If you receive a text message claiming that a cryptocurrency exchange is offering a reward or that you need to protect your account, do not click the link in the message. Instead, check directly through the exchange's official app. In particular, a request to enter your wallet's seed phrase to recover assets may be a phishing attempt designed to steal your cryptocurrency.
On October 16, 2026, the Korea Internet & Security Agency (KISA) warned of an increase in smishing attacks impersonating cryptocurrency exchanges and wallet services. Confirmed cases involved attackers using promised rewards to lure users to fake websites or malicious apps and steal information needed to recover cryptocurrency wallets.
Importantly, not every legitimate exchange reward promotion should automatically be considered fraudulent. Whether a reward event actually exists and whether a link in a text message is safe are two separate questions that must be checked independently.
How Cryptocurrency Exchange Impersonation Scams Work
Smishing attacks impersonating cryptocurrency exchanges encourage users to click links by creating excitement about potential rewards or anxiety about account security. Opening these links may lead to phishing websites designed to resemble legitimate exchanges or to pages prompting users to install malicious applications.
KISA identified four common types of wording in actual attacks:
Reward payment: Claims that the recipient has a reward waiting at an exchange.
Immediate collection: Encourages the recipient to complete the reward collection process immediately.
Unusual activity detected: Suggests that a security problem has occurred on the recipient's account.
Asset protection: Claims that urgent action is required to protect or recover assets.
The presence of these phrases does not automatically mean that every message containing them is malicious. However, caution is necessary if a message directs you to a website where you must enter personal information or install a separate application.
A request for a personal wallet's seed phrase under the pretext of asset recovery is especially important to distinguish from an ordinary promotional notice.
The safest way to verify a message is to avoid using the URL provided in the text and instead look for the relevant announcement in the exchange's official app or on its independently verified official website.
Are Cryptocurrency Exchange Reward Promotions Always Scams?
Legitimate cryptocurrency exchanges do operate reward promotions for both new and existing customers.
For example, in a promotion announced in September 2026, Bithumb described rewards for users who satisfied certain trading requirements. Coinone also operated a separate promotion for new customers.
However, the existence of a legitimate exchange promotion does not establish that a particular reward text message is genuine.
The following comparison can help distinguish legitimate announcements from suspicious requests.
| What to Check | How to Verify Legitimacy | Warning Signs |
|---|---|---|
| Whether the promotion exists | Check promotional announcements in the official app | The promotion can only be found through the text message link |
| Reward eligibility | Verify eligible participants, dates, and participation requirements in the official announcement | A reward claim requires visiting an external website |
| Account security alerts | Check account status directly in the official app | The message demands urgent verification through a text message link |
| App installation | Verify the installation method provided by the exchange | The message asks you to run a separately supplied installation file |
| Wallet recovery | Check the official recovery procedure for your wallet | The message demands your seed phrase to collect a reward or protect assets |
Do not trust a text message merely because it displays an exchange's name or logo.
Even if the sender's phone number looks familiar, it is safer to complete verification through the official app that you open independently.
Why Requests for a Wallet Seed Phrase Are Particularly Dangerous
A seed phrase is essential secret information used to recover a personal cryptocurrency wallet. Also called a recovery phrase, it generally consists of multiple English words.
Unlike an ordinary password, a seed phrase is directly connected to the ability to access assets controlled by the corresponding wallet.
KISA confirmed cases in which attackers induced users to enter seed phrases under the pretext of asset recovery and then used the information to steal their wallets.
It is important to understand the difference between a cryptocurrency exchange account and a personal wallet.
An exchange account allows a customer to sign in to an exchange service to trade or manage assets. Login passwords and identity verification information are important for protecting this account.
A personal wallet, by contrast, may be used in a way that requires the owner to manage the recovery phrase or private keys directly. If the recovery phrase is exposed, an attacker may be able to access the wallet from another device.
Therefore, any procedure claiming to distribute an exchange reward while requiring a personal wallet's recovery phrase is a serious warning sign.
You should never comply with requests such as:
Submitting a wallet recovery phrase to receive a reward.
Verifying a seed phrase to protect assets.
Entering every recovery word to confirm wallet ownership.
Providing a private key as part of a supposed exchange security inspection.
If a message says you must enter your seed phrase to receive a reward, the possibility of wallet theft should take priority over the promised reward.
What to Do After Clicking a Suspicious Crypto Exchange Link
The appropriate response depends on what you did after clicking the link. It is important to distinguish between simply opening a page, entering personal information, installing a malicious app, and exposing a seed phrase.
1. If You Only Opened the Link
Leave the suspicious website immediately and stop entering information or downloading files.
Clicking a link does not automatically mean that your wallet has been compromised. However, you should check whether any malicious files were downloaded or an application installation was initiated.
If you discover an application you did not intentionally install or notice suspicious device behavior, perform a security inspection.
2. If You Entered Exchange Login Information
Open the official exchange app independently rather than returning to the website linked in the message, and check your account's security status.
Change the password you entered immediately. If you use the same password for other services, inspect those accounts as well.
Review login history and withdrawal records. Report any suspicious activity to the exchange's customer support team.
