Analysis of reported losses shows a consistent distribution across a handful of methods, which makes defence a matter of addressing known patterns.
Phishing sites
Replica interfaces that request a signature granting access.
Which reach users through search advertising, social media and compromised accounts.
Bookmarking legitimate sites and never navigating from a link addresses most of this.
Malicious signature requests
Signing a message that grants token spending permission or authorises a sale.
Which appears harmless because no transaction is submitted and no fee is charged.
This is now among the largest loss categories and is entirely preventable by reading what is being signed.
Approval abuse
Standing permissions granted to a contract that is later compromised.
Which affects users who interacted with a protocol months earlier.
Periodic approval review and revocation is the defence and takes minutes.
Seed phrase compromise
Phrases entered into fraudulent sites, stored in cloud services, or photographed.
Which is unrecoverable once it occurs.
No legitimate service ever requires a recovery phrase, without exception.
Number porting attacks
Taking over a phone number to intercept authentication codes.
Which defeats message-based second factors on custodial accounts.
Hardware security keys or authenticator applications remove this exposure.
Address poisoning
Sending transactions from addresses that visually resemble ones you have used, hoping you copy from history.
Which exploits the practice of copying from recent transactions.
Verifying the full address and using saved address books defeats it.
Malicious browser extensions
Extensions with permission to modify pages can alter displayed addresses.
Which is why hardware wallet screen verification matters.
Minimising installed extensions and using a dedicated browser profile reduces exposure.
The realistic defence
A hardware wallet, address verification on device, reading signature requests, periodic approval revocation and a separate wallet for unfamiliar interactions.
None of it is technically demanding, and consistency is what makes it effective.
Social engineering through support channels
Attackers posing as support staff in community channels.
Which is why legitimate projects state that support never messages first.
Automated bots monitor for help requests and respond within seconds.
Fake applications
Malicious wallet applications in app stores and search results.
Which have appeared repeatedly despite store review processes.
Downloading from links published on official project sites is the defence.
Clipboard hijacking
Malware replacing copied addresses.
Which is defeated by verifying the address after pasting and on the hardware device.
This attack has existed for years and continues to work.
Recovery after compromise
Moving remaining assets to a new wallet generated on a clean device.
Which must happen quickly, since attackers frequently monitor for incoming funds.
A compromised phrase means every address derived from it is compromised permanently.
Reporting
Reporting to law enforcement and to analytics firms supports tracing and helps other users.
Airdrop and claim scams
Sites offering token claims that request signatures or approvals.
Which spike around genuine distribution events when users expect to claim something.
Verifying the claim site from official project channels is the defence.
Compromised project accounts
Official social media accounts taken over and used to post malicious links.
Which has affected major projects repeatedly.
A link from a verified account is not verification, which is counterintuitive and important.
Supply chain compromise
Malicious code introduced through dependencies or through compromised front ends.
Which affects users of legitimate applications.
Content integrity checks and self-hosted interfaces mitigate this partially.
Insider threats at projects
Team members with privileged access.
Which is addressed through the same separation of duties used elsewhere.
The distribution of losses
Published analyses consistently show phishing and approval abuse dominating, well ahead of technical exploitation of user devices.
Building a routine
Bookmark legitimate sites, read every signature request, revoke approvals quarterly, keep valuable holdings in a wallet that never interacts with unfamiliar contracts.
Which addresses the large majority of documented losses.
None of it is difficult and all of it requires doing consistently.
Teaching others
Most losses happen to people who did not know the patterns rather than to people who ignored them.
Which makes explaining the signature-request problem to someone new the single most useful thing an experienced user can do.
The attack surface is small and well documented, and the information simply does not reach people before they need it.
Institutional parallels
Organisations face the same attack patterns with more at stake and more controls available.
Which is why separation of duties, approval workflows and allowlisted destinations exist.
Individuals can adopt scaled-down versions of the same controls.
The distribution
Reported losses concentrate overwhelmingly in a handful of patterns, all of which are documented and all of which are avoidable.
A last note
Nearly every loss described here was preventable by a habit that takes seconds. That is frustrating to write and is genuinely the state of things.
Summary
Read what you sign, bookmark what you use, revoke what you no longer need and separate what you value.
Four habits covering the overwhelming majority of reported losses.