Crypto phishing: what the label means and what to do

The mechanics differ from the password phishing most people know. An attacker does not need your login; they need a signature. That can be a seed phrase typed into a convincing form, a transaction approved in a wallet popup, or a token allowance granted to a contract that then empties the balance at its leisure. Wallets have added warnings for exactly this: MetaMask's security alerts flag transactions and signatures as "Malicious" or "Warning" and are on by default, though a warning does not block the action — the user still confirms. Trust Wallet's Security Scanner works on the same principle, showing low, medium or high risk on destination addresses and dApps and leaving the decision with the user (source below).

Why it matters for a wallet check

Because the decision is yours in both directions. Wallet warnings cover the transaction you are signing; an address check covers the counterparty you are paying, which is a different question and often the earlier one. If someone sends you an address, screening it is the only independent fact you have about them before the money moves.

On the receiving side, phishing proceeds are consolidated and cashed out through retail channels, so a P2P seller can end up holding them. That is a deposit review waiting to happen. Screen the counterparty first — the Telegram bot gives three free checks a day and answers in seconds.

What to do in the first hour after a bad signature

1. Move whatever is still in the wallet to a new one whose keys have never been exposed. A compromised seed phrase does not become safe again.
2. Revoke outstanding token approvals from the compromised address, starting with the most recently granted.
3. Assume every address derived from that seed is compromised, not only the one you were using.
4. Record the transaction hashes and the destination addresses before you do anything else; you will need them for reports and for any exchange you contact.
5. Report to the platform where the funds landed and to law enforcement. Do not engage with anyone offering to reverse the transaction for a fee.

How it shows up in a Sanctuary result

Phishing appears as a named category in the result, in plain words, next to the verdict — CLEAN, LOW, MEDIUM, HIGH or CRITICAL — a recommendation of Proceed, Caution, Review or Reject, and the decision drivers behind them. The result distinguishes an address that is itself a reported collector from one that merely received value from a collector, because those two mean different things for whoever is reading.

Desks and support teams handle these in the workspace, where the category filters the case queue and results export as signed reports for a bank or a case file. Plans are on the pricing page.