Security · 10-11 min read
Crypto fraud and theft drain an estimated $9-14 billion from investors every year. What makes those losses so brutal is not the size of the number but its finality: there is no chargeback, no fraud department, no regulator that can claw the money back. Once a transaction is confirmed on-chain, it is settled forever.
That asymmetry flips the usual logic of financial safety. In traditional banking, protection happens after the fact. In crypto, prevention is the only protection there is. This guide walks through the scams that are actually taking people’s money right now, the psychology that makes them work, and the specific habits that shut them down.
Quick Reference: Eight Scams at a Glance
| Scam | Telltale sign | Primary defense |
|---|---|---|
| Phishing | Urgent email or DM with a login link | Bookmarks only; hardware 2FA key |
| Fake support | Someone contacts you offering help | Never share a seed phrase, ever |
| Romance / pig butchering | Online partner with a “special” platform | No investing on referrals from people you have not met |
| Rug pulls | Anonymous team, unaudited contract | Contract screening before you buy |
| Fake airdrops | Unrequested tokens, “claim” sites | Ignore them; audit token approvals |
| Pump and dump | Telegram “insider” tips on obscure coins | Treat anonymous tips as marketing |
| Celebrity giveaways | “Send 1 BTC, get 2 back” | No exceptions – always a scam |
| Malware | Pasted address does not match | Verify first and last characters every time |
1. Phishing
Phishing uses counterfeit websites, emails, and messages that impersonate legitimate services in order to harvest login credentials, private keys, or seed phrases. It remains the single most productive attack in crypto because it needs no technical exploit — only a moment of inattention.
How it works. An email arrives that looks like it came from your exchange or wallet provider: your account has been suspended, unusual activity was detected, a withdrawal is pending approval. The link leads to a pixel-accurate clone of the real site, which captures whatever you type — and in the worst version, asks you to “re-verify” your seed phrase.
How to avoid it. Stop clicking links in messages about your money. Reach crypto services by typing the address yourself or using saved bookmarks, and read the URL character by character before entering anything. Where a service supports hardware security keys (U2F/FIDO2), use them as your second factor: unlike codes, a security key cryptographically checks the domain, so it simply will not authenticate on a lookalike site.
2. Fake Support
Scammers scan X, Discord, Reddit, and Telegram for anyone publicly complaining about a stuck transaction or a locked account. Within minutes, a helpful “support agent” appears in your DMs, walks you through a plausible troubleshooting flow, and steers you toward a malicious site or a request for your recovery words.
The rule that ends this attack: legitimate support never contacts you first, and no legitimate employee of any company will ever need your seed phrase, private key, or wallet password. There is no edge case, no verification procedure, and no emergency in which that request is genuine.
3. Romance Scams and “Pig Butchering”
This is the fastest-growing and most financially devastating category in crypto fraud, typically run by organized criminal operations rather than lone actors. The approach begins on a dating app, a social platform, or an apparently misdirected text message, and the relationship is cultivated patiently for weeks or months before money is mentioned at all.
Eventually the new partner or friend mentions their success on a private investment platform. The site looks polished and the balance climbs convincingly, because the numbers are fabricated. Deposits grow. When the victim finally tries to withdraw, a new obstacle appears: taxes owed, a compliance fee, an insurance deposit required before funds can be released. The withdrawal never arrives. Individual losses commonly land between $100,000 and $500,000, and often include borrowed money.
How to avoid it. Treat any investment suggestion that arrives through a romantic or social connection online as fraud until proven otherwise. Never fund a platform you learned about from someone you have not verified in person, and check any platform against independent reviews and regulator warning lists before sending a cent. The tell is not the pitch — it is the fact that the relationship came first.
4. Rug Pulls
A team launches a token or NFT collection, manufactures momentum, collects real money, then drains the liquidity pool and vanishes. Because the code and the marketing are both under the founders’ control, the exit can happen in a single block.
Warning signs cluster together: an anonymous team with no verifiable track record, contract permissions that let developers mint unlimited supply or freeze withdrawals, no independent audit, guaranteed or outsized return promises, heavy influencer promotion with thin technical documentation, and a liquidity pool that is not time-locked.
