Common Crypto Scam Patterns

Why Crypto Attracts Scammers

Crypto is not inherently more dangerous than traditional finance. But it has a specific set of properties that make it unusually attractive to scammers, and understanding those properties is the first step toward protecting yourself.

The most fundamental property is transaction irreversibility. When you send crypto to a scammer, there is no bank to call, no chargeback to file, no intermediary who can reverse the transaction. Once a transaction is confirmed on the blockchain, it is final. This is actually a feature of the technology — it enables trustless transactions without banks — but scammers exploit it ruthlessly. In traditional finance, victims can often recover funds through chargebacks, wire recalls, or fraud departments. In crypto, the window for recovery is effectively zero.

Pseudonymity is the second major factor. Blockchain addresses are not tied to real-world identities by default. A scammer can create unlimited fresh wallet addresses, deploy malicious contracts, drain victims, and move funds through mixers or cross-chain bridges to obscure the trail. While blockchain transactions are publicly visible (and blockchain analytics firms can sometimes trace flows), identifying the person behind a wallet address remains extremely difficult without the cooperation of centralized exchanges that performed identity verification.

Global reach compounds the problem. A scammer in one country can target victims in every other country, 24 hours a day, with no need for local infrastructure. Setting up a convincing phishing site costs almost nothing and can be done in hours. The jurisdictional complexity of cross-border crypto crime means that law enforcement in one country often cannot pursue scammers operating in another, especially in jurisdictions with weak cybercrime enforcement.

Then there is FOMO culture. Crypto markets move fast, and the fear of missing out on the next 100x token drives people to make rushed decisions. Scammers exploit this by creating artificial urgency — “limited time airdrop,” “presale ending in 2 hours,” “only 500 spots left.” When people are afraid of missing a profit opportunity, they skip due diligence. Every bull market cycle brings a fresh wave of scams riding the wave of enthusiasm and greed.

Finally, technical complexity creates information asymmetry that scammers exploit. Most users do not fully understand what they are signing when they approve a transaction, what token approvals actually authorize, or how smart contracts work. Scammers exploit this knowledge gap by disguising malicious actions as routine interactions. If you are new to crypto, our cryptocurrency for beginners guide covers the foundational concepts you need to understand before transacting.

None of this means you should avoid crypto. It means you need to approach it with your eyes open, the same way you would approach driving — understanding the risks does not mean staying off the road, it means wearing a seatbelt and following the rules.

Phishing Attacks

Phishing is the single most common attack vector in crypto. The concept is simple: trick you into entering credentials or connecting your wallet to a fake version of a site you trust. The execution, however, has become disturbingly sophisticated.

Fake Websites

Scammers create pixel-perfect copies of popular exchanges, DeFi protocols, and wallet interfaces. The fake site looks identical to the real one — same branding, same layout, same functionality. The only difference is the URL, which is usually a slight variation of the legitimate domain: uniswap.org versus un1swap.org, or metamask.io versus metamask-wallet.io. Some attackers register domains with homoglyph characters — characters from different alphabets that look identical to Latin letters — making the fake URL visually indistinguishable from the real one in many fonts.

These sites are promoted through search engine ads (Google has been slow to crack down on crypto phishing ads), social media posts, Discord and Telegram messages, and even through compromised legitimate websites. When you enter your login credentials or connect your wallet and sign a transaction, the attacker captures your information or drains your wallet.

Email Phishing

Fake emails impersonating exchanges, wallet providers, or DeFi protocols are a constant threat. These emails typically warn of “suspicious activity” on your account, announce a required “security upgrade,” or notify you of an “unclaimed airdrop.” The email includes a link to a phishing site. Modern phishing emails are well-written, use correct branding, and can even spoof the sender address to appear as though they come from the real company.

Social Media DM Phishing

On Discord and Telegram, scammers impersonate project moderators, support staff, and even other community members. They send direct messages claiming your wallet has been “compromised” and you need to “verify” through a link, or that you have been selected for an exclusive airdrop. In some cases, scammers compromise a real project's social media accounts and post phishing links to the entire community from a trusted source.

