Definition
Pronunciation: /haks/ Hacks are user-facing incidents where crypto assets are lost due to unauthorized access, malicious software, or tricking users into signing/approving transactions that enable theft. While the term “hack” traditionally implies technical exploitation, most crypto “hacks” against individual users involve sophisticated social engineering combined with wallet transaction manipulation.What It Covers
This category includes attacks that:- Compromise wallets through phishing or malicious approvals
- Install malware or fake applications to steal credentials
- Manipulate users into granting unauthorized permissions
- Exploit trust to gain access to accounts or private keys
- Use technical tricks to intercept or redirect transactions
What It Does NOT Cover
- Investment scams where users willingly send funds (see Frauds)
- Threat-based extortion demanding payment (see Blackmail)
- Privacy surveillance without immediate asset loss (see Privacy & Tracking)
Why It Matters
Hacks represent the largest category of individual crypto losses by volume. Unlike traditional financial systems with chargebacks or fraud protection, blockchain transactions are irreversible. Once a hacker gains control of your wallet or approvals, your funds are gone permanently. According to industry research:- Wallet drainer campaigns have stolen $59M+ from individual users in single operations
- Phishing attacks are the #1 attack vector against crypto users
- Over 10,000+ victims have fallen for drainer scams in major campaigns
Subcategories & Scam Types
Phishing & Typosquatting
Description: Attacks that use fake websites, emails, or domains to trick users into entering credentials or connecting wallets to malicious contracts. Common scam types:- Typosquatting domains - Look-alike URLs with tiny spelling differences (e.g.,
arnrnatina.comvsammatina.com) - Email/message phishing - Fake support emails, grant notifications, or airdrop claims
- QR code replacement - Swapping legitimate payment QRs with attacker addresses
- Fake login pages - Cloned exchange or wallet sites designed to steal credentials
Grant Phishing: Lisa's Story
How a typosquatted domain and wallet drainer led to $180,000 loss
Typosquatting Deep-Dive
Understanding domain mimicry and how to protect yourself
Wallet Drainers & Malicious Contracts
Description: Smart contracts or scripts designed to drain all tokens from a wallet after the user approves a seemingly legitimate transaction. Common scam types:- Unlimited token approvals - Contracts requesting
setApprovalForAllor unlimited spending rights - “Sign to verify” traps - Malicious signature requests disguised as ownership verification
- NFT mint drainers - Fake NFT minting sites that drain wallets during the “mint” process
- Fake DEX/router approvals - Counterfeit DeFi platforms requesting dangerous permissions
NFT Mint Drainer Attack
How fake NFT projects use Discord and malicious mint contracts
Malware & Fake Applications
Description: Software that infects devices to steal wallet credentials, modify clipboard contents, or monitor user activity. Common scam types:- Fake wallet apps/extensions - Counterfeit versions of MetaMask, Phantom, or other wallets on app stores
- Clipboard hijackers - Malware that replaces copied wallet addresses with attacker addresses
- Keyloggers & screen capture - Programs that record keystrokes or screenshots to steal seed phrases
- Remote access trojans - Software granting attackers full device control
Account Takeover
Description: Attacks that compromise Web2 accounts (email, phone, exchange accounts) to gain access to crypto holdings. Common scam types:- SIM swap attacks - Hijacking phone numbers to bypass 2FA and reset exchange passwords
- Email compromise - Hacking email accounts to reset passwords or authorize withdrawals
- Fake 2FA reset support - Social engineering to convince support teams to disable 2FA
- Session hijacking - Stealing active login sessions through browser exploits
User Safety Basics
Before Connecting Your Wallet
Before Connecting Your Wallet
- Bookmark official sites and only access them from bookmarks, never email links
- Verify URLs character-by-character - look for extra letters, swapped characters, or wrong TLDs
- Use separate wallets - Keep a “hot wallet” with small amounts for testing new sites; store bulk funds in cold storage
- Check contract addresses on blockchain explorers - verify age, verification status, and other interactions
During Wallet Interactions
During Wallet Interactions
- Read every approval carefully - Never approve “unlimited” spending unless you know exactly why
- Enable transaction simulation - Use wallets like Rabby or Fire that show what a transaction will do
- Question urgency - Legitimate projects rarely demand immediate action with countdown timers
- Verify through multiple channels - If you receive a notification, log into the official platform independently
After Suspicious Activity
After Suspicious Activity
- Revoke approvals immediately - Use tools like Revoke.cash or Etherscan’s token approval checker
- Move remaining funds to a fresh wallet with a new seed phrase
- Report the address to ChainAbuse and your wallet provider
- Document everything - Save URLs, transaction hashes, emails, and screenshots
Relatable Examples
The Grant Applicant: Lisa applied to Web3 grants for her business. She received an email claiming approval and clicked to “verify her wallet.” The URL looked right at a glance:arnrnatina-funds.cominstead ofammatina-funds.com. She approved what she thought was a verification, but it was unlimited token approval. Within minutes, $180,000 was gone. Read Lisa’s full story →
The NFT Collector: A Discord server claimed to be launching an exclusive NFT project. The mint link was shared by accounts that looked official. During the “mint,” the site requested approval. The collector lost all NFTs and tokens from their wallet—the contract was a drainer. Read the NFT drainer case →
Recommended Controls
For Individuals
- Hardware wallets (Ledger, Trezor) for holdings over $1,000
- Multi-sig wallets for business or team funds
- Browser extensions with phishing detection (MetaMask Snaps, Wallet Guard)
- Regular approval audits - Revoke old/unused permissions quarterly
For Teams & Organizations
- Security training on phishing and approval risks
- Transaction approval processes requiring multiple reviews for large amounts
- Whitelist-only wallet connections - Pre-approve trusted dApp domains
- Incident response plan with clear steps for compromise scenarios
Real-World Statistics
What To Do If You’ve Been Hacked
1
Stop Using the Compromised Wallet
Do NOT send more transactions from the affected wallet - the attacker may be monitoring it.
2
Revoke All Approvals
Use Revoke.cash, Etherscan, or your wallet’s approval manager to revoke permissions immediately. Start with high-value tokens (USDC, USDT, WETH).
3
Move Remaining Assets
Transfer any remaining funds to a brand new wallet with a fresh seed phrase. Never reuse the compromised wallet.
4
Report the Attack
- Report to ChainAbuse: Flag the attacker’s address
- Report to your wallet provider: Help prevent others from falling victim
- Report to law enforcement: FBI IC3 (ic3.gov) for US victims
- Check your wallet: Have I Been Drained?
5
Preserve Evidence
Screenshot everything: URLs, transaction hashes, emails, messages. This helps investigations and warns others.
6
Share Your Story
Consider sharing anonymously to help educate others. Your experience can prevent future victims.
Related Resources
Report a Drainer
Add malicious addresses to the on-chain registry
Check Your Wallet
Verify if your wallet has been compromised
Frauds Category
Learn about investment scams and romance frauds
Privacy & Tracking
Understand dusting attacks and surveillance