The compliance deadline that does not exist

Crypto phishing used to promise something: an airdrop, a presale, a yield. A growing share now threatens something instead — your wallet is non-compliant, your assets are at risk, verify before the compliance deadline.

The switch makes sense from the attacker's side. Greed is optional and fear is not, and a regulatory story explains why a stranger is contacting you about your own wallet.

The shape of it

The message arrives by email, in a Discord or Telegram announcement, or as a token airdropped into your wallet whose name is a URL. It says some combination of:

• New regulations require wallet verification.
• Your wallet has been flagged and must be cleared.
• A migration is required before a date, after which access ends.
• Your funds will be frozen or forfeited if you do not act.

Every version of it invents a compliance deadline. It links to a page that mirrors a real protocol or a regulator's branding, asks you to connect, and then asks for one signature — usually a permit or setApprovalForAll, because those authorise a transfer without looking like one.

Why the premise cannot be true

A regulator has no way to require a signature from a self-custody wallet. Nothing about a private key is registered with anyone. There is no list of wallets, no compliance status attached to an address, and no mechanism by which signing something would satisfy an authority.

A protocol cannot freeze your self-custody assets. Some tokens have issuer-level freeze functions, which is a real property worth knowing about — but that is exercised by the issuer on their own token, not requested from you by email.

A real migration does not need your approval to a new contract via a link in a message. When protocols genuinely migrate, they announce it on their own domain, over weeks, with documentation, and the interface is on the address you already use.

The tell is structural: you are being asked to sign something, urgently, in response to a message you did not seek. That combination has never once been legitimate.

What makes this version effective

It targets people who are already careful. Someone who has learned to ignore free-money offers may still act on a warning about their own assets — the whole point of self-custody is that nobody else will fix it, and that responsibility is what the scam borrows.

The regulatory framing also supplies a plausible reason for the deadline, which every scam needs and most explain badly. "The rules change on the 30th" sounds like something that happens, because it is.

The check that takes a minute

1. Do not follow the link. Type the protocol's address yourself, or use a bookmark. If there is a migration, it will be on their site.
2. Search for the announcement on the project's own channels. A real deadline is documented and discussed; a fake one exists only in the message you received.
3. Ask whether a signature could possibly satisfy the claim. Compliance, verification and unfreezing are not things a wallet signature does. If you cannot explain what the signature would accomplish, that is the answer.
4. Check the address you are being asked to approve on a block explorer, before signing rather than after.

The airdropped token variant

A token appears in your wallet named after a website, sometimes showing a large fake value. Interacting with it — approving, swapping, or visiting the site — is the attack.

Receiving it is harmless. You cannot be drained by something arriving. Hide the token if your wallet allows it, and do not visit the address in its name.

If you signed

Move quickly and in this order:

1. Revoke approvals on that address with a tool such as Revoke.cash, reached by typing the address.
2. Move remaining assets to a wallet from a fresh seed if the value is meaningful, since a permit signature you gave may not be visible on-chain until it is used.
3. Record the transaction hashes and report the address to the block explorer so it can be labelled.
4. Ignore anyone offering recovery. That is the second scam, and it targets exactly the people the first one worked on.

What is wallet verification supposed to mean?

Wallet verification is a phrase that means nothing on-chain. There is no registry of addresses, no status attached to a key pair, and no authority that could record the result of a check. The phrase exists because it sounds like something you would have to do, and because the words are familiar from banking, where verification is real.

That is the whole trick. A term borrowed from a system where it exists, applied to one where it cannot.

Which of these deadlines are real?

No compliance deadline appears in either. The 2 rows marked yes have one thing in common: neither involves you signing a message that arrived in an unsolicited link.

Why does the fear version work better than the greed version?

Because greed is optional. A person who has trained themselves to ignore free-money offers has not trained themselves to ignore a warning about assets they already hold — and self-custody makes that warning land harder, since the whole premise is that nobody else will fix it for you.

The regulatory framing also supplies a plausible deadline, which every scam needs and most invent badly. Rules changing on a date is a thing that happens.

So the check is structural rather than emotional: you were contacted, urgently, and asked to sign. Ask what the signature would accomplish. If you cannot name the mechanism — and for wallet verification there is none — you have your answer without judging the story at all.

More on the mechanics in our guides to scam prevention, the wallet security habits that limit the damage, and risk analysis for addresses you have already interacted with.

What a compliance deadline actually is

A compliance deadline is a fabricated date attached to a fabricated requirement, and the phrase is doing all of the work. Real obligations in crypto attach to businesses — exchanges, custodians, brokers — and they are discharged with documents on those platforms, not with a signature from a wallet you control yourself.

The 3 things a genuine deadline has, and a fabricated one never does:

1. A published source. A regulator's own site, or the protocol's own domain, reachable by typing the address.
2. A mechanism you can describe. What happens on the date, to whom, and by what means.
3. Weeks of notice, not 48 hours. Real processes are slow because they involve people.

A compliance deadline that arrives by message, gives you 2 days, and is satisfied by signing something has none of the 3.