How to Avoid Crypto Scams

As crypto adoption grows, scams have become more targeted and technical. This guide expands beyond general warnings. It explains major scam types, concrete detection checks, step-by-step defensive measures, and what to do if you are targeted or scammed.

1. Core scam types and how they work

Phishing (websites, emails, wallets)

Scammers clone exchange or wallet sites or send emails/DMs to trick you into entering private keys, seed phrases or API keys. They may use look-alike domains, subdomains, URL shorteners, or malicious browser extensions.

Rug pulls / Exit scams (DeFi & token launches)

Developers create tokens or liquidity pools, pump interest, then withdraw liquidity or disable transfers. Look for anonymous teams, small initial liquidity, and manual liquidity locks.

Ponzi / High-yield schemes

Promises of risk-free, guaranteed returns (high APY) paid from incoming investors. Unsustainable and collapses when inflows stop.

Fake wallets / Fake apps

Cloned mobile apps or browser extensions that harvest keys. Often promoted via social posts or ads.

Impersonation & social engineering

Scammers impersonate influencers, project teams, or customer support. They may ask you to authorize transactions or sign messages.

SIM swap & account takeover

Attackers port your phone number to steal 2FA SMS codes and reset account passwords.

DeFi / smart-contract traps

Hidden backdoors, malicious contract code, or token contracts that mint unlimited supply or change ownership functions. Audits may be fake or out of date.

2. Red flags checklist (quick screening)

• Anonymous or unverifiable team. No working LinkedIn, Github or public history.
• Unusual tokenomics: tiny initial liquidity but huge allocations to team/wallets.
• Smart contract not verified on Etherscan/BscScan, or source code missing.
• Websites with misspellings, HTTP only, or odd subdomains (e.g., login-binance[.]com).
• Unsolicited DMs asking you to sign messages, reveal seed phrase, or ‘verify’ your wallet.
• Promises of guaranteed returns, referral rewards that require a deposit, or pressure to act fast.

3. How to verify a project or token — step by step

1. Check contract code: open the token contract on Etherscan/BscScan. Confirm source code is verified and readable.
2. Audit reports: look for audits from reputable firms (CertiK, OpenZeppelin, Trail of Bits). Read the findings — not just the summary.
3. Liquidity and holders: inspect liquidity pool on the DEX and top holders on the contract page. A single wallet owning >30–40% is a risk.
4. Ownership & renounce: check if ownership/administrative keys are renounced or timelocked. Renounced ownership reduces some risks (but not all).
5. Community & comms: verify official channels (website, Twitter, Discord). Look for coherent public discussion, real activity and third-party coverage.
6. Token distribution & vesting: confirm team allocations have vesting schedules available on-chain or in the whitepaper.

4. Practical defenses you can apply right now

• Keep keys offline: Use hardware wallets (Ledger, Trezor) for custody. Never paste your seed/private key into a website or app.
• Use read-only APIs: When connecting exchanges to tools, create API keys with read-only rights and disable withdrawals.
• Limit browser risk: avoid signing transactions from browser wallets on unknown sites. Use a clean browser profile or dedicated device for web3 activity.
• Two-factor & email hygiene: use authenticator apps (not SMS) and a unique, strong email for crypto accounts. Protect email with 2FA and a hardware key (U2F/WebAuthn) if possible.
• Small test transfers: always send a small test amount to new addresses or contracts before large transfers.
• Multi-sig for treasury: for teams or large holdings use multisignature wallets so no single key can move funds.
• Contract simulation: use tools (Tenderly, Etherscan ‘read’ and ‘write’ functions) to simulate calls before executing unusual contract interactions.
• Check DNS and TLS: confirm site uses TLS and the certificate matches the vendor. For exchanges, bookmark the official URL rather than following links.

5. If you are targeted or suspect a scam — immediate steps

1. Stop interacting. Do not sign messages, approve allowances, or send funds.
2. Revoke approvals. Use token approval checkers or Revoke.cash to remove dangerous allowances from malicious sites.
3. Move remaining funds. If keys are secure, move assets to a fresh wallet (hardware wallet recommended). If you suspect compromise, assume the attacker knows the keys and transfer immediately from a secure environment.
4. Freeze accounts with exchanges. Contact exchange support immediately and request withdrawal holds if a centralized exchange is involved.
5. Gather evidence. Save screenshots, URLs, transaction IDs, phishing messages, and any correspondence.
6. Report: file reports with the exchange, platform (Twitter/X, Telegram), local law enforcement, and industry bodies (e.g., IC3 in the U.S.). For DeFi scams, report to CertiK, Etherscan, Chainalysis or the DEX’s admin channels.
7. Seek recovery help: If funds moved on-chain, specialized recovery firms or law enforcement with blockchain tracing may help — but recovery is difficult and often costly.

6. Examples & short case studies

Example A — Twitter DM phishing

A user receives a DM from a verified-looking account promising an airdrop. The link opens a page that looks like a wallet connect dialog and asks to sign a message. Fix: do not sign; check the wallet request details on your hardware device; verify the profile via other sources; report the account.

Example B — Rug pull on a new token

A token is launched with heavy social buzz and a tiny liquidity pool. Hours after liquidity grows, the deployer removes liquidity. Prevention: check LP token lock status, look at the team wallets, and avoid tokens where the developer wallet holds most supply.

Example C — SIM swap takeover

Attacker ports phone, resets exchange 2FA (SMS) and withdraws funds. Prevention: use authenticator apps or hardware 2FA keys and enable a PIN/password with your mobile operator.

7. How to report scams and who to contact

• Exchanges: open support tickets, request withdrawal blocks and provide TXIDs/evidence.
• Social platforms: report phishing/impostor accounts on Twitter/X, Discord, Telegram.
• Blockchain analysis firms: CertiK, Chainalysis and others sometimes assist or publish alerts.
• Law enforcement: file a report with local police and cybercrime units; in the U.S. consider IC3.gov.

8. Simple pre-commit checklist (one page)

• Is the domain TLS enabled and correct? Bookmark official site.
• Is the contract verified on Etherscan/BscScan? Read source code or ask a developer to review.
• Is liquidity meaningful and locked? Are team tokens vested?
• Are audit reports available from reputable firms? Read the findings.
• Is the team public and verifiable? Check GitHub, LinkedIn, past projects.
• Use hardware wallet for all approvals and verify addresses on-device.
• Perform a small test transaction first.

9. Tools & resources

• Etherscan / BscScan — contract verification, holder and tx inspection.
• Token Sniffer, RugDoc, DeFiSafety — quick token / project signals (use as input, not definitive).
• CertiK, OpenZeppelin — professional audits.
• Revoke.cash / Etherscan token approval checker — revoke malicious allowances.
• Hardware wallets — Ledger, Trezor.

10. Final advice

Defense is layered: technical checks (contract & audit), operational hygiene (hardware wallets, 2FA, read-only APIs), and behavioural rules (never rush, test small amounts, verify people and domains). Remove the outdated “playbooks” section and focus on verifiable checks and straight procedures. If you lose funds, act fast, gather evidence and report immediately — recovery is uncertain but timely action increases the chances.

Disclaimer: this guide is informational and does not constitute legal or financial advice. Laws and best practices change. For high-value holdings or complex cases consult a qualified security or legal professional.

Further reading

Apps & Wallets | Altcoin Analysis