Twitter (X) phishing is particularly effective because scammers create accounts that closely mimic legitimate projects, sometimes with verified checkmarks obtained through the paid subscription. They reply to official posts with phishing links, knowing that users often click links in reply threads without checking the exact account name.

How to Verify Legitimate Sites

The best defense against phishing is to never click links from emails, DMs, or social media posts when accessing financial services. Instead:

• Bookmark the real URLs of every exchange and protocol you use. Always access them through your bookmarks, never through search results or links.
• Check the URL bar carefully before entering credentials or connecting your wallet. Look at the actual domain, not just the page content.
• Use browser extensions like ScamSniffer or Wallet Guard that warn you when you visit known phishing domains.
• Enable two-factor authentication on every exchange account, using an authenticator app rather than SMS.
• Be skeptical of urgency. Legitimate services do not threaten account closure or fund loss if you do not act within minutes.

For a broader look at security practices, see our common crypto security mistakes guide.

Wallet Drainer Attacks

Wallet drainers represent the most technically sophisticated consumer-facing crypto scam. Unlike simple phishing that steals your login credentials, drainers steal your assets directly from your self-custody wallet through malicious transactions that you are tricked into approving.

How Drainers Work

When you connect your wallet to a drainer site, the malicious front-end scans your wallet's contents — tokens, NFTs, approvals — and calculates the most profitable attack strategy. It then presents you with a transaction or signature request designed to extract maximum value with minimum suspicion.

There are two primary mechanisms:

Approval-Based Draining

The site asks you to sign a transaction that grants the attacker's contract permission to move your tokens. This typically uses the ERC-20 approve() function or the ERC-721/1155 setApprovalForAll() function. Once you approve, the attacker can transfer your tokens to their wallet at any time — even days or weeks later. The approval transaction itself does not move any funds, which makes it seem harmless. The actual theft happens in a separate transaction that you never see or approve.

Signature-Based Draining

More advanced drainers use off-chain signatures (like EIP-712 typed data signatures or Permit2 signatures) that do not appear as on-chain transactions in your wallet. These signatures can authorize token transfers without a separate approval transaction. Because off-chain signatures do not cost gas and look less alarming than on-chain transactions, users are more likely to sign them without scrutiny. The attacker then submits the signed authorization on-chain to execute the theft.

Drainer-as-a-Service Kits

The drainer ecosystem has become professionalized. Kits like Inferno Drainer (which publicly “retired” in late 2023 but whose code continues to be used), Pink Drainer, and Angel Drainer are sold or rented to scammers as turnkey solutions. The kit provides phishing website templates, wallet scanning code, transaction generation logic, and even customer support for the scammers using them. The kit operator takes a percentage (typically 20-30%) of every theft automatically through smart contract revenue sharing. This means even technically unsophisticated criminals can deploy highly effective wallet drainers.

Prevention

• Read before you sign. Your wallet shows you what a transaction does. If it asks you to approve a contract you do not recognize, reject it.
• Use transaction simulation tools like Blowfish, Pocket Universe, or built-in wallet simulations that show you the expected outcome of a transaction before you confirm it. Use our signature decoder to understand what off-chain signatures authorize.
• Keep valuable assets in a separate wallet that you never connect to unknown sites. Use a “burner” wallet with limited funds for exploring new protocols.
• Revoke old approvals regularly using tools like Revoke.cash. Stale approvals from months ago can be exploited if the approved contract is compromised.

Fake Airdrops and Token Claims

Airdrops — free token distributions from projects rewarding early users — are a legitimate part of crypto. Major airdrops like Uniswap's UNI, Arbitrum's ARB, and Jito's JTO distributed thousands of dollars to eligible wallets. But scammers have weaponized the airdrop concept to create one of the most pervasive crypto fraud categories.

