A Familiar Warning, Worth Repeating: How Phishing Targets .eth Owners
Every so often a security story makes the rounds in crypto circles, and the lesson is always the same even when the details differ. People lose access to wallets and names not because the protocol failed, but because they were tricked into approving a malicious transaction, signing the wrong message, or sharing a recovery phrase.
ENS owners are frequent targets, not because ENS is insecure, but because a .eth name is a visible, valuable asset. It signals that someone is active in the space, and that makes them a more interesting target than a random address.
The same scams, new wording
The wording changes, the mechanics do not. A message arrives, it creates pressure, and it asks you to do something with your wallet. The underlying protocol is rarely touched at all.
How these attacks usually work
The patterns are remarkably consistent:
- A message that looks urgent, often about a name expiring or a migration being required
- A link to a site that looks like the real ENS app but is not
- A request to connect a wallet and sign or approve something
- The promise of a giveaway, a discount, or a final reminder to create pressure
Rarely is there any genuine exploit of the underlying protocol. The weakness is human attention, and the attackers exploit it well.
If you want the wider picture of how ENS ownership and control actually work, see what ENS is and ENS security basics.
The habits that actually protect you
Good security for ENS is not complicated. It is mostly a set of boring, repeatable habits:
- Type the ENS app URL yourself, or use a bookmark you trust, instead of clicking links
- Treat any message that demands urgency or creates fear as suspicious by default
- Never share your recovery phrase, ever, with anyone or any site
- Read what you are signing, especially approval requests for token spend
- Double-check the exact domain before connecting a wallet to any site
- Beware of messages claiming your name is about to be taken or needs a migration action
Why this matters more as migration news spreads
Security stories matter even more during periods of change. When a real migration or upgrade is happening, scammers love to piggyback on the confusion. If you see an unsolicited message telling you to take an action on your name, verify through official channels first. The real protocol team will never message you out of the blue asking for your recovery phrase.
For the legitimate side of that story, see what ENSv2 is.
The bottom line
ENS is not the weak link. People are. The best protection is skepticism, a bookmark you trust, and the willingness to slow down when something feels rushed. A name you have owned for years is worth a few extra seconds of caution.
Next steps
Read ENS security for the fundamentals of protecting a name, or return to the ENS learning hub for the full set of guides.