Do the homework first. Contract screeners such as Token Sniffer, DEXTools, and GoPlus Security flag many of these patterns automatically in seconds — a trivial cost compared with what they can save you.
5. Fake Airdrops and “Free Token” Traps
Unfamiliar tokens appear in your wallet unprompted, or a post advertises a free airdrop that requires connecting your wallet to claim. The claim page then asks for token approval permissions, and that signature is the actual attack: it authorizes the contract to move your assets whenever it likes.
How to avoid it. Do not interact with tokens you did not request — not even to sell or transfer them. Skip claim sites promoted through social media entirely. And review your existing permissions periodically with revoke.cash or the token approval checker on Etherscan, revoking anything you no longer actively use.
6. Pump and Dump Schemes
Coordinated groups, usually organized in private Telegram or Discord channels, accumulate a thinly traded token, generate synthetic excitement to pull in outside buyers, then exit together. The chart spikes, the exit happens, and everyone who arrived on the hype is left holding the bag.
How to avoid it. An unsolicited tip about an obscure token from an anonymous source is not information, it is recruitment. Channels advertising “insider” calls are describing the scheme in their own marketing.
7. Celebrity Impersonation and Giveaway Scams
Fake accounts and hijacked verified profiles promise to double any crypto sent to a given address, often dressed up with a live-stream replay of a real interview to lend credibility. The structure itself is the giveaway: no genuine promotion has ever required you to send funds first in order to receive more back. If that is the mechanism, it is theft, full stop.
8. Malicious Software
Clipboard-hijacking malware sits quietly on a device and swaps any crypto address you copy for the attacker’s. You paste what you believe is your own deposit address and send the funds straight to a stranger. Related families steal wallet files or seed phrases stored on disk.
How to avoid it. After pasting any address, confirm the first and last several characters against the source before signing, and confirm them on your hardware wallet screen rather than on the computer. Keep seed phrases off any device that connects to the internet.
Why These Scams Work
Recognizing the mechanics is only half of the defense. Every scam above is engineered around a small set of predictable psychological levers, and noticing the lever being pulled is often faster than analyzing the offer itself.
- Manufactured urgency. “This window closes in four hours” exists to prevent you from thinking, checking, or asking anyone else.
- Borrowed authority. Familiar logos, spoofed domains, impersonated founders, and fabricated regulatory language all substitute recognition for verification.
- Social proof. Invented testimonials, doctored trading dashboards, and inflated community numbers make a fiction feel crowded and therefore safe.
- Reciprocity. Pig-butchering operations spend months giving attention and support, so the eventual request feels like a favor between friends.
- Greed – with cover. An implausible return only survives scrutiny when the levers above have already lowered your guard.
A useful habit: when you notice urgency, authority, and unusual profit arriving in the same message, treat that combination itself as the alarm.
Your Security Checklist
- Keep significant holdings on a hardware wallet, not on an exchange or a browser extension.
- Use a unique, strong password for every exchange and store them in a password manager.
- Prefer a hardware security key for two-factor authentication, an authenticator app where keys are unsupported, and never SMS.
- Bookmark every crypto service you use and reach them only through those bookmarks.
- Write your seed phrase down, verify it once, and store it offline in a secure physical location – never in a photo, note app, or cloud drive.
- Audit and revoke stale token approvals on a recurring schedule.
- Keep a separate low-balance hot wallet for DeFi experimentation, isolated from your main holdings.
- Verify any investment opportunity independently, before money moves rather than after.
The Bottom Line
Self-custody hands you complete control of your money and, with it, complete responsibility for protecting it. Nearly every loss described above came down to a single irreversible action taken under pressure — one click, one signature, one pasted address. Slowing down at exactly those moments is not paranoia; in a system without an undo button, it is the entire security model.
This content is for informational purposes only and does not constitute financial or legal advice. If you believe you have been targeted, report it to your local authorities and, in the United States, to the FBI’s Internet Crime Complaint Center (IC3).