Dusting Attacks

In a dusting attack, the scammer sends tiny amounts of a fake token directly to thousands of wallets. The token name is often designed to lure you to a phishing site — something like “$2,500 USDT Reward — Claim at reward-site.com” or “Visit AirdropClaim.xyz.” The tokens appear in your wallet uninvited. If you visit the site and connect your wallet to “claim” or sell, you are actually connecting to a drainer.

Some dusting tokens are programmed so that any attempt to interact with them — including trying to send them away or approve them for trading — triggers a malicious contract function. The safest response to unknown tokens in your wallet is to ignore them entirely. They cannot harm you unless you interact with them.

Claim Site Scams

The most common version: a website claims you are eligible for a large airdrop. You connect your wallet, the site shows an impressive token balance “available to claim,” and the claim button triggers either a drainer transaction or a token approval that gives the attacker access to your real assets. The fake claim amount is generated by the scammer's front-end code — there are no real tokens to claim.

These sites are promoted aggressively on social media, often through compromised accounts of real crypto influencers or projects. During major airdrop seasons, dozens of fake claim sites appear for every legitimate airdrop.

How to Verify Real Airdrops

• Check the project's official website and social accounts. Legitimate airdrops are announced through official channels. Go to the project's real website (from your bookmarks, not from a link) and look for airdrop information there.
• Verify the claim contract. Real airdrops use verified, audited contracts. Check the contract address on a block explorer — is it verified? Does it match what the official project has published?
• Be skeptical of unsolicited notifications. If you did not actively use a protocol, you are unlikely to be eligible for its airdrop. Most airdrops reward specific on-chain activity, not random wallets.
• Real airdrops never ask you to send funds first. If a “claim process” requires you to send ETH or any other token to receive the airdrop, it is a scam. Period.

Use our live scam tracker to check if a specific airdrop claim site has been reported.

Rug Pulls and Exit Scams

A rug pull happens when a project's creators abandon it and take investors' money. The term comes from the idea of pulling the rug out from under someone. Rug pulls are one of the most common and financially devastating scams in DeFi, accounting for billions of dollars in losses since the 2020 DeFi summer.

Hard Rug Pulls

In a hard rug, the attacker exploits a technical mechanism to steal funds instantly. The most common version: a token creator adds liquidity to a decentralized exchange (like Uniswap), promotes the token to attract buyers, watches the price rise as people buy in, and then removes all the liquidity in a single transaction. The token becomes untradeable and worthless instantly. Some hard rugs use backdoor functions in the smart contract — mint functions that create unlimited tokens, or fee functions that prevent anyone except the creator from selling.

Soft Rug Pulls

Soft rugs are slower and harder to identify. The team gradually loses interest, stops developing, reduces communication, and quietly sells their token holdings over weeks or months. There is no dramatic exit — the project just fades away while insiders cash out. Soft rugs exist in a gray area between outright fraud and simple project failure, which makes them harder to prosecute and harder for victims to accept.

How to Spot Rug Pull Warning Signs

• Anonymous team with no verifiable track record. Not all anonymous teams are scammers, but anonymity eliminates accountability. If the team is anonymous, every other signal needs to be stronger.
• Unlocked liquidity. If the liquidity pool tokens are not locked or burned, the creator can remove liquidity at any time. Check if liquidity is locked using a block explorer or our risk scanner.
• Unaudited or unverified contracts. A verified contract on Etherscan or similar explorers means the source code is publicly readable. An audit from a reputable firm adds another layer of trust. Neither guarantees safety, but their absence is a red flag.
• Concentrated token holdings. If the top 5 wallets hold 80% of the token supply, a coordinated sell-off can destroy the price. Check token distribution on a block explorer.
• Unrealistic promises. Projects promising “1000x returns” or “guaranteed profit” are almost always scams. Legitimate projects talk about technology, product-market fit, and roadmaps — not price targets.
• Copy-pasted or forked code with no original development. Many rug pull tokens are deployed using templates with minor modifications. If the contract is a straight copy of another token with just the name changed, be cautious.

