How to spot a crypto scam

Crypto scams look endlessly varied and are not. Almost all of them are one of a small number of patterns wearing a new logo, and the patterns have barely changed in a decade. Learning the shapes is far more useful than keeping a list of bad projects, because the list is out of date by the time it is published.

One structural thing to hold onto first: transactions are irreversible and there is no chargeback. Every protection you have is exercised before you sign, which is why all of the advice below is about recognising something in advance rather than recovering afterwards.

1. The rug pull

A new token launches with heavy marketing. Enough people buy in. The people who made it drain the liquidity, or mint themselves an unlimited supply and sell it, and the price goes to nothing in minutes.

The tells: an anonymous team with no track record; a contract nobody has audited; supply concentrated in a handful of wallets; marketing that talks about the price rather than the product; a launch that pressures you to buy in the next few hours. An explorer will show you how the supply is distributed and when the contract was deployed, and a contract deployed yesterday holding most of its own supply tells you what you need to know.

2. The fake airdrop

Tokens you did not ask for appear in your wallet, or a post announces a claim window for a project you have used. The claim page asks you to connect your wallet and approve a transaction.

The tells: you were not expecting it; the link came from a reply, a DM, or a search advertisement rather than the project's own channel; there is a deadline. Unsolicited tokens in a wallet are frequently bait — interacting with them is the trap, so the correct response is to ignore them entirely. Never connect a wallet to claim something you did not already know was coming.

3. Approval draining

The most important one to understand, because it does not need your seed phrase and does not look like theft while it is happening. When you use a decentralised app, you grant its contract permission to move specific tokens on your behalf. A malicious contract asks for a permission that is broader than it appears — and once granted, it can move those tokens later, at a time of its choosing, without asking again.

The tells: a signature request you cannot read, on a site you arrived at from a link, that asks for permission over a token you were not trying to trade. Wallets increasingly warn about unlimited approvals; take the warning seriously. Review and revoke old approvals periodically — anything you granted to a site you no longer use is a door left open.

4. Impersonation and fake support

You post a problem in a public channel. Within minutes someone helpful messages you privately, claiming to be support for the wallet or exchange. They walk you to a “validation” or “sync” page that asks for your seed phrase, or they ask you to share your screen.

The tell is the direction of contact. Real support does not message first. Combine that with the absolute rule from Wallets & Keys 101: no legitimate service, ever, under any circumstances, needs your seed phrase. There is no scenario where typing it into a page is correct. Treat every request as theft, because it is.

5. The long-con investment scam

Contact begins somewhere unrelated to crypto — a dating app, a professional network, a wrong-number message that turns into weeks of friendly conversation. Eventually an investment opportunity comes up: a platform with a polished interface showing your balance growing. Small withdrawals succeed, which builds confidence. Larger ones require a fee, then a tax, then a compliance deposit. None of the money was ever invested and the interface was a display.

The tells: the relationship came first and the opportunity second; the platform is not one you can find independently; withdrawals require paying money in. That last one is the clearest signal in this entire page — a genuine platform deducts fees from your balance. Being asked to deposit in order to withdraw means there is nothing there.

This category takes more money than the technical attacks, and it targets patience rather than ignorance. Knowing how blockchains work is no protection at all.

6. Recovery services

After a loss, someone offers to trace and recover the funds for an upfront fee. They are the same people, or people who bought the list. Nobody can reverse a confirmed transaction — not a service, not a hacker for hire, not a lawyer. Money spent here is money lost twice.

The general test

Before signing anything, four questions catch most of it:

• Who started this? If they contacted you, the base rate of legitimacy is very low.
• Why is there a deadline? Urgency exists to stop you checking. Real opportunities survive an hour of research.
• What am I actually signing? If you cannot read it, do not sign it. That alone prevents the approval attacks.
• Does this require me to pay to get paid? If so, it is a scam. There is no legitimate version of this.

And the oldest rule, which survives because it keeps working: guaranteed returns do not exist. Anyone promising a fixed yield on a volatile asset is either lying or does not understand their own product, and from where you are standing those look identical.

If it has already happened

Move any remaining funds to a new wallet with a new seed phrase — not the compromised one. Revoke outstanding contract approvals. Record the transaction hashes; they are permanent evidence and are what any legitimate investigation would work from. Report it to your national fraud or cybercrime authority and, if an exchange was involved, to the exchange, which can sometimes freeze funds that reach it. Then ignore everyone who offers to get it back for a fee.

Losing money to one of these is not a sign of stupidity. These are professional operations run at scale against people who were being reasonable, and the ones that work best exploit patience and courtesy rather than ignorance.