Crypto offers innovation and opportunity. It also attracts fraud. This guide expands beyond short warnings and gives you specific indicators, real-case examples, and practical defenses for each scam type. Read this before you click, invest, or sign.
1. Phishing Attacks
How it works: Attackers clone websites, send spoofed emails or DMs, or create fake wallet-connect popups to capture credentials, private keys, or sign malicious transactions.
Real example
The attacker sends a DM from a copied influencer account linking to a “wallet connect” page. The victim approves a transaction that grants an allowance for the attacker to sweep funds.
How to detect
- Check the URL character-for-character and certificate (padlock).
- Hover links before clicking; inspect the domain and avoid URL shorteners.
- Be suspicious of unsolicited DMs promising rewards or urgent action.
Immediate defenses
- Never paste your seed phrase or private key into a website or app.
- Verify wallet-connect prompts on the device (hardware wallet) and review every field on the device screen.
- Use a dedicated browser profile for web3 activity with minimal extensions.
2. Rug Pulls / Exit Scams
How it works: Developers create a token and/or liquidity pool, attract capital, then drain liquidity or disable transfers.
Real example
Tokens launched with large team allocations and unlocked liquidity. After a short pump, the deployer performed a liquidity removal. The token price collapsed and investors could not recover funds.
Red flags
- LP tokens not locked or ownership not renounced.
- Top wallets hold a very large % of supply.
- Anonymous team and heavy influencer-led hype with little technical disclosure.
How to avoid
- Check LP lock status and team vesting on-chain (look for timelocks and multisig).
- Review token holder distribution (top holders >30–40% is risky).
- Prefer projects with verified audits and public, on-chain liquidity locks.
3. Fake Airdrops and Giveaways
How it works: Scammers promise free tokens; victims are asked to send a small amount or sign a message that gives approval to drain funds.
How to detect
- Legitimate airdrops never require you to send funds first.
- Official airdrops are announced on verified channels and documented with clear eligibility criteria.
How to avoid
- Confirm announcements on the project's verified website and official social channels.
- Never sign transaction approvals or messages you do not understand.
4. Pump-and-Dump Schemes
How it works: Coordinated groups buy a low-liquidity token, hype it to attract retail buyers, then sell heavily, collapsing the price.
Red flags
- Sudden, unexplained social-media hype and rising mentions from newly created accounts.
- Huge volume spikes on low-liquidity tokens with no real product news.
How to avoid
- Avoid buying into tokens that show pump behavior or that lack real liquidity/depth.
- If you trade such assets, use very small position sizes and predefined exit rules.
5. Impersonation & Support Scams
How it works: Fraudsters impersonate exchange support, project teams, or influencers and ask for credentials or sign requests.
Real example
Users receive messages from accounts named “Support” on Telegram that mimic exchange support and instruct users to sign a transaction to “verify” accounts.
How to avoid
- Official support will never ask for your seed phrase or to sign arbitrary transactions.
- Contact support only through verified channels on the official website. Use case/ticket numbers and two-way verification.
6. SIM Swap & Account Takeover
How it works: Attackers port your phone number to a new SIM, intercept SMS 2FA, and reset passwords to withdraw funds.
Prevention
- Use authenticator apps (Google Authenticator, Authy) or hardware 2FA keys (U2F) instead of SMS.
- Set PIN/password protections with your mobile operator and enable account recovery protections.
7. Smart-contract and DeFi-specific Scams
How it works: Malicious or buggy contracts enable hidden minting, admin drains, or backdoors. Fake audits or copy/paste contracts with changed parameters are common.
Detection
- Verify contract source on Etherscan and read key functions (owner transfer, minting, pausing).
- Check audit reports for unresolved critical findings.
Prevention
- Do not interact with contracts unless you understand what functions you invoke.
- Simulate transactions (Tenderly, Etherscan read/write) before executing significant actions.
8. What to do if you’re targeted or scammed
- Stop interacting immediately. Do not sign more transactions.
- Revoke approvals using Revoke.cash or Etherscan token approval checker to remove malicious allowances.
- Move unaffected funds to a new secure wallet (create on an air-gapped or hardware device).
- Contact platforms (exchanges, wallet providers) and request withdrawal holds if funds are on a centralized service.
- Collect evidence: save URLs, TXIDs, screenshots, and message logs.
- Report: file reports with the exchange, social platforms, local law enforcement, and specialist groups (IC3 in the US, Action Fraud in the UK). Contact blockchain analysis firms if funds moved on-chain.
- Consider professional help: Recovery firms and legal counsel can assist but check credentials and fees; recovery is often difficult and not guaranteed.
9. Practical prevention checklist
- Use hardware wallets and verify addresses on-device.
- Enable U2F/WebAuthn hardware keys for important accounts.
- Prefer authenticator apps over SMS for 2FA; avoid SMS 2FA where possible.
- Use read-only API keys for third-party services (disable withdrawals).
- Audit links and domains; bookmark trusted sites and never follow unknown links for sensitive actions.
- Limit extensions and use a clean browser profile for Web3 activity.
- For teams/treasuries, use multisig with independent signers and timelocks.
10. Tools & resources
- Revoke.cash / Etherscan token approval checker — revoke malicious allowances.
- Etherscan / BscScan — contract verification and holder checks.
- Token Sniffer, RugDoc, DeFiSafety — heuristics for token risk (use as a signal, not a final verdict).
- CertiK, OpenZeppelin — audits and security firms.
- Chainalysis, CipherTrace — for tracing stolen funds (used by law enforcement).
11. Conclusion
Scams evolve. The most reliable defense is the combination of technical checks (contract verification, audits), operational hygiene (hardware wallets, 2FA, read-only APIs), and behavioral rules (don’t rush, verify sources, test small transfers). If you suspect fraud, act immediately: revoke approvals, secure remaining funds, gather evidence and report widely. Use this guide as a living checklist and keep tools and procedures up to date.
Disclaimer: This guide provides practical information but not legal advice. For large losses or complex cases consult qualified legal, security, or recovery professionals.
