How to spot and avoid crypto exchange phishing

Kraken lists the patterns it sees: look-alike web addresses with an extra or swapped letter or words like "-support", paid search ads that put a fake site above the real one, urgent emails and texts such as "Your account is suspended", QR codes in messages, fake apps and browser extensions, fake "verify you are human" pages that tell you to paste a command into your computer, and wallet drainer sites that ask you to connect a wallet to claim an airdrop. (Kraken: phishing scams)

OKX adds two common schemes: fake arbitrage, airdrop or listing offers that lead to copied sites, and people posing as customer service in chat who walk you step by step into entering your password or fund password on a phishing page. (OKX: phishing website scams)

Kraken says it will never ask you to share your password, 2FA codes or Master Key, forward a device approval email, share a seed phrase for any wallet, remove your 2FA, install remote access software such as AnyDesk or TeamViewer, move funds to a "safe" wallet, or pay to release or verify funds. A message that asks for any of these is a scam.

Bitvavo puts it the same way for its Web3 wallet: no legitimate party, including Bitvavo, will ever ask for your private keys, and urgent or threatening messages, misspelled links and offers that look too good to be true are warning signs. (Bitvavo: recognizing phishing)

Use a passkey for sign-in where it is offered. Kraken explains that a passkey is tied to its real website and will not work on a fake one, even if you are fooled. Type the address or use a bookmark instead of a search engine, and check the domain rather than the padlock: in kraken.com.example.net, the domain is example.net.

Set an anti-phishing code. On OKX you can set one under Menu > Profile and settings > Security > Anti-phishing code; every genuine OKX email then includes it, and an email without it is fake. OKX also lets you check whether a phone number, email or account is official under Menu > Get help > View all > Verify official channels.

Add a second barrier. Kraken suggests keeping its Master Key on a different device from your sign-in 2FA and turning on the Global Settings Lock, so that someone who gets in still cannot change your security settings. Download exchange apps only from the official app stores through links on the exchange’s own site.

A drainer site does not need your password; it needs you to sign a transaction. Bitvavo warns that once a malicious transaction is signed it cannot be reversed, and suggests a small test transaction before sending larger amounts. For background, see custodial and self-custody wallets and our reports on Ledger’s CryptoBilis warning and the Trezor Brevo email incident.

1. Contact the exchange through its own site or app. Kraken asks you to contact support straight away through its form; OKX asks you to contact customer service and, if needed, freeze the account.
2. Change your passwords and 2FA. Open the exchange yourself by typing the address or using a bookmark, then change your password and update your sign-in 2FA. On OKX, change both the login password and the fund password.
3. Check for changes you did not make. Kraken advises checking that withdrawal addresses, API keys and devices are all familiar and deleting any you do not recognize.
4. Move funds if a recovery phrase was exposed. If you typed a seed phrase or private key anywhere, move the funds to a new wallet with a new phrase, set up on a device you trust.
5. Secure the device. Bitvavo recommends scanning the device for malware, updating the operating system and considering a clean device for the new setup.

• Kraken Support: Phishing scams Checked 12 November 2026
• OKX Support: How can you protect yourself from phishing website scams? Checked 12 November 2026
• Bitvavo Help Center: How to recognize phishing Checked 12 November 2026