes hours or days later, the victim often has no idea a signature they approved was the actual point of compromise.
The danger of blind signing
Blind signing happens when a hardware wallet approves a transaction without displaying the destination address, the token amount, or the actual smart contract function being called, showing only a hash instead. That makes it effectively impossible to catch a malicious request at the point of signing, since there is nothing meaningful on the screen to check. Disabling blind signing forces the device to decode and display transaction details in full, and it should stay disabled except for the rare, verified case where a specific contract call genuinely requires it, after which it should be turned back off.
Separating wallets by purpose
Active traders reduce their exposure by splitting funds across wallets with different jobs instead of keeping everything in one place. A cold hardware wallet that never connects to a browser extension or a decentralized app holds long-term core assets and is never exposed to a malicious signature request in the first place. A separate wallet funded only with active trading capital handles day-to-day swaps on protocols that have already been verified. A third, disposable wallet with minimal funds is used for new mints, airdrop claims, and untested protocols, so that if it is compromised the loss is limited to whatever small amount was sitting in it.
Spotting the social engineering layer
Many phishing attempts start well before the malicious signature request, often through a fake customer support account in a project's Discord or a direct message claiming urgent action is needed. Treat any unsolicited message urging immediate wallet action, especially one paired with a countdown or a claim of limited time, as a red flag worth verifying through the project's official channels before clicking anything.