Phishing
Impersonating a trusted site or party to capture credentials or induce a harmful signature.
Phishing pages relay passwords and authenticator codes to the real exchange in real time, so only a hardware security key — which checks the domain — defeats them. In self-custody, phishing takes the form of fake claim pages that request approvals. Reach financial sites by bookmark, never by link.