For a deeper dive into this specific scam type, see our dedicated how to avoid rug pulls guide.

Social Engineering Scams

Social engineering attacks target the person, not the technology. These scams rely on building trust, exploiting emotions, and manipulating victims into voluntarily handing over funds or access. They are often the most financially devastating because they bypass every technical safeguard — your hardware wallet, your antivirus software, your secure browser — by convincing you to take the harmful action yourself.

Fake Support Scams

This is one of the simplest and most persistent scams in crypto. It works like this: you post a question or complaint on Twitter, Reddit, Discord, or Telegram about a wallet issue or exchange problem. Within minutes, someone claiming to be from “official support” sends you a direct message offering to help. They direct you to a fake support portal, ask you to “verify your wallet” by entering your seed phrase, or ask you to connect to a “support tool” that is actually a drainer site.

The rule is absolute: no legitimate support team will ever DM you first. No legitimate service will ever ask for your seed phrase, private keys, or wallet password. If someone reaches out to you claiming to be support, they are a scammer. Always initiate support conversations yourself through the official website.

Romance and Pig Butchering Scams

“Pig butchering” (a term derived from the Chinese phrase for fattening a pig before slaughter) is a long-term confidence scam that has become one of the highest-grossing fraud categories globally. The FBI estimated that pig butchering scams caused over $3.9 billion in losses in the United States alone in 2023.

The scam follows a pattern: the attacker initiates contact through a dating app, social media, or even a “wrong number” text message. Over weeks or months, they build a personal relationship — romantic, friendly, or mentorship-based. Eventually, they introduce the topic of cryptocurrency investing and share stories of their own incredible returns. They guide the victim to a fake exchange platform that shows fabricated profits on paper. The victim deposits more and more real money, seeing their “balance” grow on the fake platform. When the victim tries to withdraw, the scammer claims there are “tax fees” or “regulatory holds” that require additional deposits. Eventually, the scammer disappears with all the funds.

These scams are often operated by large criminal organizations, sometimes using trafficked workers forced to conduct the scam operations. The emotional and financial damage to victims is severe.

Impersonation Scams

Scammers impersonate well-known figures — Vitalik Buterin, CZ, Elon Musk, popular crypto YouTubers — on social media, YouTube live streams, and Telegram. The typical format is a fake giveaway: “Send 1 ETH, receive 2 ETH back.” Despite how obviously fraudulent this sounds, these scams continue to generate millions in revenue because they exploit the authority and trust associated with recognized names.

YouTube live stream scams are particularly effective. Scammers use deepfake or pre-recorded video of a known figure, overlay it with a fake giveaway banner, and run it as a live stream with a title referencing current crypto events. YouTube's moderation has improved but still struggles to catch these streams before they accumulate thousands of viewers.

Recovery Scams

Perhaps the cruelest variant: scammers who specifically target people who have already been scammed. They monitor social media for people posting about crypto losses, then contact them claiming to be “blockchain recovery experts” or “crypto investigators” who can retrieve the stolen funds. They charge upfront fees, request access to the victim's wallet, or both. The recovery never happens. The victim loses money twice.

Token Approval Exploits

Token approvals are a fundamental part of how DeFi works, but they are also one of the most underappreciated security risks for everyday crypto users. Understanding how approvals work is essential to protecting your assets.

How Token Approvals Work

When you use a decentralized exchange, lending protocol, or any DeFi application, it needs permission to move your tokens. The ERC-20 standard includes an approve() function that lets you grant a specific smart contract permission to spend a specific amount of a specific token from your wallet. For example, if you want to swap 100 USDC on Uniswap, you first approve Uniswap's router contract to spend up to 100 USDC from your wallet, and then you execute the swap.

The problem is that many DeFi interfaces request unlimited approvals by default. Instead of asking for permission to spend exactly 100 USDC, they ask for permission to spend an unlimited amount of USDC from your wallet, forever — or until you explicitly revoke the approval. This is done for convenience (you do not have to re-approve every time you trade), but it creates a persistent security risk.

