One Click and Your Money Is Gone: How to Protect Crypto Assets from Phishing, Drainers ...

Non-custodial wallets give users full control over their assets, but with that comes full responsibility for security. Attackers take advantage of this, and instead of looking for vulnerabilities in code, they are increasingly trying to access funds through the owner. A phishing link, a malicious permission, or a convincing scam story can be enough.

On an Incrypted livestream security in the crypto industry, law enforcement representatives, cybersecurity and blockchain analytics specialists, and a hardware wallet expert broke down the main risks for holders. We looked at how attack patterns are changing, what role artificial intelligence plays in them, and what on-chain trail stolen funds leave behind.

The Incrypted editorial team compiled the key takeaways and practical conclusions from this discussion.

The main vulnerability — the user

In many schemes, attackers do not need to hack the blockchain, an exchange, or the wallet itself. It is much easier to target the asset owner and convince them to perform the required action themselves. This is exactly what social engineering is built on, as well as a large of attacks using crypto drainers.

In practice, the first often looks harmless — an ad for “quick money,” a message from someone you know, or a link to a service that seems familiar.

Yevhen Panchenko, First Deputy Head of the Department of International Police Cooperation of the National Police of Ukraine, highlighted FOMO, trust in a single source of information, and the desire to make money “here and now” as key risk factors. In this state, a user can easily become fixated on one project, channel, or person and stop double-checking the information they receive.

You shouldn’t rely on the first video you find online — it may be wrong. You need to study different approaches and read different sources.

At the stage, the wallet owner is already required to take a specific action.

Oleksandr Plakhotniuk, head of the Cyberpolice Department’s unit for combating crimes related to virtual assets, noted that crypto drainers do not break blockchain cryptography. Their goal is to make the wallet owner sign a transaction, grant permission, or transfer funds.

Bait is distributed via:

hacked accounts on X (formerly Twitter), Discord, TikTok, Instagram, and other social networks

paid ads that lead to clone sites

fake airdrops, NFTs, “compensation,” and other giveaways

Telegram channels and investment communities, where the victim is gradually steered toward transferring a large amount.

One common scheme is Pig Butchering. First, the victim is offered to deposit a small amount and is shown supposedly successful results to build trust. Then the person is led to a much larger transfer — for example, they are promised insider info or tens of percent in returns on a single trade.

Artificial intelligence has made it easier to scale such attacks. According to Dmytro Budorin, CEO of Hacken Group, AI tools help create phishing sites faster, produce deepfakes, and personalize messages. Data from or GitHub is also used — for example, in fake job offers or investment pitches.

AI tools help hackers streamline and speed up their work. Now even someone without deep technical knowledge can steal funds using these models

New tools are changing the shape of the attack, but not its goal — the victim still has to be persuaded to click a link, open a file, connect a wallet, or approve an action. A phishing site by itself does not withdraw money. The attacker needs permissions to the assets, and often the owner hands them over themselves by approving an unverified request.

One confirmation — and your assets can disappear

A wallet signature is not just a technical formality. Depending on the request, a user may grant a third-party address or smart contract permission to operate the assets, and this is exactly what crypto drainers are built on.

According to Alexander Plakhotnyuk, attackers can use several types of permissions — for example, Increase Allowance, Set Approval for All, or transaction execution delegation. In a wallet interface, such a request may look like yet another routine technical confirmation, especially if the user is in a hurry or already confident they are on a legitimate site.

You can sign an approval even with an empty wallet. If it remains valid, an attacker can wait until enough funds appear at the address, and only then initiate the withdrawal of assets.

With off-chain signatures , the situation is more complicated. They do not require paying a fee and do not immediately appear on the blockchain like regular transactions. After a theft, a user may decide that someone got their seed phrase or hacked their wallet, even though the cause was an approval signed earlier.

The schemes themselves are also getting more complex. Among the variants Plakhotnyuk broke down:

proxy smart contracts that hide the real logic of the operation

approvals to change individual transaction parameters

malicious multisig scenarios

the Address Poisoning attack — swapping the address for a lookalike string of characters.

The last scheme does not even require a sophisticated phishing interface. The attacker generates an address whose first and last characters match those of an address familiar to the user, and sends a small transaction from it. If the person later copies details from their transaction history, they may accidentally pick the already substituted details.

