NexFlow › Library › Verifying a crypto link

How to verify a crypto link — the ten-second check that stops the drainer channel

The dominant loss channel in crypto is not a smart-contract bug or an exchange hack — it is a link: a fake site at a lookalike domain, reached through a DM, an ad, or a hijacked social post — the delivery channel is the attack, not the destination’s polish. Verifying the link is the check that decides whether anything downstream matters.

Practical guide · updated 2026-09-28 · not financial advice

The drainer playbook is a link problem — and a link problem is solved at the link, not at the site: the wallet drain, the fake airdrop, the phishing “support portal” all execute the same way — get you to a fake front-end, get a signature. The verify-the-link discipline is the countermove, and it takes seconds once it’s a habit.

Every claim below names its source and date.

The rule that covers most of it: links in DMs are hostile

The single highest-signal rule in the category: a crypto link sent to you — DM, reply-guy comment, “support” outreach, Discord ping — is presumed hostile until verified. Real projects do not DM links. Real support does not DM. Real airdrops do not arrive in DMs. The rule has no exception — not for support, not for airdrops, not for announcements. The channel itself is the tell — the attacker’s whole job is reaching you with a link — the site is built and waiting; the link is the only part that has to reach you — every drainer page is a finished product short exactly one ingredient: a victim at the URL, and the DM is where they do it.

This rule alone defeats the largest share of crypto phishing: not because fake sites are detectable (they’re pixel-perfect clones) but because the delivery channel is.

Reading the domain — the lookalike tells

The verify step is the domain, not the page. The fake-site economy runs on lookalike domains: hyphen variants (phantom-wallet.com), wrong TLDs (phantom.net, jup.ag clones at .app/.io), typosquats (rn-vs-m, misspellings), and subdomains-of-evil (phantom.fake-site.com — the registered domain is the last two labels, and “phantom.” at the front is decoration — the subdomain is free text; the registrable domain is the identity — browsers render the whole thing, but only the last two labels are the legal site — browsers render the whole thing, but only the last two labels are the legal site).

Read the domain from the right: the registrable part is the last two labels. “app.phantom.com” is Phantom; “phantom.app-wallet.io” is a scam at app-wallet.io. The ten-second habit is reading the domain right-to-left before anything loads.

The homoglyph and punycode layer

The subtler variant: homoglyph domains — characters that look identical but aren’t (Cyrillic “а” for Latin “a”, rn-for-m, zero-for-O), rendered through punycode. Browsers show some punycode forms raw (xn--…) but the visual fakes still ship through ads and posts and anywhere the raw domain isn’t visible where you don’t see the raw domain.

The defense isn’t eyeballing better — it’s the navigation rule: reach financial sites by typed URL or a verified bookmark, never by link. The bookmark made after a verified first visit is the durable fix — you never have to evaluate the domain again.

The app-store and social-channel verification

For apps: the publisher name is the check — the official listing is under the real company (“Phantom Technologies Inc.,” the exchange’s legal name), and clone apps sit under throwaway developer names. The store listing is trustworthy; the link to it is not — navigate the store directly — the store listing is trustworthy; the path to it is not.

For social links: a project’s real links live on its verified official channels — the long-aged Twitter/X account, the pinned post, the official site’s link-out page. A link from a reply, a lookalike account, a “community” Discord, or a hijacked old post is a channel, not a source. When in doubt: reputation-check the URL at a scanner, or just don’t.

The “connect wallet” tell — where the link leads

The last check is what the site asks for: a legitimate tool’s first ask is “connect wallet” (address visibility — low-risk); the drainer’s is a signature or transaction approval — the moment the page asks for a signature you didn’t initiate is the moment you leave framed as connection, verification, or a claim. Any link that arrives at a signature request without your initiation is hostile — the signature is the drain.

And the last-layer rule: “sign this message to verify your wallet” is the phrase-level scam — a real site never needs a signature to prove you own an address you just connected from.

The recovery layer — if you clicked anyway

The honest layer most guides skip: clicking the link alone is almost never the loss — the damage needs a signature. If you opened a suspicious link and signed nothing, you are almost certainly fine: close the tab and move on. The scam needs you to transact; the click is just the door.

If you did sign — approved a transaction or signed a message — the response is mechanical and time-boxed: move everything remaining to a fresh wallet immediately (the signed approval is the drain’s standing permission — the approval outlives the session), revoke token approvals on the chain’s approval tool, and treat the wallet as burned. Speed matters — the drain is automated and usually executes within minutes. The response clock starts at the signature, not at the discovery. Minutes matter; the standing approval doesn’t wait. Move first; investigate after. The order is the point.

And the habit that makes a click survivable rather than fatal: the two-wallet compartment pattern — a hot wallet for new sites, a cold wallet for value — means the worst case is the float, not the savings. The verify-the-link discipline is the front door; compartmentalization is the fire door behind it. The two together turn the most common loss channel in the category into a survivable click.

The discipline, once through

DM links are presumed hostile. Read the domain right-to-left; the last two labels are the site. Reach money sites by bookmark or typed URL — the homoglyph layer is why eyeballing isn’t enough. Verify publisher names on stores, account age on socials. And the destination tells: a link that ends at a signature you didn’t initiate is the drain. Ten seconds of discipline — the check is faster than the scam — the whole discipline is measured in seconds, and it holds against every costume the channel wears, and the largest loss channel in crypto closes. And it closes on the side of the reader, not the attacker.

Frequently asked