Ice phishing

Standard phishing tries to obtain a seed phrase or private key. Ice phishing instead exploits how tokens work on Ethereum and similar chains: a holder can authorise another address to move tokens on their behalf. The attacker presents a fake mint, claim or login page whose transaction is really an approve, setApprovalForAll or off-chain permit signature naming the attacker as spender, and later calls transferFrom to empty the balance.

The technique, named by security researchers in 2022, is now the core of most wallet drainer kits. It is effective because the signature request often looks routine, the theft can happen hours or days later, and permit signatures cost no gas and do not appear as a pending transaction, so victims may not notice what they signed.

Keys remain safe, so the wallet itself is not compromised, but every approved token is exposed until the approval is revoked. Reading the spender and amount before signing, using wallets that simulate the outcome and revoking unused allowances limit the damage. Hardware wallets do not prevent ice phishing if the user approves the request.