If you also disclosed an identity verification code, inform customer support about that disclosure.
3. If You Installed a Suspicious Application
Stop entering additional financial information or performing transactions involving your assets, and prioritize a security inspection of your device.
KISA also warns that when a malicious app infection or personal information exposure through a phishing site is suspected, a victim's mobile phone number may be misused to send smishing messages.
In South Korea, users can check whether their mobile carrier offers a phone-number spoofing prevention service for text messages. They should also review mobile payment records for unusual activity.
It is safer not to change passwords or perform wallet recovery operations on a device suspected of being affected by a malicious application.
4. If You Disclosed Your Wallet Seed Phrase
If you submitted your seed phrase to an external phishing website, you should no longer assume that the wallet is secure.
Continuing to use an exposed recovery phrase is dangerous. Urgently consider transferring your assets to a newly created wallet that uses a completely different recovery phrase.
The following precautions are important:
1. Use a trusted device and an official wallet application.
2. Create a new wallet without reusing the previous seed phrase.
3. Never enter the new wallet's recovery phrase on external websites or disclose it to another person.
4. If the assets can still be transferred, carefully verify the blockchain network and receiving address before making a secure transfer.
5. Preserve records of any withdrawals or theft that have already occurred and report the incident to the relevant authorities.
If the assets have already been transferred or the attacker accessed the wallet first, you may not be able to complete the transfer successfully.
Blockchain transactions should not be assumed to be reversible in the same way as ordinary bank transfers. The possibility of recovering stolen assets depends on the assets involved and the circumstances of the transactions.
How to Check Suspicious Text Messages Through KISA's Protection Nara Service
Suspicious reward messages or asset protection notices can be checked using the smishing verification service provided by KISA's Protection Nara, a South Korean cybersecurity information and protection service.
Protection Nara provides a message verification procedure through KakaoTalk, the messaging service widely used in South Korea. Users can submit a received message to ask whether it is malicious.
Follow these steps:
1. Search for the official Protection Nara channel in KakaoTalk.
2. Add the channel and access its smishing verification service.
3. Copy and submit the suspicious text message. You do not need to open the link contained in the message.
4. Review the smishing verification result.
5. If the service indicates that analysis is still in progress, check the result again later.
Verification results are classified into three categories: Normal, Caution, and Malicious.
A newly reported message may initially receive a Caution classification. According to KISA's guidance, users can check again after 10 minutes to see whether the message has been classified as Normal or Malicious.
A Caution result does not mean that the message is safe. Until verification is complete, avoid opening suspicious links or entering personal information.
In South Korea, smishing messages can also be reported using a smartphone's spam reporting function or through the smishing reporting procedure operated by the Integrated Reporting and Response Center for Telecommunications Financial Fraud.
For assistance with hacking, spam, or personal information infringement in South Korea, users can call 118.
Three Things to Check Before Responding to a Crypto Reward Message
When you receive a cryptocurrency-related text message, focus first on what the message asks you to do rather than simply what it claims.
1. Does the Message Require You to Open a Link to Receive a Reward or Secure Your Account?
Even if the promotion mentioned in the text message is real, that does not guarantee that the URL in the message belongs to the official exchange.
2. Does the Message Confuse Exchange Login Information With Wallet Recovery Information?
Be particularly cautious when a message claims to resolve an exchange login problem but requests the seed phrase for a personal wallet.
3. Have You Separately Verified the Message and Considered Reporting It?
Check the promotion and your account status through the exchange's official app. If the text message itself appears suspicious, use Protection Nara to assess whether it is malicious.
If you have already entered personal information or exposed your wallet recovery phrase, protecting your account and assets takes priority over waiting for a text message verification result.
Frequently Asked Questions
Are All Cryptocurrency Exchange Reward Text Messages Fraudulent?
No. Legitimate exchanges also run promotional events and reward programs. However, the existence of a promotion and the safety of a link in a text message are separate matters. Always verify the details directly in the official app.
Can I Trust a Message if It Displays the Exchange's Official Logo?
A logo alone cannot establish the sender's identity. Phishing websites impersonating exchanges may use similar names and visual designs, so you should independently verify the official access method.
If I Exposed My Seed Phrase but My Balance Is Still There, Is My Wallet Safe?
A remaining balance does not prove that your wallet is secure. An exposed seed phrase may allow an attacker to access the wallet. Prepare a new, trusted wallet and consider transferring the assets.
What Does a Caution Result Mean in Protection Nara's Smishing Verification Service?
Caution may mean that the message has not yet been conclusively classified as Normal or Malicious. Follow Protection Nara's instructions for another check, but do not open suspicious links or enter information before verification is complete.
Can I Recover Stolen Cryptocurrency by Reporting a Smishing Attack?
Reporting an incident does not automatically result in asset recovery. Preserve transaction records and relevant evidence before reporting the incident. The actual possibility of recovery depends on the transaction circumstances, the path taken by the assets, and other relevant factors.
*Disclaimer: This article is provided for reference purposes to help readers understand market developments and does not constitute an investment recommendation for any particular security or asset. Final investment decisions and responsibility rest with the individual investor.*