Why Unlimited Approvals Are Dangerous

If you have granted unlimited approval to a smart contract, and that contract is later hacked, the attacker can drain all of that token from your wallet — not just the amount you originally intended to trade. There have been multiple real-world examples of this: exploited protocols where the attacker used existing user approvals to drain tokens from users who had interacted with the protocol months or years earlier.

Even if the protocol itself is never hacked, if you accidentally grant unlimited approval to a malicious contract (through a phishing site or drainer), you have given the attacker permanent permission to take that token from your wallet whenever they choose. Many drainer attacks specifically target existing approvals rather than creating new ones.

How to Manage Approvals

• Prefer limited approvals. When your wallet asks you to approve a token spend, manually edit the amount to match what you actually intend to trade. Some wallets (like MetaMask) allow you to set a custom approval amount during the approval transaction.
• Revoke old approvals regularly. Use tools like Revoke.cash, Etherscan's token approval checker, or our security checklist to review and revoke approvals you no longer need. Make this a monthly habit.
• Understand Permit2. Uniswap's Permit2 contract consolidates token approvals into a single contract with time-limited and amount-limited permissions. If a protocol uses Permit2, your exposure is reduced because approvals can expire automatically. However, Permit2 signatures can also be exploited by drainers if you sign a malicious permit.
• Use multiple wallets. Keep your long-term holdings in a wallet that never interacts with DeFi. Use a separate “active” wallet for trading and DeFi, and keep only the funds you need for current activities in it. This limits the blast radius if any approval is exploited.

For more on how to structure your wallet setup, see our how to store crypto safely guide and the crypto wallets explained guide.

Investment and Ponzi Schemes

Ponzi schemes are as old as finance itself, but crypto has given them a fresh coat of paint and new distribution channels. The fundamental structure is unchanged: early investors are paid “returns” using money deposited by later investors. The scheme collapses when new deposits slow down and there is not enough money to pay existing participants.

Guaranteed Returns

The biggest red flag in all of crypto: any project, platform, or individual promising guaranteed returns. You see it phrased as “earn 1% daily,” “guaranteed 10% monthly,” or “risk-free 300% APY.” No legitimate investment can guarantee returns. Even the best DeFi protocols experience yield compression, smart contract risks, and market volatility. If someone guarantees a specific return, they are either lying or running a Ponzi where early depositors are paid with new deposits.

Some schemes hide behind complex DeFi terminology to obscure their Ponzi mechanics. They describe “algorithmic yield optimization” or “AI-driven trading strategies” without transparency about how the yield is actually generated. If you cannot understand where the yield comes from — who is paying for it and why — you should not deposit funds.

Celebrity Endorsement Scams

Scammers use fabricated celebrity endorsements to promote fraudulent platforms and tokens. These range from fake news articles claiming a celebrity has endorsed a crypto platform, to deepfake videos of public figures promoting investment opportunities, to paid promotions by influencers who do not disclose their financial arrangements or do not investigate the projects they promote.

A celebrity or influencer promoting a token tells you nothing about its legitimacy. Many influencers have been paid to promote tokens that turned out to be scams, and some have been sued or charged for doing so. Evaluate projects on their technical merits, team track record, and token economics — not on who is talking about them on social media.

Pump and Dump Groups

Private Telegram and Discord groups that coordinate buying a low-liquidity token to inflate its price (the pump), then sell at the top (the dump), leaving latecomers with worthless tokens. These groups are often marketed as “trading signals” or “investment communities.” The group organizers buy before announcing the pump to their members, meaning even participants who think they are in on the scheme are usually the ones being dumped on.

If you are invited to a group that coordinates token purchases, you are not getting an insider advantage — you are the exit liquidity. The organizers profit because you and people like you buy after they have already bought at a lower price.

