Hackers Pose as MetaMask 2FA to Steal Recovery Phrases

Crypto News Wallets

Written by Aaron S.,

Editor-In-Chief

Last Updated: January 05, 2026

Key Takeaways

A phishing scam impersonates MetaMask 2FA prompts, which trick users into entering their 12-word recovery phrase on fake websites;
Attackers use counterfeit MetaMask domains and urgent 2FA alerts to harvest seed phrases and drain victims’ crypto wallets;
MetaMask’s user base and reputation make it a prime target for phishing campaigns posing as security updates.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Hackers Pose as MetaMask 2FA to Steal Recovery Phrases

BITDEGREE IN YOUR SOCIAL FEED

A recent phishing campaign targets MetaMask users by mimicking two-factor authentication (2FA) prompts to deceive individuals into revealing their wallet's recovery phrase.

The scam links direct users to counterfeit domains that resemble MetaMask, where fake security alerts urge them to enable 2FA and submit their 12-word seed phrase to complete a "security setup".

Once the phrase is entered, attackers can import the wallet and drain the funds. This behavior was flagged on January 5 by cybersecurity firm SlowMist's chief security officer, 23pds, in an X post.

What is BNB? The Truth Behind Binance Smart Chain (Animated)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Phishing tactics often exploit well-known brands to gain victims' trust. MetaMask, as the most popular self-custodial wallet, boasts over 100 million annual users and supports more than 244,000 connected decentralized applications.

These figures highlight why attackers choose it as a disguise to legitimize their scams.

The scam typically begins with a phishing email claiming that enabling 2FA is mandatory to protect wallet access. These emails feature the MetaMask logo and prompt urgent action by including messages such as "Enable 2FA Now!".

Clicking through takes the user to a phishing site that mimics MetaMask's interface, with a countdown timer or credibility checks, all intended to pressure the user to act quickly.

Recently, ZachXBT claimed to have identified a fake Coinbase $1.36B support agent who stole around $2 million from unsuspecting crypto users. How? Read the full story.