How to spot fake crypto links before you connect a wallet
Most crypto thefts still start with a link: a lookalike wallet site, a fake browser extension, a search ad, or an "urgent security alert" that leads to a page asking for your seed phrase. Here are the patterns to look for, in the order attackers use them, and a free checker that does the comparison for you.
Check a link free →Three rules that stop most attacks
- No real wallet, exchange or support agent will ever ask for your seed phrase on a website. A page that asks for 12 or 24 words to "verify", "sync", "restore" or "validate" your wallet is a theft page.
- Type or bookmark official addresses. Don't reach wallets or exchanges through ads, DMs, emails or search results.
- Install wallet extensions only from the link on the vendor's own site, and check the publisher name in the store. Fake Phantom, Jupiter and Bitget extensions were reported again this month.
7 signs a crypto link is fake
| Sign | Example | Why it matters |
|---|---|---|
| Typosquat | metamsk.io, uniswapp.org | One letter added, dropped or swapped. Easy to miss on a phone. |
| Lookalike characters | rnetamask.io (rn for m), 1edger.com | Characters that look the same at small font sizes. |
| Punycode / homoglyphs | xn--… domains that render as a brand with Cyrillic letters | The address bar can look exactly like the real name. |
| Brand plus extra words | phantom-wallet-support.com, metamask-sync.app | The brand appears, but the registered domain belongs to someone else. |
| Free hosting subdomain | …vercel.app, …netlify.app, …pages.dev, …github.io | Anyone can create one in a minute; real wallets use their own domain. |
| Brand name on another TLD | ledger.support, coinbase.help | Sometimes owned by the brand, often not. Treat with caution. |
| Very new domain or odd redirects | Registered days ago, or a link that hops through several hosts | Phishing domains are burned quickly and rotated. |
The bait text matters too: "airdrop", "claim", "migrate", "validate", "wallet connect fix", "account suspended". Urgency is the tell.
How to check a link
- Paste it into the free Crypto Link Check. It compares the hostname with the official domains of about 60 wallets, exchanges and dapps (full list) and flags typosquats, lookalike characters, punycode, brand-plus-words domains, free hosting, missing HTTPS and bait keywords. The free check never visits the page.
- The full check (0.005 USDC per 1-10 links, x402 on Base, made for agents and bots) also looks up domain age via RDAP and DNS, follows redirects, and scans the page for seed-phrase prompts and approval-drainer code.
- Developers can run the same lexical check offline:
npx devx-link-check metamask-sync.vercel.app(exit code 2 when flagged), or add the MCP server to an agent so it checks links before it connects a wallet.
If you already connected or typed your seed
- Typed a seed phrase: treat the wallet as compromised. Make a new wallet on a clean device and move everything you can, starting with the most valuable assets. Then check the old address for a 7702 sweeper.
- Connected and signed something: revoke token approvals with a reputable approvals tool and check recent transactions for unexpected approvals or permits.
- Only visited the page: usually no loss, but close the tab, clear the download folder and don't run anything it offered.
FAQ
How can I tell if a crypto website is fake?
Compare the registered domain with the official one character by character, watch for extra words like -support or -sync, free hosting subdomains such as vercel.app or netlify.app, punycode (xn--) domains, and any request for your seed phrase. The free Crypto Link Check does this comparison against about 60 wallets, exchanges and dapps.
Will MetaMask or Phantom ever ask for my seed phrase on a website?
No. No legitimate wallet, exchange or support team asks for a seed phrase on a website, in a form, or in a chat. Any page that does is a phishing page.
What is a typosquat domain?
A domain that is one or two characters away from a real brand, for example a missing, doubled or swapped letter, registered to catch people who mistype or misread the address.
What is a punycode or homoglyph phishing domain?
A domain that uses non-Latin characters that look like Latin letters. Browsers encode it as xn--, but it can display as a familiar brand name. Crypto Link Check decodes punycode and folds lookalike characters before comparing.
What should I do if I entered my seed phrase on a phishing site?
Assume the wallet is compromised. Create a new wallet on a clean device, move remaining assets right away, revoke approvals, and check the old address for an EIP-7702 sweeper delegation.