Imagine stepping off a 16-hour flight, exhausted and irritable, only to realize you need to urgently move some crypto funds. With SIM-card kiosks closed, you connect to the airport’s “free WiFi” to get online.
Hours later, your crypto is gone, transferred to an unknown wallet. You may have fallen victim to an “Evil Twin” WiFi attack.
Evil Twins mimic legitimate WiFi networks
Security experts told Cointelegraph that this often-overlooked threat involves attackers creating fake WiFi networks that closely resemble legitimate ones. Once a device connects, hackers can intercept traffic or harvest sensitive information, including login credentials.
Last year, the Australian Federal Police charged a man accused of setting up fraudulent free WiFi hotspots at an airport that mimicked official networks to capture personal data from unsuspecting users.
Steven Walbroehl, co-founder of cybersecurity firm Halborn, told Cointelegraph that Evil Twin attacks are most common in airports, cafes, hotels, transit hubs, conferences, and busy tourist areas, where travelers frequently seek free internet access.
Meanwhile, SlowMist chief information security officer 23pds said Evil Twin networks are “more common than people think,” adding that many users still “absolutely fall for it.”
An Evil Twin network alone won’t automatically drain crypto
Walbroehl cautioned that simply connecting to a malicious WiFi network does not necessarily result in lost crypto, as long as users avoid transmitting private keys, seed phrases, or other highly sensitive information while connected.
“Even without access to a private key, attackers who capture exchange login credentials, email access, or two-factor authentication codes can rapidly empty centralized crypto accounts,” he said.
Watch out for fake logins and deceptive prompts
SlowMist CISO 23pds explained that attackers often pressure victims into giving up information after they join a rogue network. This can involve fake login pages, bogus software updates, prompts to install so-called helper tools, or, in the worst cases, tricking users into entering their seed phrases — something he noted “still happens far too often.”
“If you remember one thing: Evil Twin attacks win by getting you to make a mistake — not by magically breaking encryption. So the real danger is less about deep hacking, and more about phishing + social engineering at the perfect moment.”
23pds recommended several practical steps to stay safe on public WiFi. Users should avoid high-risk crypto activities—such as transferring funds, changing security settings, or connecting to new dApps—while on unsecured networks. He also advised never entering a seed phrase, using bookmarks for exchange websites or typing URLs manually, avoiding search ads, and double-checking all addresses instead of copying and pasting.
Walbroehl added that using a personal mobile hotspot, private networks, and disabling auto-connect on devices can help prevent falling victim to an Evil Twin attack.
If public WiFi must be used, he suggested relying on a trusted VPN to encrypt traffic and only connecting to networks verbally confirmed by venue staff as legitimate.
In January, an X user known as The Smart Ape shared that their crypto wallet was drained after using a hotel’s public WiFi and making a series of “stupid mistakes.” While this incident didn’t involve an Evil Twin network, it demonstrated how attackers can exploit public networks to trick users and steal crypto using similar tactics.
Additional crypto security tips for travelers
In June, Kraken’s security chief, Nick Percoco, warned about the widespread lack of security awareness at crypto events, including conferences.
23pds suggested a practical three-layer approach to safeguarding crypto while traveling: avoid using your main holdings on the go, create a separate travel wallet with a limited amount of funds, and use a small, offline hot wallet for daily transactions, payments, minor swaps, or limited dApp interactions.
“If your phone gets stolen, you click a bad link, or something goes wrong — your downside is limited.”
