How to protect your crypto wallet from hackers: five ways in, five fixes

Most wallet thefts leave the cryptography intact. Hackers get you to send funds to the wrong address, sign the wrong message, type your seed into the wrong box, or use a wallet that made a weak key. If you want to protect your crypto wallet from hackers, close those five doors. Each one below comes with a case and a fix.

Address poisoning

The attacker creates an address whose first and last characters match one you use, then sends you a tiny transfer so it sits in your history. Next time you copy an address from that history, you copy theirs. Carnegie Mellon researchers measured this on Ethereum and BNB Chain from July 2022 to June 2024: more than 270 million attempts against more than 17 million victims, and 6,633 successful thefts worth at least $83.8 million.

“the primary representation used for wallet addresses is a hardly memorable 40-digit hexadecimal string”

— Taro Tsuchiya and co-authors, Carnegie Mellon University, "Blockchain Address Poisoning", 2025 · arxiv.org

Fix: send only to addresses from your saved address book, check the whole address before a large transfer, and send a small test first.

Approvals you forgot

A drainer site asks you to sign a permit or approval, and the signature lets a contract move your tokens later, with no further click from you. Fix: before you sign, read which token and which amount the wallet shows. Once a month, open revoke.cash or your wallet's approvals screen and cancel what you no longer use.

Fake support asking for the seed

From 13 August to 10 September, breaches at suppliers exposed about 81,000 customer records of Trezor users, and fake security emails then reached Trezor and BitBox customers. The devices were untouched. The mailing lists gave the phishers their targets. Fix: no wallet maker asks for your 24 words, by email, phone or chat.

Spyware on your phone

A Ukrainian user says more than $68,000 in USDT left his Trust Wallet on 15 October, and he blames iPhone spyware on an outdated iOS. Apple had patched that exploit chain 205 days earlier. Fix: install system updates the week they arrive and keep the seed phrase off the phone entirely, including screenshots and notes.

A seed made by a weak generator

Qubic's web wallet built seeds with JavaScript's Math.random. An attacker drained 1,404 wallets in 104 minutes. Fix: create the seed on a hardware wallet or in a widely audited wallet app, never on a website that generates keys.

Our count

• One successful address poisoning per about 40,700 attempts. The attackers still profit because each success brought about $12,600 on average.
• 6,633 thefts against 17 million targeted people is about 0.04%. The attackers count on the rare day you are in a hurry.
• At Qubic the attacker emptied a wallet every 4.4 seconds. A weak seed gives no time to react.

Pick the door that fits your habits: if you copy addresses from history, start with the address book; if you click links in email, start with the rule about the 24 words.

This guide is general information and does not replace an audit of your own setup. Address poisoning figures come from the Carnegie Mellon study; the cases come from our earlier reporting.