Blockchain security firm SlowMist has raised the alarm over a new and highly convincing phishing campaign targeting MetaMask users. Unlike earlier scams that relied on obvious fake links or direct wallet drainers, this attack is more subtle. It exploits user trust by copying MetaMask’s two-factor authentication (2FA) flow, making the scam feel like a routine security check rather than a threat.
According to SlowMist, the real danger lies in how familiar and “safe” the process looks. Users believe they are protecting their wallets when in reality, they are handing full control to attackers.
How the Fake 2FA Scam Tricks Users
SlowMist’s chief security officer, known as “23pds,” explained that the scam unfolds in multiple polished steps. Victims are first redirected to spoofed websites with URLs that closely resemble MetaMask’s official domain. Minor spelling changes are easy to overlook, especially when users feel pressured to act quickly.
Once inside, users are shown realistic security alerts and a professional-looking 2FA verification page. Countdown timers, warnings, and reassurance messages are used to build urgency and trust. The final step asks users to enter their recovery phrase to “complete” verification. At that moment, attackers gain full access to the wallet and its funds.
Also Read : Crypto Hack Alert: $107K Drained From 100+ Wallets Across EVM Chains
Phishing Losses Drop, but Attacks Get Sharper
Interestingly, this new scam appears during a year when overall crypto phishing losses declined sharply. In 2025, wallet-draining losses fell by more than 80%, and the number of victims dropped significantly. However, experts warn that attackers are adapting, not disappearing.
Instead of a few large-scale thefts, scammers are now focusing on mass retail campaigns. Average losses per victim have decreased, but an increasing number of users are being targeted. Activity also increases during strong market rallies, when higher transaction volumes create more opportunities for social engineering.
Attackers are also abusing newer Ethereum features. Permit-based approvals and newer malicious signature methods allow multiple harmful actions to be hidden inside a single user approval, making scams harder to detect.
Wallet Providers Step Up Defense
In response, major wallet providers such as MetaMask, Phantom, and WalletConnect have partnered with the Security Alliance (SEAL) to develop a shared phishing defense system. This network enables real-time reporting and faster blocking of malicious sites across multiple wallets, strengthening ecosystem-wide protection.
How to be Safe?
Despite declining losses, security experts stress that vigilance is more important than ever. The golden rule remains unchanged: no legitimate wallet will ever ask for your seed phrase. Scammers rely on urgency and realism to override caution. Slowing down, double-checking URLs, and treating pressure as a red flag remain the most effective defenses in an increasingly sophisticated threat landscape.
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
