Common Crypto Scams and How to Avoid Them

Crypto scams stole an estimated $3.9 billion in 2023 alone. The combination of irreversible transactions, pseudonymity, and many new and inexperienced users makes crypto an attractive target.

Knowledge is your best defence. Here are the most common attacks and exactly how to spot them.

Why Crypto Scams Work

Scammers exploit several features of crypto:

• Irreversibility: Once you send crypto, there's no chargeback
• Pseudonymity: Attackers are hard to trace
• Complexity: Many users don't fully understand what they're doing
• FOMO: Fear of missing out pushes people into rushed decisions
• Greed: Promises of unrealistic returns override rational thinking

The Most Common Crypto Scams

1. Phishing

Fake websites, emails, and apps impersonating legitimate crypto services. You enter your seed phrase or password, and it goes straight to the attacker.

Red flags:

• Slightly misspelled URLs (e.g., metamask-io.com instead of metamask.io)
• Unsolicited emails or messages with links
• Any site that asks for your seed phrase

Protection: Full phishing guide here.

2. Rug Pulls

Developers launch a new token, generate hype, attract investors, then suddenly withdraw all liquidity and disappear — leaving investors with worthless tokens.

Red flags:

• Anonymous team with no verifiable identities
• No code audit
• Promises of extraordinary returns
• Liquidity not locked
• Token contract with "mint" or admin access functions

Examples: Squid Game Token (2021) — rose 75,000% then dropped to near zero in minutes.

3. Pig Butchering (Romance Scams)

Long-term confidence scams where the attacker builds a romantic or friendly relationship over weeks or months before introducing a "investment opportunity." Victims send increasingly large amounts before the attacker disappears.

These are now among the largest-volume scams in crypto, often run by organized criminal groups.

Red flags:

• Someone online who's unusually interested in you
• Early introduction to a "great" crypto investment platform
• Profits shown on a fake platform (withdrawal attempts are then blocked)

4. Fake Exchanges and Platforms

Fraudulent platforms that look professional, let you "deposit" and see fake profits, then refuse to let you withdraw without paying additional "fees" (which also disappear).

Protection: Only use established exchanges. Verify URLs. Check reviews on multiple independent sources.

5. Giveaway Scams

"Send 1 ETH to receive 2 ETH back!" Legitimate projects and public figures never run these. Ever.

This includes deepfake videos of Elon Musk, Vitalik Buterin, or other prominent figures promoting fake giveaways.

Rule: If you have to send crypto to receive crypto, it's a scam. No exceptions.

6. Fake Support

Scammers monitor social media and forums for people with problems, then reach out posing as support staff. They'll ask for your seed phrase or remote access to your computer.

Rule: Real support never asks for your seed phrase. Never.

7. Pump and Dump

Organized groups accumulate a low-cap token, generate hype through social media, then sell once retail investors pile in.

Red flags: Coordinated social media buzz about a little-known token, promises of imminent price increases, Telegram/Discord groups promising signals.

8. Malicious Wallet Approvals (Token Drainers)

You connect your wallet to a malicious site and unknowingly approve a transaction that grants it unlimited access to your tokens.

Protection: Regularly audit your wallet approvals at revoke.cash. Never approve unlimited permissions for unfamiliar contracts.

9. Clipboard Hijacking

Malware that monitors your clipboard and replaces crypto addresses you copy with the attacker's address. You think you're sending to your address but you're sending to theirs.

Protection: Always verify the first 4 and last 4 characters of any address after pasting.

10. Dusting Attacks

Small amounts of unknown tokens sent to your wallet. Interacting with them (trying to sell or swap) can trigger a transaction that reveals your identity or grants malicious approvals.

Protection: Ignore unknown tokens that appear in your wallet.

The Universal Rules

1. No one ever needs your seed phrase — not support, not developers, not anyone
2. If it sounds too good to be true, it is — guaranteed returns don't exist in crypto
3. Take your time — scammers create urgency. Real opportunities wait.
4. Verify everything independently — don't click links, go directly to known URLs
5. When in doubt, don't — the cost of missing an opportunity is much less than the cost of a scam

What to Do If You've Been Scammed

• Stop sending funds immediately — additional "fees" to recover funds are part of the scam
• Document everything — screenshots, addresses, communications
• Report to authorities — FTC (US), Action Fraud (UK), Canadian Anti-Fraud Centre (Canada)
• Report to the platform — if an exchange was used, report the receiving address
• Warn others — post in crypto communities to prevent others being victimized

Unfortunately, recovery of stolen crypto is rare. Prevention is everything.

Continue Learning

• Phishing Protection — the most common attack in detail
• Seed Phrases — what scammers are always trying to steal
• Wallet Security — how to protect your setup
• Security Checklists — action items to secure your crypto today

---

For a comprehensive security framework, read Understanding Seed Phrases from the Mastering Crypto series.