What Is an ICE Phishing Attack That Drains Your Wallet Through a Fake Site?

01 October 2026

An ICE Phishing attack is a scam where a fake website mimics a legitimate cryptocurrency service, tricks you into connecting your wallet, and then executes a transaction that gives the attacker unlimited approval to drain your tokens. The "ICE" stands for "Infinite Contract Execution" or "Infinite Currency Extraction," depending on who you ask, but the mechanism is the same: a single deceptive signature empties your wallet.

How it works in general terms

A normal phishing site asks for your seed phrase or private key. An ICE phishing site does not. Instead, it asks you to connect your wallet - which feels safe because you have done it on real sites hundreds of times. Once connected, the site prompts you to sign a transaction that looks routine: "Approve swap," "Claim airdrop," or "Verify wallet." In reality, the transaction is a smart contract call that grants the attacker unlimited permission to transfer your tokens.

The scam exploits the ERC-20 token approval system. When you approve a smart contract to spend a token, you set a limit. Legitimate services set a limit equal to what you are swapping or depositing. An ICE phishing site asks you to approve an infinite amount - often represented as the maximum possible value (2^256 - 1). Once that approval is on the blockchain, the attacker can drain every token you hold that uses the same approval mechanism.

Typical Steps of an ICE Phishing Attack

1. You receive a lure. This can be a direct message on social media, an email, a compromised ad, or a link in a Discord server. The lure promotes a fake airdrop, a new token sale, a staking pool, or a "site update" requiring wallet reconnection.

2. You click the link. The URL looks close to the real one - metamask-verify.com instead of metamask.io, or uniswap-airdrop.live instead of uniswap.org. The site design is a near-perfect copy of the real service.

3. You connect your wallet. The site uses a standard "Connect Wallet" button. Clicking it triggers the same MetaMask or WalletConnect popup you see everywhere. This step alone does not give the scammer access - connection alone grants no spending authority.

4. You are asked to sign a transaction. This is the critical moment. The site displays a prompt that says something like "Claim your tokens" or "Verify your address." The transaction details are hidden behind a small "Details" button or shown in technical jargon. If you click "Sign" or "Confirm" without reading the full transaction data, you approve the infinite spend.

5. Your wallet is drained. The scammer, or an automated script, immediately calls the transferFrom function on the token contract, moving your tokens to their wallet. Because the approval is unlimited, they can take every token you hold in that wallet that uses the same approval standard. Multiple tokens can be drained in a single sweep.

Why It Works

The attack works because of a gap between what users think "signing" means and what it actually authorises. Many users believe that signing a message is harmless - it does not move funds. That is true for off-chain signatures, like signing into a website. But an on-chain transaction is different. When you sign a transaction that calls approve on a token contract, you are giving the smart contract permission to move your tokens. The scammer depends on you not reading the fine print.

Another factor is that MetaMask and similar wallets show the transaction in a popup, but the popup does not always display the approval amount clearly. In some wallet versions, the approval limit is hidden behind a "View full transaction details" link. Users who skip that step never see the infinite approval.

How to Recognise an ICE Phishing Attempt

• Unsolicited links. Any message pushing you to "claim" something or "verify" your wallet from an unknown source is suspect. The site can look perfect, but the delivery method is the giveaway.

• Requests to sign a transaction you did not initiate. If you visit a site and it immediately asks you to sign something before you have clicked anything, that is abnormal. Legitimate sites only ask for a signature when you perform an action like swapping or depositing.

• Unusual transaction details. If you expand the transaction details in your wallet and see a value like 115792089237316195423570985008687907853269984665640564039457584007913129639935 (2^256 - 1), that is an infinite approval. A normal swap approval shows a number equal to the amount you are swapping.

• Mismatched URLs. Check the address bar carefully. Look for subtle typos, extra words, or wrong top-level domains. A site that looks like the real thing but has a different domain is phishing.

What to Do If You Have Signed an ICE Transaction

1. Do not sign anything else. If you realise you have approved an infinite spend, stop interacting with the site immediately.

2. Use a revoke tool. Visit a reputable token approval checker like Etherscan's Token Approval tool or a dedicated service such as Revoke.cash. Connect your wallet and look for approvals with infinite limits. Revoke the approval for the scam contract.

3. Move remaining funds to a new wallet. Revoking the approval removes the scammer's permission, but if the scam contract has any other functionality, your wallet could still be at risk. Create a new wallet, transfer your remaining tokens there, and do not reuse the compromised wallet for anything important.

4. Report the scam. Submit the phishing URL to services like Etherscan's Phishing Database, MetaMask's Phishing Detection, or Google Safe Browsing. This helps protect other users.

Prevention

• Use a hardware wallet. It does not prevent the scam, but it forces you to confirm every transaction on a separate device, giving you an extra moment to read the details.
• Install a browser extension that checks URLs against known phishing databases.
• For any action that asks you to sign a transaction, expand the details and read what you are approving. If the amount looks like an infinite number, reject it.
• Consider using a "burner" wallet for interacting with unfamiliar dApps. Keep your main holdings in a wallet that never connects to unknown sites.

Back to crypto scams