How crypto wallets get drained: seed phrases, clipboard swaps and public Wi-Fi (2026)

A drained wallet almost never looks like a break-in. In most cases nothing was broken at all: the owner entered a seed phrase on someone else's page, approved a transfer to a swapped address, or installed an app that only looked like the real one. Three scenarios below, and a clear line between what an encrypted connection covers and what it never will.

Scenario one: a site with a lookalike name

You search for a wallet or a swap service, click the top result, and land on a copy of the interface. The domain differs by one character, a hyphen, or a top-level domain: .com instead of .io, the digit 1 in place of the letter l. The page loads over HTTPS and the padlock is there. A certificate can be issued for almost any domain in minutes, and the padlock only confirms that nobody else is reading the connection to that domain. It says nothing about the domain being genuine.

Then the interface asks you to «restore your wallet» or «confirm ownership» and shows a field for 12 or 24 words. A real wallet asks for the seed phrase exactly once: when you restore it on a new device. No service, no support agent, no airdrop and no balance check ever needs it.

Scenario two: the address was swapped in the clipboard

Nobody types addresses by hand — they copy them. That is what the trick is built on. Malware watches the clipboard, recognizes from the shape of the string that a crypto address was copied, and substitutes its own. You hit paste, see a long string of the right form, glance at the first few characters, and approve the transfer.

Checking the ends does not help. A lookalike address is generated in advance by brute force, and both the first and the last characters can match. That is how address poisoning works: a near-identical address is planted in your transaction history and waits to be copied out of it. Only one thing is reliable: read the address in full, and from a screen other than the one it was pasted into — the display of a hardware wallet, a second device, or an address book you saved earlier.

Scenario three: a fake app

The clone lives in two places: in the search ads above the real site, and in the app store itself, with a similar icon, a familiar name and reviews. It behaves like the real thing right up to the moment you enter your seed phrase to import a wallet. After that it does not fail and shows nothing unusual. The phrase is simply no longer yours alone.

• Install the app only from the link on the project's own site, and open that site from a bookmark rather than from search.
• Look at the developer on the store listing, not at the app name: a fake usually has a new account with no history and no other apps.
• A clone is usually newer and has fewer installs, but both numbers can be inflated, so treat them as an argument rather than proof.
• Check wallet browser extensions the same way: a fake has a different identifier in the store page URL.

What a VPN does not cover here

A tunnel is responsible for the channel: it encrypts traffic between your device and the server and changes the network address the site sees. It does not check where you ended up — a real domain and a typo domain look identical to it. It does not read your clipboard and does not compare the address you pasted with the one you copied. It does not tell a genuine wallet app from a fake with the same icon.

All three scenarios above play out with a VPN on exactly as they do without it: the data reaches the attacker intact, over a secure connection. There is no anonymity here either — a VPN changes your network address and nothing more. The other layers are covered in the guide on deanonymization through device identifiers.

What a VPN does cover

There is one job the tunnel is genuinely for: networks you do not control. In a cafe, a hotel, an airport or a coworking space you connect to an access point someone else runs. Whoever runs it — or whoever set up an access point with a similar name nearby — sees which domains you reach and answers your DNS queries. Those answers can be replaced to send you to a page of their choosing, and hotel captive portals normally work through the same mechanism.

• The domains you visit stop being visible to the network: the requested host name travels inside the encrypted connection.
• DNS queries go into the tunnel instead of to someone else's router, provided the client is configured that way and does not send them outside it.
• Traffic contents cannot be read or rewritten in transit on that network.

What a DNS spoofing attempt looks like

Spoofing almost always leaves visible traces. People scroll past them because they are in a hurry. Signs to watch for on an open network:

• A familiar site opened over http:// instead of https://, or moved to another domain on its own.
• The browser showed a certificate warning: the name in the certificate does not match the domain, or the issuer is not the usual one.
• The network asks you to install a certificate, a profile or a separate app «for internet access».
• The login page looks normal but asks for something it never asked for before: a seed phrase, a private key, an authenticator code «for verification».
• The site loads only on this network, and on mobile data it does not load or looks different.

1. 1Do not click «proceed anyway» on a certificate warning. On someone else's network, that warning exists for exactly this situation.
2. 2Close the tab and switch to mobile data: if everything is fine there, the problem was the network, not the site.
3. 3Turn the tunnel on before you open anything that matters, not after the first attempt goes wrong.
4. 4Do not install certificates or profiles at a Wi-Fi network's request: an installed certificate lets whoever issued it read even encrypted connections.
5. 5If you already entered something before connecting, treat that data as compromised and change it from another device.

Rules that actually work

1. 1The seed phrase lives on paper or metal, not in a screenshot, a photo library, a notes app, cloud storage or a message to yourself. A photo of the phrase syncs to the cloud automatically, and from that point its security equals the security of your email account.
2. 2The phrase is entered once, when you restore a wallet on a new device. Any other reason to enter it means you are on the wrong page.
3. 3Verify the destination address in full, not by the first characters, and preferably on a different screen than the one you pasted it into. For a large amount, send a minimal test transfer first.
4. 4Give the wallet its own perimeter: a separate browser with no extensions, or better, a separate device with no games, no work files and no casual downloads.
5. 5Open wallet, exchange and swap sites from bookmarks. Search results, and the ads above them in particular, are the most common entry point into phishing.
6. 6Keep amounts you would hate to lose on a hardware wallet. It shows the recipient address on its own screen, and a clipboard swap on the computer does not change that screen — but this works only if you actually read the address there instead of confirming blind.

If the phrase has already gone somewhere it should not

Speed matters more than investigation. Treat the phrase as known to strangers from the moment it was entered: the old wallet cannot be brought back under your control, and anyone holding the phrase has access to it.

1. 1Create a new wallet on another device you consider clean, and write the new phrase down on paper.
2. 2Move whatever is still at the old address to it, starting with whatever moves fastest.
3. 3Scan the device you entered the phrase on for malware, and check the accounts tied to it for unknown sessions and mail forwarding rules.
4. 4Change passwords and confirmation codes on exchanges and in your email from a different device you know is clean.
5. 5Do not contact «fund recovery services» or «crypto lawyers» that reach you through direct messages and comments: that is the second wave of the same scam. A transfer that has already gone through cannot be reversed.

Common questions

The short version: a VPN covers the network — someone else's Wi-Fi, the visibility of domains, DNS spoofing. The wallet is on you: where the phrase is stored, where the site was opened from, and which screen the address was read on. Mixing those two layers is what costs the most. What users of free clients pay instead of money is covered in free VPN: what the user actually pays.