Yield Farming Scams

High-yield farming protocols that offer impossibly high APYs (10,000%+) to attract deposits. The yield is typically paid in a governance token that the protocol creates out of thin air. As more people farm, the governance token's price collapses under sell pressure, and the “high yield” becomes worthless in dollar terms. Some of these are not outright scams — they are simply unsustainable economic designs. But many are designed to extract value from late participants while insiders profit from early access and token allocations.

How to Protect Yourself

The good news is that most crypto scams are preventable. They rely on urgency, confusion, and trust exploitation — all of which you can defend against with consistent habits. Here is a comprehensive checklist that covers the most important protections.

Wallet Security

• Use a hardware wallet for significant holdings. A hardware wallet like Ledger or Trezor keeps your private keys offline and requires physical confirmation for every transaction. It does not make you immune to scams, but it eliminates remote theft and malware-based attacks. See our how to store crypto safely guide.
• Use separate wallets for different purposes. At minimum, maintain a “vault” wallet (hardware, never connects to DeFi), an “active” wallet (for regular DeFi use), and a “burner” wallet (for minting, claiming, and exploring unfamiliar protocols). Use our self-custody planner to design your wallet structure.
• Never share your seed phrase. No legitimate person, service, platform, support agent, or smart contract will ever need your seed phrase. If anything asks for it, it is a scam. Write it down on paper, store it securely offline, and never enter it into any website or application except when restoring your wallet in the official wallet software. Use our seed phrase analyzer to check your backup strategy (no phrase submission required).

Transaction Habits

• Read every transaction before signing. Your wallet shows you what you are approving. Take the time to understand it. If a “free mint” is asking you to approve token spending, something is wrong.
• Use transaction simulation tools. Extensions like Blowfish and Pocket Universe show you what a transaction will do before you confirm it. They catch many (but not all) malicious transactions.
• Set limited approvals. When approving token spending, set the amount to what you actually need instead of accepting the default unlimited approval.
• Revoke old approvals monthly. Treat it like changing your passwords. Stale approvals from protocols you no longer use are unnecessary risk.
• Send a small test transaction first. When sending crypto to a new address, send a tiny amount first and confirm it arrived before sending the full amount.

Verification Habits

• Bookmark everything. Keep bookmarks for every exchange, wallet interface, and DeFi protocol you use. Access them through bookmarks, not search engines or links.
• Verify announcements through multiple sources. If you see an airdrop or event announcement, check the project's official website, their verified social accounts, and community channels independently.
• Distrust urgency. Scams almost always create time pressure. A real opportunity does not disappear in 10 minutes. If you feel rushed, stop and verify.
• Research before you invest. Read the smart contract (or have someone you trust read it), check the audit status, verify the team, and understand the token economics before putting money in.

Reporting Scams

If you encounter a scam, reporting it helps protect others even if your own funds cannot be recovered:

• Report to law enforcement. In the US, file a report with the FBI's Internet Crime Complaint Center (IC3). In the UK, report to Action Fraud. In the EU, contact your national cybercrime unit.
• Report the scammer's addresses. Flag the wallet address on block explorers like Etherscan (using their report feature) so it gets labeled for other users.
• Report phishing sites. Use Google Safe Browsing reports, PhishTank, and browser extension reporting features to get phishing domains blacklisted.
• Alert the community. Report scam accounts on social media and warn others in relevant community channels, but verify your information before making public accusations.

Track active scam campaigns and report new ones through our live scam tracker.

The Three Rules That Prevent Most Scams

If you remember nothing else from this guide, remember these three rules. Following them consistently would prevent the vast majority of crypto scams:

1. Never share your seed phrase with anyone, for any reason, ever. There are zero legitimate exceptions to this rule.
2. If it sounds too good to be true, it is. Guaranteed returns, free money, celebrity giveaways — they are all scams. Every single time.
3. When in doubt, do nothing. Close the tab. Do not sign. Do not send. Come back later with fresh eyes and verify through official channels. The cost of missing a real opportunity is almost always lower than the cost of falling for a scam.