Anti-phishing guide for crypto users: email, fake sites, wallet drainers, and social scams
How phishing attacks work in practice on Binance and BNB Chain — fake Binance emails, counterfeit DEX frontends, Permit signature drainers, and social media scams — with specific defenses for each attack type.
How phishing attacks work in practice — fake Binance emails, counterfeit PancakeSwap frontends, Permit signature drainers, Discord fake support — and the specific defenses that work against each type.
Phishing is the most common way crypto users lose access to exchange accounts and on-chain wallets. Unlike hacks that exploit protocol vulnerabilities, phishing targets you directly — it works by tricking you into providing credentials, signing a malicious transaction, or granting a dangerous contract approval. Understanding how phishing actually works on platforms like Binance and on BSC makes the defenses obvious and easy to apply.
Email phishing: how fake Binance emails work
Phishing emails impersonating Binance are the most common attack vector for exchange users. The format is consistent: an email with Binance's visual design, logo, and typical formatting claims there is a problem with your account — unauthorized login, suspended withdrawal, suspicious activity, or a new security feature requiring your action. A prominent button links to a site that looks exactly like Binance but captures your email, password, and 2FA code the moment you enter them.
The most important defense is Binance's anti-phishing code, available under Account → Security → Anti-Phishing Code. Once enabled, every legitimate email from Binance includes your chosen code in a visible position. A phishing email cannot include this code because the attacker does not know what it is. If you receive an email claiming to be from Binance without your code visible, or with the wrong code, it is a phishing attempt regardless of how legitimate it looks.
Secondary verification: check the sender domain. Binance's legitimate emails come from @binance.com. Attackers spoof addresses that look similar: @binance-secure.com, @binance.support.com, or use display names that say "Binance Security" while the actual sending domain is something unrelated. Most email clients show the full sender address when you click on the display name.
Website phishing: recognizing fake exchanges and DEX frontends
Website phishing attacks replicate the frontend of legitimate platforms — Binance, PancakeSwap, MetaMask, and other high-traffic crypto sites. The goal is either to capture login credentials or to present wallet connection requests that grant malicious approvals or trigger drainer transactions.
How users reach fake sites: Google Search ads, links in Telegram groups, promoted tweets, and Discord messages from compromised accounts are the four main channels. The ad channel is particularly effective because Google results rank by bid, not authenticity — a fake PancakeSwap site can appear above the real one in paid results.
Domain inspection is your first defense. The real Binance is at binance.com — no subdomain, no TLD variation, no added words. Legitimate base URLs: pancakeswap.finance, metamask.io, bscscan.com, venus.io. Phishing variations use homoglyph characters (replacing an "l" with a "1" or "I"), adjacent TLDs (.net, .io, .app instead of the real one), or added words (pancakeswap-app.io, metamask-wallet.com). The only reliable way to ensure you are on the right site is to access it via a bookmark you created by navigating directly to the verified URL.
Once you are on a phishing site, your wallet shows a connection request that looks identical to a legitimate one. The attack begins after connection, when the site prompts you to approve a transaction. Read what your wallet shows before confirming anything. A swap should show specific token amounts in and out. A "verify wallet" prompt or a request to "approve unlimited [token]" to an unrecognized address should be rejected immediately.
Wallet drainer attacks and the Permit signature
A wallet drainer is a contract or off-chain service designed to transfer tokens from wallets that interact with it. The most common mechanism is a standard ERC-20 approval: you sign a transaction approving the drainer contract to spend unlimited amounts of a specific token, and it immediately or later transfers your full balance.
A more sophisticated variant uses the Permit function (EIP-2612), supported by tokens like USDT, USDC, and many DeFi tokens on BSC. A Permit signature authorizes a token transfer without an on-chain approval transaction — the victim signs a message in their wallet, which looks like a simple "sign in" or "verify" request with no visible gas cost, and the attacker submits that signature on-chain to execute the transfer. MetaMask and other wallets now display warnings for Permit signatures, but the warning is easy to miss if you are in a hurry.
The defense: be skeptical of any "Sign" or "Sign Message" prompt when you expect to be doing a trade or a claim. Legitimate DEX swaps generate specific transaction data showing exact input and output amounts. If the message body contains hex data or a domain name you do not recognize, reject the request.
Social media and direct message phishing
Discord and Telegram phishing follows a consistent pattern. A user posts a question about a protocol, a wallet problem, or an airdrop. Within minutes, they receive private messages from accounts posing as official support staff, community moderators, or the project team. The conversation escalates toward one of three outcomes: the user is asked for their seed phrase to "restore the wallet," directed to a fake recovery tool that captures wallet data, or instructed to sign a transaction on a fake site.
No legitimate support team, protocol, or exchange will initiate a private message about a public question. No legitimate team will ever ask for your seed phrase or private key — not in a support ticket, not to verify your account, not to process a refund. A request for seed phrase access is always an attack, regardless of how official the account appears.
Verified accounts on X/Twitter are not reliable signals of legitimacy. Verified official accounts are frequently compromised or impersonated. A promoted tweet from a verified-looking account linking to a bonus airdrop site is not evidence that the site or the airdrop is real.
Protecting browser extensions and wallet installations
Browser extension attacks have become a significant vector. A malicious extension installed in your browser can intercept wallet signing requests, modify transaction destinations before they are submitted, or read your clipboard (where copied wallet addresses live). The attack is either a fake wallet extension (a counterfeit MetaMask published in the Chrome Web Store) or a legitimate extension that was later compromised by a malicious update.
Install wallet extensions only from the official site's linked extension page: MetaMask from metamask.io, Trust Wallet from trustwallet.com. Never install from a link received in a message. Review your installed extensions periodically and remove any you no longer use. Extensions with broad permissions to "read and change all website data" deserve particular scrutiny.
Practical setup to reduce phishing exposure
Enable Binance's anti-phishing code immediately and choose a string you will recognize at a glance. Bookmark binance.com, pancakeswap.finance, bscscan.com, and any other platform you use regularly, and access them only through those bookmarks. Keep a dedicated browser profile or device for crypto, with no extensions except your wallet. Configure your wallet to display full transaction details and read them before signing — this takes 10 seconds and catches most drainer attacks.
Review active token approvals on revoke.cash every few months to identify and remove approvals from old interactions. An approval granted months ago to a contract that was later compromised remains active until you revoke it explicitly. This periodic review is the complement to careful signing: it handles the cases where you may have approved something without fully understanding its scope.
If you receive an alarming email about your Binance account, do not click any link in the email. Navigate to binance.com directly via your bookmark and check your account status there. The email may be phishing; your account status on the real site is the truth.