A similar mechanic is also used on clone sites. During the stream, Plakhotnyuk analyzed a phishing copy of Hyperliquid with a domain that mimicked the original site’s address. The user went there for a routine token swap, connected their wallet, and received a request to approve access to their assets.

Once such a script is already running, it may be too late to react. In one of the examples reviewed, transactions were executed automatically one after another — almost immediately after confirmation.

Losses are usually very large because transactions happen instantly, in one click. Even experienced crypto users lose large amounts

– Alexander Plakhotnyuk

That said, the site address and the interface’s look and feel are only part of the check. Before signing, it’s important to understand exactly what the wallet is requesting and what permissions the smart contract will receive.

Can stolen funds be traced?

Stolen assets can pass through several addresses in a matter of seconds. In that time, the victim needs to notice the theft, understand what happened, and seek help, while law enforcement needs to the services or exchanges the funds are moving through.

Vadym Burlakov, Business Growth Partner at Crystal Intelligence, pointed to this exact difference in pace — assets move almost instantly, while the response can take days or weeks.

However, speed does not make transactions invisible. Each such operation is recorded on a public ledger, so analytical tools make it possible to trace links between addresses, intermediary wallets, and exchanges.

Among the Ukrainian cases Burlakov cited were social engineering schemes, fake investment platforms, and sites masquerading as AML services. In one case, a user was offered to “check the cleanliness” of a wallet, after which they were asked to connect it and sign a transaction that could turn out to be a drainer contract.

The blockchain is not a black box, but a public trail that can be read

That said, tracing funds and getting them back are not the same thing. The faster an attacker moves assets through new addresses, services, or exchanges, the less time there is to respond.

If a suspicious approval has already been signed or funds have started to move out, Plakhotnyuk advises acting step by step:

revoke the granted approvals

move the remaining assets to a new wallet you control

save addresses, transaction hashes, domains, and other evidence

if the funds ended up on an exchange — report the incident to it

the cyber police

After a theft, a follow-up attack is also possible — a recovery scam. The user is offered paid “help” to recover assets, but such an offer may be yet another fraudulent scheme.

Right after an incident, it is important to secure any remaining assets, preserve evidence, and avoid sharing new data with anyone promising a quick recovery. Even successful transaction tracing does not protect you from being compromised again.

Self-custody does not guarantee security

User error is not the only source of risk. The problem can also arise at the device level or in its software.

On the stream, LOGIC founder Dmitry Karachentsov broke down the Cold Card case. According to him, the vulnerability remained in the firmware for more than five years and was linked to insufficient randomness when generating seed phrases. This allowed attackers to brute-force previously created combinations and gain access to users’ funds.

Karachentsov said owners of older MK3 models were hit harder, while additional protection mechanisms helped preserve the funds of some users. These included:

using a custom passphrase

adding extra entropy when generating the seed phrase

importing a seed phrase created independently of the device

In this case, it is no longer the user making a mistake — the vulnerability arose at the device level.

Use an additional passphrase. Even if the manufacturer makes a mistake when generating the seed phrase, you will have time to move to a new wallet

– Dmitry Karachentsov

Karachentsov recommends storing your hardware wallet, seed phrase, and an additional passphrase separately. You should not keep backups in cloud services or as photos.

For trading, day-to-day operations, and long-term storage, Karachentsov advises using different tools. Exchanges, he says, are primarily for trading, hot wallets are for operational funds, and long-term positions are best kept separately.

In addition, you should organize asset storage so that compromising one element does not grant access to all funds. To do this, it is better to separate the device, backup data, and day-to-day operations.

The speakers’ recommendations for reducing the risk of theft and hacking can be summarized in a short checklist:

separate your main wallet from the addresses you use for airdrops, new protocols, and other experiments;

do not access financial services via links from ads, direct messages, or unknown channels;

before confirming a transaction, check exactly what the app is requesting and what permissions you are granting;

do not copy the recipient address from your transaction history;

periodically review granted permissions and revoke those you no longer need;

do not store your seed phrase in the cloud, in photos, or in messengers;

for large amounts, use separate storage and additional layers of protection, including a passphrase;

after a suspicious transaction, isolate the remaining funds as quickly as possible, and save data on transactions, addresses, and domains;

do not trust unknown services that promise to recover stolen cryptocurrency for a fee.

These are just some of the topics discussed during the stream. The full recording includes more real-world cases, a breakdown of how crypto drainers work, tracking stolen funds, and the security of self-custody. Watch the full episode here on Incrypted’s YouTube channel.