2024

Bitcoin

would

Crypto investors are being targeted by a new phishing campaign that impersonates MetaMask and tricks users into handing over their wallet recovery phrases, according to the blockchain security firm SlowMist.
The attackers are impersonating a <a href="https://cointelegraph.com/learn/articles/what-is-two-factor-authentication-2fa" rel="noopener noreferrer nofollow">two-factor authentication (2FA)</a> security verification flow, which redirects users to fraudulent domains through fake security warnings that request users’ seed phrases.
When a user shares a wallet recovery phrase, the funds from the wallet are stolen, <a href="https://x.com/im23pds/status/2008008223526400417" rel="noopener noreferrer nofollow" target="_blank">warned</a> SlowMist's chief security officer, 23pds, in a Monday X <a href="https://x.com/im23pds/status/2008008223526400417/photo/1" rel="noopener noreferrer nofollow" target="_blank">post</a>.
This new wave of scams serves as a reminder that decentralized wallet protocols would never ask users for their secret recovery phrase, which enables anyone to take control of the wallet.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2026-01/019b8dc8-9a73-7a59-9424-5cd711493544.png" title="" alt="Fake MetaMask 2FA security checks lure users into sharing recovery phrases">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/im23pds/status/2008008223526400417/photo/1" rel="noopener noreferrer nofollow" target="_blank">23pds</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/bitcoin-retirement-fund-pig-butchering-scam" rel="noopener noreferrer nofollow">Bitcoin investor loses retirement fund in AI-fueled romance scam</a>
The phishing email redirects users to fake domains impersonating MetaMask, urging them to enable 2FA within a short period, claiming they may lose access to key wallet features.
The final step of the fraudulent process asks users for their 12-word seed phrase to complete the “security setup.”
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2026-01/019b8dc8-9ebc-77ba-baa2-1a3f9b32a0c8.png" title="" alt="Fake MetaMask 2FA security checks lure users into sharing recovery phrases">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/im23pds/status/2008008223526400417/photo/1" rel="noopener noreferrer nofollow" target="_blank">23pds</a>
 </figcaption>
</figure>
Crypto <a href="https://cointelegraph.com/news/phishing-scams-top-crypto-threat-2024-certik" rel="noopener noreferrer nofollow">phishing scams</a> involve hackers sharing fraudulent links with victims to steal sensitive information, such as crypto wallet private keys.
Phishing scams have been a long-standing issue in the cryptocurrency space, but a decreasing number of incidents signals that investors are becoming wiser to this threat.&nbsp;
Related: <a href="https://cointelegraph.com/news/crypto-security-phishing-supply-chain-attacks" rel="noopener noreferrer nofollow">Crypto hack counts fall but supply chain attacks reshape threat landscape</a>
<h2 id="phishing-scams-fall-83-in-2025">Phishing scams fall 83% in 2025</h2>
Losses to phishing scams decreased 83% year-over-year, falling to $83.3 million in 2025, from $494 million in 2024, according to a <a href="https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/" rel="noopener noreferrer nofollow" target="_blank">report</a> from Web3 security tool Scam Sniffer, published on Saturday.
The number of phishing scam victims also decreased by 68% year-over-year, from 332,000 victims in 2024 to 106,000 in 2025.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2026-01/019b8dc8-a12c-7d11-be04-204d5823c4ff.png" title="" alt="Fake MetaMask 2FA security checks lure users into sharing recovery phrases">
 <figcaption style="text-align: center;">
 Monthly crypto phishing scam losses and victims, 2025 chart. Source: drop.scamsniffer.io
 </figcaption>
</figure>
Still, losses to phishing attacks peaked in the third quarter of the year, during the market’s most active period, signaling that phishing losses are closely aligned with market activity.
“When markets are active, overall user activity increases, and a percentage fall victim — phishing operates as a probability function of user activity,” wrote Scam Sniffer in the report.
Phishing scammers often impersonate the most popular brands to build trust with their victims.
MetaMask is the world's leading self-custodial wallet, with over 100 million annual users and 244,000 connected decentralized applications, <a href="https://consensys.io/" rel="noopener noreferrer nofollow" target="_blank">according </a>to its parent company, Consensys.<iframe width="100%" height="315" src="https://www.youtube.com/embed/t06mVWz6ngM?start=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy" sandbox="allow-scripts allow-same-origin allow-popups allow-forms"></iframe>
Magazine: <a href="https://cointelegraph.com/magazine/meet-crypto-sleuths-fighting-crime-better-than-the-cops/" rel="noopener noreferrer nofollow">Meet the onchain crypto detectives fighting crime better than the cops</a>

Fake MetaMask 2FA security checks lure users into sharing recovery phrases

Table of Contents

Cointelegraph

Other articles published on Jan 5, 2026

Join our free newsletter for daily crypto updates!